E-commerce Security: SSL, S-HTTP, and Digital Signatures, Slides of Fundamentals of E-Commerce

Download E-commerce Security: SSL, S-HTTP, and Digital Signatures and more Slides Fundamentals of E-Commerce in PDF only on Docsity! Limitation Although SSL protects information as it is being transmitted, it does not protect information once it is stored in the merchant’s database. The data needs to be encrypted and/or the server secured to protect information that was previously transmitted. Docsity.com Secure HTTP • Secure HTTP (S-HTTP) is an extension of HTTP. • It is concerned with securing individual messages. • Works at the application level. • Security features: – Client and server authentication (using RSA) – Symmetric encryption for communication – Message digests – The client and server may use separate S-HTTP techniques simultaneously. Example: The client may use private keys and the server may use public keys. Docsity.com Transaction integrity • It is difficult to prevent integrity violations, but techniques can enable integrity violations to be detected; information can then be re-sent. • The basic idea: – A hashing algorithm is applied to produce a message digest. – The message digest is encrypted to produce a digital signature. Docsity.com Message digest • A hashing function is applied to the message. • This produces a number that is based on the length and content of the message. Good hash algorithms have few collisions. • The message digest is appended to the message. • The receiver recalculates the message digest. • If they two do not match, integrity is violated. Problem: What if an adversary changes both the message and the message digest? Docsity.com Digital signature • The sender computes the digest, encrypts it using her private key, and then appends the encrypted digest onto the message. • Only the sender could have created the digital signature. • The merchant deciphers the digest, computes his own digest, and compares the two. If they match the integrity of the message was preserved. • For added security, the digital signature and the message can be encrypted. Docsity.com