1

I am relatively new to the world of cryptography and was wanting to develop a webpage which allows credit card payments. Thus, I looked into the digicert ssl service, hoping that it could do what I want.

My question is, if an asymmetric encryption requires some form of exchange and protocol between the server and end-user, then is that not potentially a point of weakness? How does it, if it does, manage to tell each other what cipher and keys to use initially without someone listening in the middle during the handshake process knowing. Ultimately, does it even matter?

Scenario 1: A customer connects to the website. Is it possible that a hijacker poses as the server IP and intercepts the signal, before returning it again unchanged? He becomes a spy in the network...

Scenario 2: Assuming scenario 1 is possible or the electrical cable to the exchange from the customer's home has been compromised, the user computer will tell the server his capabilities and the server will return with a unique response, then the encryption begins. How is that initial process protected? It's sort of like typing a password but someone's watching over your back...

I'm pretty new to this, so this is my understanding. Please correct me at any stages and enlighten me with info.

Thanks in advance.

The big D
  • 11
  • 1
  • 6
    If you're a beginner, don't send any credit card data to your server. Send it to a tokenizing PSP. Your server will still need to use SSL, but it avoids *a lot* of difficulties. – CodesInChaos Oct 24 '14 at 08:19
  • "before returning it" to the client "unchanged" or "before returning it" to the network "unchanged"? –  Oct 24 '14 at 08:27
  • 1
    While agreeing that you shouldn't be collecting credit card data without a _much_ better understanding of SSL, the missing link you're looking for is that SSL certificates have to be signed by a trusted third party whose public key is distributed with the web browser, and so never passes over the Internet where it could be intercepted. In theory, this prevents site spoofing and man-in-the-middle attacks. – Mike Scott Oct 24 '14 at 09:44
  • 1
    It sounds like you should read up on the basics of SSL. http://security.stackexchange.com/questions/20803/how-does-ssl-tls-work would be a good starting point. – Mark Oct 24 '14 at 10:23

0 Answers0