<p>I have a WCF Service decorated with WebInvoke attributes and WebHttp binding for JSON enabling. The service can be accessed from JavaScript until we try to make it working cross domain. Can you please recommend how to get this to work cross domain?</p>

<p>We've tried to create proxy web handler but it gives "Bad Request" everytime WebHttpRequest try to access it.</p>

For a ridiculously short value  ( Ie: values < 64 characters ), MD5 as a hash becomes ineffective due to rainbow table attacks, and as the value you're sending will be shared over the wire, all they have to do is brute force the shared secret ( and they have a known product to work with )
As such, thats not public key private key. its mererly shared secret.
Also, keep in mind this shared secret will be in your flash file you send to the user, which these days and be trivially disassembled and then your "secret" is not a secret any more.
You want a more challenge-response mechanism with proper crypto signing, where a new sign key is assigned for every game from the server, and multiple scores cannot be submitted with the same sign key. ( For extra protection ;) )
User starts game. Sign key is requested. ( the sign key is produced from another key which they cant access ).
Score is signed with sign key, and then sent
You verify the value of the sign with the key you sent them.
You discard the sign key you sent them.
However, you
still
have the problem where you have no way to prevent the actual scoring system being tampered with. Somebody smart enough could just reverse engineer your SWF object and inject new code that just sets the score to their chosen value.