title: Does TLS ensure message integrity and confidentiality of data transmission in a RESTful Java enterprise
body: <p>I want to apply web service security according to <a href="https://www.owasp.org/index.php/Web_Service_Security_Cheat_Sheet" rel="noreferrer">OWASP Web Service Security</a>. Thereby I stumbled over the two points:</p>
  
  <ol>
  <li><a href="https://www.owasp.org/index.php/Web_Service_Security_Cheat_Sheet#Message_Integrity" rel="noreferrer">Message Integrity</a></li>
  <li><a href="https://www.owasp.org/index.php/Web_Service_Security_Cheat_Sheet#Message_Confidentiality" rel="noreferrer">Message Confidentiality</a></li>
  </ol>
  
  <p>So far there is just a RESTful service which can be directly accessed by a client. For each request the client needs to authenticate by the server. All communication is secured via TLS. I'm now unsure about <em><code>Message Integrity</code></em> since I don't understand the sentence: </p>
  
  <blockquote>
    <p><em>When using public key cryptography, encryption does guarantee confidentiality but it does not guarantee integrity since the
    receiver's public key is public. For the same reason, encryption does
    not ensure the identity of the sender.</em></p>
  </blockquote>
  
  <p>Is it also required that the data was signed by the client in order that message integrity is ensured? TLS is only <strong><em>point-to-point</em></strong>, what is about proxies?</p>
  
  <p>Concerning <em><code>Message Confidentiality</code></em>, I understood it as follows.</p>
  
  <ol>
  <li>Use TLS to ensure message confidentiality over the wire.</li>
  <li>Use a symmetric encryption to encrypt the transmitted data.</li>
  <li>The encrypted data get stored in data base.</li>
  </ol>
  
  <p>Did I understand that right?</p>