Front cover - IBM Redbooks

connection. A good solution is to use SSL, which we will explore in the next
section.
6.2.5 Secure Sockets Layer
As we’ve already said a couple of times, authentication is an attempt to address
two of our primary security objectives, namely: access control and identity
verification. Regrettably, authentication does not address our other primary
security objectives, namely: confidentiality and data integrity.
Worse even, authentication is not truly secure because passwords are sent over
a network in a form close to plaintext – they’re Base64 encoded. The emphasis
here is on “encoded”, not “encrypted.” Base64 is an encoding algorithm, not
encryption, and as such it's supposed to be easily reversible. Thus, given that
passwords are generally transmitted within HTTP headers, if these are
intercepted (using a packet sniffer, for example), they can be easily decoded and
used by impersonators.
Thus, a protocol that uses cryptographic techniques is needed. There are
several protocols that seek to meet this need, but only one is universally
implemented: Secure Sockets Layer (SSL).
SSL is widely used on the Internet not only in conjunction with HTTP, but also
with a number of other popular application protocols, specifically LDAP, POP3,
HTTP, SMTP, IIOP, or IMAP.
What is SSL?
The Secure Sockets Layer protocol was originally created by Netscape Inc., but
now it is implemented in most Internet-based client/server software. SSL makes
use of a number of cryptographic techniques, such as public key and symmetric
key encryption, digital signatures, and public key certificates.
Note: The current version of SSL is 3.0, however, it has been supplanted by
the new Transport Layer Security (TLS), an IETF standard protocol. TLS was
first defined in RFC 2246: “The TLS Protocol Version 1.0". Since there is no
support in Notes and Domino for TLS -- and there aren’t any plans to support
TLS in the foreseeable future, this chapter only covers SSL v3.
SSL version 3.0, which was introduced in 1996, is a security protocol that:
► Encrypts information sent over the network from client and server, providing
confidentiality
► Validates that the message sent to a recipient was not tampered with,
providing data integrity
Chapter 6. Public key infrastructures 249