Perimeter
11/28/2011
12:46 PM
Taher Elgamal
Taher Elgamal
Commentary
50%
50%

SSL's Future

SSL will evolve to meet requirements for e-commerce and mobile

So what will happen to the current e-commerce world based on SSL and all of the new authentication methods under way?

SSL has been the target for a variety of attacks, many of which have been in the news lately. I believe that it will be extremely difficult to fundamentally change the models for e-commerce after 15 years of growth, despite the fraud and threats we know about. The appropriate way to manage fraud better is to work on the existing systems to improve how parties assure themselves of the identities of others involved in transactions.

There is actually more than one way that authentication can be supported within the SSL framework as it stands.

Any strong authentication can simply be used after the one-sided server authentication and encryption session has been established. At this point, the server can request any authentication information from the client, and the authentication can happen within the encrypted session. Each website can choose the authentication method it desires, as long as browser and client support can be established somehow.

Alternatively, the strong authentication method desired could be used to “unlock” a private key with a digital certificate on the client side that can be used to provide the client authentication requested by the SSL server.

Either way, the current infrastructure can, in fact, support multiple authentication methods that will help us mitigate the dependence on user passwords.

I wish that the technical community could collaborate on improving the existing e-commerce infrastructure. Many improvements are needed, for sure, but incremental improvements have always worked better than calling for a new infrastructure that would not be possible to actually put together.

My prediction is that SSL will grow with the e-commerce needs and that new versions and new implementations will meet the expectations for growing e-commerce and mobile commerce requirements.

Recognized in the industry as the "inventor of SSL," Dr. Taher Elgamal led the SSL efforts at Netscape. He also wrote the SSL patent and promoted SSL as the Internet security standard within standard committees and the industry. Dr. Elgamal invented several industry and government standards in data security and digital signatures area, including the DSS government standard for digital signatures. He holds a Ph.D. and M.S. in Computer Science from Stanford University.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.