What are SSL and SHTTP?
SSL (Secure Socket Layer) and SHTTP (Secure HTTP) and are proposed encryption and user authentication standards for the Web. The basic idea behind the encryption is to encode the text of a message with a key. There are two ways to encrypt -- 1) symmetric - the same key is used for encoding and decoding, and 2) asymmetric - one key is used for encoding and another for decoding. In the latter there is a pair of keys that work together, with one being the public key for encoding, and the other being a private key for decoding. A typical implementation would use both - an asymmetric system would be used to transmit a symmetric key good for the current session.
For this to work in a web environment, you need the scheme built into the browser and the server. SSL is Netscape's answer. It uses low level encryption to encrypt transactions in higher-level protocols such as HTTP, NNTP and FTP. SSL is (currently) only for Netscape browsers and some Netscape servers. I have not had experience with this to a great extent, but SSL's main strength lies in encrypting the messages. The client authentication really isn't happening yet, and until some type of universal signature method is used (like Verisign) to sign clients, the only advantage is the message encryption. There is still no guarantee that you are who you say you are. Layman's terms? Look in Security Preferences under the Options menu in Netscape and look at your Site Certificates. These can be used to create a secure connection. You could still send a fake credit card number and claim you are Joe Blow, but at least your message could not be intercepted ;-)
SHTTP has been proposed by CommerceNet, a coalition of businesses interested in commercial Internet usage. It only works with HTTP, but is a bit more flexible than SSL. Currently SHTTP is implemented for the Open Marketplace Server from Open Market, Inc on the server side, and Secure HTTP Mosaic on the client side.
SSL (Secure Socket Layer) and SHTTP (Secure HTTP) and are proposed encryption and user authentication standards for the Web. The basic idea behind the encryption is to encode the text of a message with a key. There are two ways to encrypt -- 1) symmetric - the same key is used for encoding and decoding, and 2) asymmetric - one key is used for encoding and another for decoding. In the latter there is a pair of keys that work together, with one being the public key for encoding, and the other being a private key for decoding. A typical implementation would use both - an asymmetric system would be used to transmit a symmetric key good for the current session.
For this to work in a web environment, you need the scheme built into the browser and the server. SSL is Netscape's answer. It uses low level encryption to encrypt transactions in higher-level protocols such as HTTP, NNTP and FTP. SSL is (currently) only for Netscape browsers and some Netscape servers. I have not had experience with this to a great extent, but SSL's main strength lies in encrypting the messages. The client authentication really isn't happening yet, and until some type of universal signature method is used (like Verisign) to sign clients, the only advantage is the message encryption. There is still no guarantee that you are who you say you are. Layman's terms? Look in Security Preferences under the Options menu in Netscape and look at your Site Certificates. These can be used to create a secure connection. You could still send a fake credit card number and claim you are Joe Blow, but at least your message could not be intercepted ;-)
SHTTP has been proposed by CommerceNet, a coalition of businesses interested in commercial Internet usage. It only works with HTTP, but is a bit more flexible than SSL. Currently SHTTP is implemented for the Open Marketplace Server from Open Market, Inc on the server side, and Secure HTTP Mosaic on the client side.
0 comments :
Post a Comment