Dear Team,

Kindly clarify on the following queries about the OPC UA specification Part 4 Services,

1.From my understanding after the GetEndpoints Service messages, the client sends a OpenSecureChannel request to the server which means the request is signed or signed & encrypted according the security policy in the desired endpoint. I saw the following lines in the specification Part 4 Services, pg.no 33,

‘The OpenSecureChannel request and response Messages shall be signed with the sender’s Certificate. These Messages shall always be encrypted. If the transport layer does not provide encryption, then these Messages shall be encrypted with the receiver’s Certificate.’ In this it is mentioned that the messages ‘shall’ always be encrypted. How does it rely on transport layer ?

and I also see another description in the OPC Unified Architecture Book by Wolfgang Mahnke, Stefan-Helmut Leitner, Matthias Damm as follows,

‘If the certificate is considered as trustworthy, then as the second step an OpenSecureChannel request secured in accordance to the Security Policy and the Security Mode is sent to the selected Session Endpoint of the server.’ Here, it highlights that the message is secured in accordance to the Security Policy and Security Mode so I request a clarification on the scenario if the security mode is sign ? Will the message be encrypted also ?

2. When the Message Security Mode is None then the Security Policy ‘must’ be None ?

3. X509IdentityToken specification Part 4 Services section 7.35.4

‘This token shall always be accompanied by a signature in the userTokenSignature parameter of ActivateSession if required by the SecurityPolicy. The Server should specify a SecurityPolicy for the UserTokenPolicy if the SecureChannel has a SecurityPolicy of None.’ In the first line it is mentioned that ‘if required by the SecurityPolicy’, what is context of ‘if required’ when the userTokenSignature is a required field for X509IdentityToken ? In the second line it is mentioned that a explicit Security Policy is required if the SecureChannel has a SecurityPolicy of None, where ‘None’ means no certificates are exchanged and so X509IdentityToken cannot be used, referring to the following lines in the same specification (Section 5.6.3 ActvateSession, pg.no: 40) ?
‘If the token is an X509IdentityToken then the proof is a signature generated with private key associated with the Certificate. The data to sign is created by appending the last serverNonce to the serverCertificate specified in the CreateSession response.’

For your kind information I use the specification released on November 2015 to study. Please clarify.

Thanks,
Gajasri