Java Network Programming (3rd ed) [Electronic resources] نسخه متنی

Chapter 11. Secure Sockets

One of the perennial fears of
consumers buying goods over the Internet is that some hacker will
steal their credit card number and run up a several-thousand-dollar
bill by calling phone sex lines. In reality, it's
more likely that a clerk at a department store will read their credit
card number from a store receipt than that some hacker will grab it
in transit across the Internet. In fact, as of mid-2004, the major
online thefts of credit card numbers have been accomplished by
stealing the information from poorly secured databases and
filesystems after the information has been
safely transmitted across the Internet. Nonetheless, to make Internet
connections more fundamentally secure, sockets can be encrypted. This
allows transactions to be confidential, authenticated, and accurate.

However, encryption is a complex subject.
Performing it properly requires a detailed understanding not only of
the mathematical algorithms used to encrypt data but also of the
protocols used to exchange keys and encrypted data. Even a small
mistake can open a large hole in your armor and reveal your
communications to an eavesdropper. Consequently, writing encryption
software is a task best left to experts. Fortunately, nonexperts with
only a layperson's understanding of the underlying
protocols and algorithms can secure their communications with
software designed by experts. Every time you order something from an
online store, chances are the transaction is encrypted and
authenticated using protocols and algorithms you need to know next to
nothing about. As a programmer who wants to write network client
software that talks to online stores, you need to know a little more
about the protocols and algorithms involved but not a lot more,
provided you can use a class library written by experts who do
understand the details. If you want to write the server software that
runs the online store, then you need to know a little bit more but
still not as much as you would if you were designing all this from
scratch without reference to other work.

Until recently, such software was subject to the arms control laws of
the United States. To some extent it still is. Laws about encryption
in other countries range from much stricter than the
U.S.'s to nonexistent. This has limited the ability
of Sun and other vendors who operate internationally to ship strong
encryption software. Consequently, such capabilities were not built
into the standard java.net classes until Java 1.4.
Prior to this, they were available as a standard extension called the
Java Secure Sockets Extension (JSSE).
Although JSSE is now part of the standard distribution of the JDK, it
is still hobbled by design decisions made to support earlier, less
liberal export control regulations, and it is therefore less simple
and easy to use than it could or should be.

Nonetheless, JSSE can secure network communications using the
Secure Sockets Layer (SSL)
Version 3 and Transport Layer Security (TLS) protocols and their
associated algorithms. SSL is a security protocol that enables web
browsers to talk to web servers using various levels of
confidentiality and authentication.