12

I have been asked what is the difference between S-HTTP and HTTPS, and I am wondering if someone has an idea about.

Wikipedia says that S-HTTP encrypts only the served page data and submitted data like POST fields, leaving the initiation of the protocol unchanged. Because of this, S-HTTP could be used concurrently with HTTP (unsecured) on the same port, as the unencrypted header would determine whether the rest of the transmission is encrypted. (I did't get this point, can someone give an example)

In contrast, HTTP over TLS wraps the entire communication within Transport Layer Security (TLS; formerly SSL), so the encryption starts before any protocol data is sent.

So is HTTPS more secure than S-HTTP ?

16

The basic idea of S-HTTP is to do everything which is done in the binary SSL/TLS protocol within the text based HTTP protocol. This by itself does not make it less secure.

What makes it definitely less security from today's view is the choice of allowed ciphers (see section 3.2.4.7 of RFC 2660) which includes only ciphers which are considered weak today. But S-HTTP is not only an old protocol regarding ciphers. It can be expected that some of the attacks which got developed against SSL/TLS in the mean time and which got fixed in subsequent versions will also work against S-HTTP. Given the time when it was developed I expect S-HTTP to be at about the weak security level of SSL 2.0 but at most SSL 3.0.

  • 1
    It is worth to point out, that also the desired URL (in the Request Header) is encrypted with S-HTTP, by leaving the orginial header blank, and providing the actual URL inside the encrypted part. See the already mentioned Wikipedia article. – nulldev Dec 18 '17 at 9:00
  • 3
    @nulldev: this is kind of covered by "to do everything which is done in the binary SSL/TLS protocol within the text based HTTP protocol" but yes, it is also similar to HTTPS in this case. It not only protects the URL this way but also almost all headers, including the sensitive Cookie header. – Steffen Ullrich Dec 18 '17 at 9:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.