B2B Integration : A Practical Guide to Collaborative E-commerce

296 B2B Integration — A Practical Guide to Collaborative E-commerce
Session Key
^
Secret
Message Encryption
t) with
CompanYA Session Key
Figure 10.4.
*ds-~ y
Cipher
Text Decryption
with
Secret
Message
Session Key Company B
Digital envelope
10.6.4. Best of both worlds — The digital envelope
By combining private and public key encryption, we get best of both
worlds, the digital envelope.
Consider again a case of Company A wanting to communicate with
Company B. Company A generates a random private key for the
communication session. This random private key is called a session key
since it will be used only for this particular session. The session key is
encrypted with the public key of Company B and sent to it. Company B
gets the session key securely, using its private key to understand the
message. Figuratively, the session key is sent in a secure envelope
formed by public key encryption (see Figure 10.4).
Once the session key is established between the two companies, the
subsequent communication, based on private key encryption, can be
made using the session key on both sides. This part of communication
is much faster due to decreased overhead.
Using a digital envelope, the same level of privacy is achieved as
public key encryption with better performance of the application.
10.6.5. Digital signature
Digital signature is the electronic equivalent of a pen-and-paper signature
and is used for authenticating the sender of the message. It provides
a means by which information cannot be repudiated by binding