Which one among the following correctly stands for SSL encryption with regard to banking websites ?

Correct — A, (a) Secure Socket Layer encryption. SSL is the Secure Sockets Layer — the protocol that put the padlock on a banking website's address bar. The booklet prints 'Socket' in the singular where the protocol's own name uses the plural, Secure Sockets Layer; the expansion intended is unmistakable and no other option comes close.

What the name describes. A 'socket' is the endpoint of a network connection, the pairing of an address with a port through which two programs exchange bytes. SSL was designed as a LAYER placed between the application, such as a web browser, and the ordinary transport connection beneath it, so that an application could hand over its data and have it encrypted in transit without being rewritten. That is why a bank's site changes from http to HTTPS and to port 443 rather than needing a different kind of web page: the same protocol is being carried over a secured layer.

What it actually does for a banking session, in three parts. AUTHENTICATION — the server presents a digital certificate issued by a certifying authority, which the browser checks, so that the customer can tell the bank's site from an impostor's. KEY EXCHANGE — the two sides use public key cryptography during the handshake to agree on a session key that no eavesdropper can derive. ENCRYPTION and INTEGRITY — the rest of the conversation, including the password and the transaction details, is encrypted with that session key using fast symmetric cryptography and carries a check that detects tampering.

One piece of currency. SSL itself was developed by Netscape in the mid-1990s and its versions are now deprecated; the protocol in actual use is its successor, TRANSPORT LAYER SECURITY, TLS. The older name has stuck in ordinary usage — certificates are still sold as 'SSL certificates' — which is why the abbreviation is still the one examiners ask about.

Why the others are wrong

• (b)Superior Safety Level encryption — Three words that sound reassuring and describe nothing. There is no such protocol, and the phrase names no mechanism — no authentication, no key exchange, no layer. Expansions of this shape, built from vague quality words, are the standard filler in an acronym item and can be discarded on sight.
• (c)Server-to-Server Linked encryption — Uses real networking vocabulary and points at the wrong relationship. The connection being secured when a customer banks online is between a CLIENT — the customer's browser or app — and the bank's server, not between two servers. The hyphenated form is designed to look technical enough to be right; test it against what actually happens in the session and it fails.
• (d)Safety Server Level encryption — A rearrangement of the same plausible-sounding words as (b) and (c), which is a hint in itself: where three options are built from interchangeable filler and one names a definite protocol, the definite one is usually the answer. 'Safety' is also the wrong register — the field's word is security, meaning protection against a deliberate adversary, while safety concerns protection against accident.

Transport-layer security protects data in motion. The handshake begins with the server sending its certificate, which binds its identity to a public key and is signed by a certifying authority the browser already trusts; the client verifies the signature and the certificate's validity. The two sides then establish a shared secret using public key methods, and switch to symmetric encryption for the bulk of the traffic, because symmetric algorithms are far faster. Every record thereafter carries an integrity check, so alteration in transit is detected. This is what HTTPS is — ordinary HTTP carried inside such a session, conventionally on port 443. What it does not do is protect data at rest on either machine, or protect a user who has been persuaded to type a password into a fraudulent site that has a valid certificate of its own.

Key facts

• SSL stands for Secure Sockets Layer; a socket is the endpoint of a network connection.
• SSL was developed by Netscape in the mid-1990s and has been superseded by Transport Layer Security, though the older name persists in common usage.
• HTTPS is HTTP carried over such a secured session, conventionally on port 443.
• The server proves its identity with a digital certificate issued by a certifying authority.
• The handshake uses public key cryptography to agree a session key; the session itself uses faster symmetric encryption.
• Records carry integrity checks, so tampering in transit is detected.
• The padlock indicates an encrypted, authenticated connection to the site named in the certificate — not that the site is honest.
• Such protection covers data in transit only; data stored on either end is protected by other means.

Common traps

• Reading 'Server-to-Server' as right because the words are technical; the secured link is client to server.
• Assuming the padlock certifies the honesty of the business behind the site.
• Confusing encryption in transit with encryption of stored data.
• Forgetting that TLS is the protocol in use today, even where the term SSL is still used.

• practice — not a real PYQ

  In a secured web session, the digital certificate presented by a bank's server is issued by which one among the following ?

  • (a)The customer's internet service provider
  • (b)A certifying authority trusted by the browser
  • (c)The Reserve Bank of India
  • (d)The browser manufacturer

  Answer(b) A certifying authority trusted by the browser

• practice — not a real PYQ

  HTTPS differs from HTTP chiefly in that it does which one among the following ?

  • (a)Compresses web pages before sending them
  • (b)Carries the same traffic inside an encrypted and authenticated session
  • (c)Stores the user's password on the server
  • (d)Uses a faster physical network

  Answer(b) Carries the same traffic inside an encrypted and authenticated session