Wireless Security.pdf - PDF Archive

Standardizing Security 249
is established, the HTTP server will perform password authentication as normal, but in
this case, the username and password will not be sent as plaintext over the network. As a
result, the authentication is secure.
The last two security technologies we will mention are secure FTP (FTP over SSL) and
PGP. 5 Secure FTP (not to be confused with SFTP, the Simple File Transfer Protocol), is
simply the implementation of FTP over an SSL connection. It will behave in the same
manner as FTP, but the information being transmitted will be encrypted. Quite different
from Secure FTP, PGP is an overloaded name—it refers to a product, a company, and
a technology. Originally written in the early 1990s, PGP started out as a program to
secure emails using public-key cryptography (it used its own algorithm). Still in use
today, PGP is provided in commercial products that provide various levels of security
and authentication. The commercial products are targeted at specific platforms, but
the original technology could be adapted to an embedded application. This would, of
course, require you to obtain the source code for the old PGP technology, which is likely
protected by copyright, but it would be an interesting project to see if it could be ported
to an embedded system—encrypted email could be a useful feature in many embedded
applications.
10.5.4 Wrap-Up
We have only scratched the surface of security protocols in this chapter, but it should be
enough to get started. In the next chapter, we cover a single protocol in more depth, since
it is so important to security in general. This protocol is used in virtually every secure
Web transaction today: the Secure Sockets Layer (SSL).
5 PGP is a trademark of the PGP Corporation.
www.newnespress.com