12

I have been asked what is the difference between S-HTTP and HTTPS, and I am wondering if someone has an idea about.

Wikipedia says that S-HTTP encrypts only the served page data and submitted data like POST fields, leaving the initiation of the protocol unchanged. Because of this, S-HTTP could be used concurrently with HTTP (unsecured) on the same port, as the unencrypted header would determine whether the rest of the transmission is encrypted. (I did't get this point, can someone give an example)

In contrast, HTTP over TLS wraps the entire communication within Transport Layer Security (TLS; formerly SSL), so the encryption starts before any protocol data is sent.

So is HTTPS more secure than S-HTTP ?

Improve this question
1
  • Came here after a CISSP test exam question regarding S-HTTP. I honestly had never heard of it.
    – Joe
    Jun 24 at 15:10

1 Answer 1

Reset to default
16

The basic idea of S-HTTP is to do everything which is done in the binary SSL/TLS protocol within the text based HTTP protocol. This by itself does not make it less secure.

What makes it definitely less security from today's view is the choice of allowed ciphers (see section 3.2.4.7 of RFC 2660) which includes only ciphers which are considered weak today. But S-HTTP is not only an old protocol regarding ciphers. It can be expected that some of the attacks which got developed against SSL/TLS in the mean time and which got fixed in subsequent versions will also work against S-HTTP. Given the time when it was developed I expect S-HTTP to be at about the weak security level of SSL 2.0 but at most SSL 3.0.

Improve this answer
2
  • 1
    It is worth to point out, that also the desired URL (in the Request Header) is encrypted with S-HTTP, by leaving the orginial header blank, and providing the actual URL inside the encrypted part. See the already mentioned Wikipedia article.
    – nulldev
    Dec 18, 2017 at 9:00
  • 3
    @nulldev: this is kind of covered by "to do everything which is done in the binary SSL/TLS protocol within the text based HTTP protocol" but yes, it is also similar to HTTPS in this case. It not only protects the URL this way but also almost all headers, including the sensitive Cookie header.
    – Steffen Ullrich
    Dec 18, 2017 at 9:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .