title: Does WCF message security actually encrypt message contents?
body: <p>I have read the documentation provided at MSDN, and some other posts on this site. However, its still a bit unclear whether WCF (specifically, NetTcpBinding) will actually encrypt message <b>contents</b> when using message security w/ certificates. Does anyone know for sure?</p>
  
  <p>For instance you can specify both transport and message credentials in your config: </p>
  
  <pre><code>       &lt;security mode="TransportWithMessageCredential"&gt;
            &lt;transport clientCredentialType="Certificate"/&gt;
            &lt;message clientCredentialType="Certificate"
                     negotiateServiceCredential="true" /&gt;
         &lt;/security&gt;
  </code></pre>
  
  <p>As far as I can tell the MSDN documentation implies that message security simply relies on either username/password or certificate-based authentication (negotiation), but doesn't specifically state that the message themselves are actually encrypted at the message level.</p>
  
  <p>For instance if I use ONLY message security, with certificate-based negotiation, I don't think message contents are actually encrypted (ie. a packet sniffer could intercept the raw message contents -- even if the service enforces authentication)?</p>
  
  <p>If true message-level encryption is possible (using NetTcpBinding) how is it done in code? I believe this is related to the AlgorithmSuite, though I'm not sure, </p>
  
  <pre><code>binding.Security.Mode = SecurityMode.Message;
  binding.Security.Message.ClientCredentialType = MessageCredentialType.Windows;
  binding.Security.Message.AlgorithmSuite = new System.ServiceModel.Security.TripleDesSecurityAlgorithmSuite(); 
  </code></pre>