Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote -3 down vote favorite

I have learnt little about https. But was not clear the need of it. What if i encrypt the data using the most powerful algorithms like RSA instead of sending through a HTTPS zone?? Can someone suggest few points on why we need https??

share|improve this question
6  
First, learn what HTTPS is. Then you will know if you need it or not. – Michael Hampton Sep 8 '12 at 14:28
HTTPS can use RSA, and browsers support it while your custom idea does not. – becomingwisest Sep 8 '12 at 14:30
You are mixing oranges and apples. – Skaperen Sep 8 '12 at 17:18

closed as not constructive by Greg Askew, growse, John Gardeniers, EEAA, Tim Brigham Sep 9 '12 at 0:21

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

2 Answers

up vote 2 down vote

First, RSA is a authentication mechanism, not encryption. AES is an encryption algorithm, probably the one you're thinking of.

Second, HTTPS is well supported and fairly easy to implement, it's also very complete and well audited. There is no good reason that you can't create you're own mechanism based on whatever encryption technology you want, but you'll lose the befits described above.

share|improve this answer
up vote 2 down vote

What if i encrypt the data using the most powerful algorithms like RSA instead of sending through a HTTPS zone??

The user's browser would be encrypting it with the public key provided by the server.

Without HTTPS, that server could easily be a man-in-the-middle attack. Now, you've provided your nicely encrypted, highly sensitive data to the wrong server.

share|improve this answer
Data is not encrypted with the x509 Keys, public key cryptography is very slow and would kill a webserver to use it for general data transfers. A faster symmetric algorithm like 3DES, AES, Camellia, or RC-4 is used for data, and the key for that algorithm is determined by DH usually. RSA is used for authentication, not encryption, which is the point you get at in your second paragraph... – Chris S♦ Sep 9 '12 at 1:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.