Kenneth C. Laudon,Jane P. Laudon Management Information System 12th Edition pdf

Secure Sockets Layer (SSL)

and its successor Transport Layer Security (TLS)

enable client and server computers to manage encryption and decryption

activities as they communicate with each other during a secure Web session.

Secure Hypertext Transfer Protocol (S-HTTP)

is another protocol used for

encrypting data flowing over the Internet, but it is limited to individual

messages, whereas SSL and TLS are designed to establish a secure connection

between two computers.

The capability to generate secure sessions is built into Internet client

browser software and servers. The client and the server negotiate what key and

what level of security to use. Once a secure session is established between the

client and the server, all messages in that session are encrypted.

There are two alternative methods of encryption: symmetric key encryption

and public key encryption. In symmetric key encryption, the sender and

receiver establish a secure Internet session by creating a single encryption key

and sending it to the receiver so both the sender and receiver share the same

key. The strength of the encryption key is measured by its bit length. Today, a

typical key will be 128 bits long (a string of 128 binary digits).

The problem with all symmetric encryption schemes is that the key itself

must be shared somehow among the senders and receivers, which exposes the

key to outsiders who might just be able to intercept and decrypt the key. A

more secure form of encryption called