Internet & Intranet Security Management - Risks & Solutions

• Confidentiality. Data items transferred in the session are transparently encrypted after an initial
handshake and session key determination.
The SSL handshake protocol is layered on top of the SSL record protocol and is used to exchange a
series of messages between the communicating peers when they first establish an SSL connection.
During the SSL handshake protocol the server and the client are able to authenticate each other:
• Server authentication. The server is authenticated to the client by presenting a public key certificate
(confirming to the X.509 v3 standard (ITU-T, 1997)). The client has to check that the server's
certificate is valid and has been issued by a certificate authority (CA) trusted by him. This
confirmation might be important if the user, for example, is sending a credit card number over the
network and wants to check the identity of the receiving server.
• Client authentication. Similarly, the server can optionally authenticate the client by requiring the
client's public key certificate. This optional service may protect the server from fraudulent users and
non-repudiation problems.
In addition, during the SSL handshake protocol the server and the client are able to negotiate several
parameters (e.g. compression, encryption algorithm, etc.). After negotiation, a master key is created.
This master key is used to determine session keys which can be used for further symmetric
encryption/decryption.
The use of public key certificates assumes the existence of a public key infrastructure (PKI),
including both certifying authorities to issue, revoke and distribute certificates. Since client
authentication is optional, server certificates are widely used today.
Secure HTTP
The secure HTTP (S-HTTP) protocol was initially developed by Enterprise Integration Technologies
in 1994 and shortly thereafter was taken under consideration by the IETF Web Transaction Security
working group which submitted an RFC in August 1999 (Rescorla and Schiffman, 1999). S-HTTP is
essentially a security-enhanced version of HTTP, that can be used to provide security services at the
application layer: confidentiality, authentication, message integrity and non-repudiation of origin. In
fact, this means that it is possible to differentiate among the security requirements of individual
documents that are transmitted on a secure HTTP channel. For example, a Web application using S-
HTTP can mark an individual document as private or digitally signed, in contrast, SSL encrypts the
entire communication stream. One conceptual difference between SSL and S-HTTP is that, SSL
establishes a secure TCP/IP connection between a client and a server, which can be used for HTTP
traffic. Unlike SSL, S-HTTP uses TCP/IP connections to transmit data.