Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have learnt little about https. But was not clear the need of it. What if i encrypt the data using the most powerful algorithms like RSA instead of sending through a HTTPS zone?? Can someone suggest few points on why we need https??

share|improve this question

closed as not constructive by Greg Askew, growse, John Gardeniers, EEAA, Tim Brigham Sep 9 '12 at 0:21

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

First, learn what HTTPS is. Then you will know if you need it or not. – Michael Hampton Sep 8 '12 at 14:28
HTTPS can use RSA, and browsers support it while your custom idea does not. – becomingwisest Sep 8 '12 at 14:30
You are mixing oranges and apples. – Skaperen Sep 8 '12 at 17:18

First, RSA is a authentication mechanism, not encryption. AES is an encryption algorithm, probably the one you're thinking of.

Second, HTTPS is well supported and fairly easy to implement, it's also very complete and well audited. There is no good reason that you can't create you're own mechanism based on whatever encryption technology you want, but you'll lose the befits described above.

share|improve this answer

What if i encrypt the data using the most powerful algorithms like RSA instead of sending through a HTTPS zone??

The user's browser would be encrypting it with the public key provided by the server.

Without HTTPS, that server could easily be a man-in-the-middle attack. Now, you've provided your nicely encrypted, highly sensitive data to the wrong server.

share|improve this answer
Data is not encrypted with the x509 Keys, public key cryptography is very slow and would kill a webserver to use it for general data transfers. A faster symmetric algorithm like 3DES, AES, Camellia, or RC-4 is used for data, and the key for that algorithm is determined by DH usually. RSA is used for authentication, not encryption, which is the point you get at in your second paragraph... – Chris S Sep 9 '12 at 1:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.