Right now, SSL (secure socket layer) is the defacto standard and is
pretty much used on all commercially-viable secure sites. Interesting
since the draft standard has actually expired. Meantime, the TLS
Working Group (TLS = transport layer security) was established in 1996
to standardize a 'transport layer' security protocol as an SSL
replacement, and started by using SSL version 3.0 as a starting point.
In 1999, RFC 2246, TLS Protocol Version 1.0 was published as a
Proposed Standard, but it has not been accepted, nor adopted. The
working group has also published RFC 2712, Addition of Kerberos Cipher
Suites to Transport Layer Security (TLS) as a Proposed Standard, and
two RFCs on the use of TLS with HTTP (hyper text transfer protocol -
the protocol the internet uses to communicate between servers and
browsers). The big benefit I see to TLS is that it will be compliant
with a variety of ciphersuites -- increasing the intrusion resistance.
If you are simply looking to understand the adoption of SSL by
e-commerce sites, simply know that most sites with secure areas use
it. The certificate authorities (such as verisign, thawte, etc.)
embrace this (i think 128-bit) standard. If you are looking for
technical information, I suggest a visit to the IETF website. The The
Internet Engineering Task Force is an open organization of various
folks in the internet industry (of which I'm a member) and it operates
primarily via working groups. There are search functions there that
will allow you to find out technical information based on key words. |