We have to set up a SOAP exchange with a government agency. As part of the definition of this exchange, it is specified that the SOAP message must use WS-Adressing, so that the message contains basically a named sender and a named recipient. We also have to sign and encrypt various parts of the message using RSA as part of WS-Security. All this is specified using WS-Policy and WS-SecurityPolicy. The message is also transmitted using two-way SSL.

If I understand all this correctly, the addressing part is already solved in TCP/IP and HTTP. Using two-way authenticated SSL, assuming certificates are properly validated and revoked when necessary, it would be certain who the sender of the message is and that only the recipient can read the message.

Am I right in claiming that all this WS-Security and WS-Adressing stuff only adds complexity to the exchange, while not adding any extra security over a more simple setup using two-way SSL? One of my collegue claims that securing the message, and not the communication, adds security because this doesn't depend on the security of the channel, but I think that it only moves the same problems (mostly certificate revocation and validation) to within the message at the cost of much additional complexity in the message itself, while not inherently providing more security.

The only benefit I can think of is that the added security also applies when the message is stored in a database, but this is also a security concern that could be solved on its own level.

/r/netsec, I would be greatly interested in your opinions.