Perimeter
11/28/2011
12:46 PM
Taher Elgamal
Taher Elgamal
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

SSL's Future

SSL will evolve to meet requirements for e-commerce and mobile

So what will happen to the current e-commerce world based on SSL and all of the new authentication methods under way?

SSL has been the target for a variety of attacks, many of which have been in the news lately. I believe that it will be extremely difficult to fundamentally change the models for e-commerce after 15 years of growth, despite the fraud and threats we know about. The appropriate way to manage fraud better is to work on the existing systems to improve how parties assure themselves of the identities of others involved in transactions.

There is actually more than one way that authentication can be supported within the SSL framework as it stands.

Any strong authentication can simply be used after the one-sided server authentication and encryption session has been established. At this point, the server can request any authentication information from the client, and the authentication can happen within the encrypted session. Each website can choose the authentication method it desires, as long as browser and client support can be established somehow.

Alternatively, the strong authentication method desired could be used to “unlock” a private key with a digital certificate on the client side that can be used to provide the client authentication requested by the SSL server.

Either way, the current infrastructure can, in fact, support multiple authentication methods that will help us mitigate the dependence on user passwords.

I wish that the technical community could collaborate on improving the existing e-commerce infrastructure. Many improvements are needed, for sure, but incremental improvements have always worked better than calling for a new infrastructure that would not be possible to actually put together.

My prediction is that SSL will grow with the e-commerce needs and that new versions and new implementations will meet the expectations for growing e-commerce and mobile commerce requirements.

Recognized in the industry as the "inventor of SSL," Dr. Taher Elgamal led the SSL efforts at Netscape. He also wrote the SSL patent and promoted SSL as the Internet security standard within standard committees and the industry. Dr. Elgamal invented several industry and government standards in data security and digital signatures area, including the DSS government standard for digital signatures. He holds a Ph.D. and M.S. in Computer Science from Stanford University.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web