S-HTTP được thực hiện trong một số máy chủ Web thương mại và hầu hết các trình duyệt. Các máy chủ S-HTTP thương lượng với các khách hàng cho các loại mã hóa sẽ được sử dụng. Giao dịch có thể liên quan đến một số dạng mã hóa giữa máy chủ và máy khách. | Securing Your Internetwork Chapter 1 33 S-HTTP is implemented in some commercial Web servers and most browsers. The S-HTTP server negotiates with the client for the type of encryption that will be used. Transactions can involve several types of encryption between a particular server and client. S-HTTP does not require clients to have public key certificates because it can use symmetric keys to provide private transactions. The symmetric keys would be provided in advance using out-of-band communication. Transport Layer Security Transport layer security is directed at providing process-to-process security between hosts. Most schemes are designed for TCP to provide reliable connection-oriented communication. Many transport layer security mechanisms require changes in applications to access the security benefits. The secure applications are replacements for standard unsecure applications and use different ports. Secure Sockets Layer SSL and Transport Layer Security TLS SSL was designed by Netscape and is used widely on the Internet for Web transactions such as sending credit card data. SSL can also be utilized for other protocols such as Telnet FTP LDAP IMAP and SMTP but these are not commonly used. TLS is an open IETF-proposed standard based on SSL . RFCs 2246 2712 2817 and 2818 define TLS. The two protocols are not interoperable but TLS has the capability to drop down into SSL mode for backwards compatibility. SSL and TLS provide security for a single TCP session. SSL and TLS provide a connection between a client and a server over which any amount of data can be sent securely. Server and browser must be SSL- or TLS-enabled to facilitate secure Web connections. Applications must be SSL- or TLS-enabled to allow their use of the secure connection. For the browser and server to communicate securely each needs to have the shared session key. SSL TLS use public key encryption to exchange session keys during communication initialization. When a browser is installed .
