I have learnt little about https. But was not clear the need of it. What if i encrypt the data using the most powerful algorithms like RSA instead of sending through a HTTPS zone?? Can someone suggest few points on why we need https??
3
-
6First, learn what HTTPS is. Then you will know if you need it or not.– Michael HamptonSep 8, 2012 at 14:28
-
HTTPS can use RSA, and browsers support it while your custom idea does not.– becomingwisestSep 8, 2012 at 14:30
-
You are mixing oranges and apples.– SkaperenSep 8, 2012 at 17:18
Add a comment
|
2 Answers
First, RSA is a authentication mechanism, not encryption. AES is an encryption algorithm, probably the one you're thinking of.
Second, HTTPS is well supported and fairly easy to implement, it's also very complete and well audited. There is no good reason that you can't create you're own mechanism based on whatever encryption technology you want, but you'll lose the befits described above.
What if i encrypt the data using the most powerful algorithms like RSA instead of sending through a HTTPS zone??
The user's browser would be encrypting it with the public key provided by the server.
Without HTTPS, that server could easily be a man-in-the-middle attack. Now, you've provided your nicely encrypted, highly sensitive data to the wrong server.
-
Data is not encrypted with the x509 Keys, public key cryptography is very slow and would kill a webserver to use it for general data transfers. A faster symmetric algorithm like 3DES, AES, Camellia, or RC-4 is used for data, and the key for that algorithm is determined by DH usually. RSA is used for authentication, not encryption, which is the point you get at in your second paragraph...– Chris SSep 9, 2012 at 1:05