Web Development

Ask something
Discussion Locked

SSL Implementation

0 helpful
5 replies

by svelidanda

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

What are all the disadvantages using SSL, if any?
Is there still problems with the intruders trapping the data being transferred over SSL(128 bit)?

There are people asking questions what if the hacker is able to get the data being transferred over SSL ? How can this be clarified.

5 replies

by jay eckles

I suppose the two main disadvantages are 1. the increase response time (encryption/decryption must take place at both ends of the transaction) and 2. the increased cost of support, although that may be minimal.

Intruders can trap data being transmitted with any protocol - I'm sure you've heard of "packet sniffers" and such. SSL cannot prevent this type of data trapping. What SSL does is encrypt the data so that even if the data is intercepted, it means nothing to the intruder. Without the128 bit key, it would take an impossible amount of time to perform what's known as a "brute force" attack to crack the encryption. Distributed.net has been trying since about 1998 with an amazing amount of computing power to crack a 64 bit key. A 128 bit key is simply beyond our computing capacity to crack in a reasonable amount of time. As computers become more powerful, that will change, but we're OK for now.

I don't know what encryption algorithm is used in SSL, but it's conceivable that anything other than a one-time pad (which SSL definitely does not use) can be compromised through a more elegant attack than a brute force method, but that requires the attacker discovering the solution to some heretofore unsolvable mathematical problem. Not likely - you probably have as good a chance of winning the Powerball.

Basically data intercepted over SSL is about as useful as if you recorded a couple of hours of static on your VCR. There's no discernable data other than white noise.

Good luck.

Jay
www.jayeckles.com

by rrosulescu

In addition with answer 1
With SSL you can make authentication too, so it's hard to think that an intruder can do much. Java implements the most popular encryption algorithms(DES, triple DES, RSA, ...), but there are many implementations of the last generation of encryption algorithms written in Java you can use.
Indeed there is a delay using SSL and I heard if there are many users the response can dramatically down (but others say there are no problems).

This discussion is closed to new replies.