3

If data are passing through a SSL-encrypted connection, is it required to re-encrypt these data? In other words, is it mandatory/useful/worth it to AES/RSA (for example) encrypt data that will be re-encrypted with SSL?

4 Answers 4

3

It depends.

SSL protects the data while it's in transit, but not at any other time. If all you're worried about is an eavesdropper on the network, SSL is sufficient. If you're worried about an untrusted system administrator, or an attacker stealing a hard drive, or other non-network attacks on the data, then further encryption is a good idea.

2

SSL uses a cryptographic system that uses two keys to encrypt data so you do not need to enforce encryption by AES and so on. SSL auhenticate Web servers, and encrypts communications between Web browsers and Web servers.. Websites (bank websites, for example) rely on SSL even to retrieve very sensitive data of their users because this protocole ensures by itself data integrity.

SSL uses assymetric encryption for authentication (between the server and client). After authentication is established, they start to communicate using symetric encryption because it is faster.

enter image description here

From the schema above, you can see data is transferred between the server and the client after authentication is made. Encryption of this data is made after (and thanks to) exchanging the cipher key (symetric encryption)

3
  • My problem is more moral than technic, i use client-server relation (SSL-encryped), so on the server's viewpoint, i can read raw plain datas, which might no be good is it ?
    – Rogue
    Dec 23, 2014 at 21:08
  • @Rogue You receive data in plain text because encryption and decryption is transparent to the user.
    – user45139
    Dec 23, 2014 at 21:44
  • Ok, i'm getting it clearer
    – Rogue
    Dec 23, 2014 at 21:46
2

What you're talking about is the difference between encrypting data in-transit versus encrypting data at rest. If you are concerned about traffic being sniffed or modified in-transit, you need SSL because it provides encryption and authentication. If you're concerned about someone grabbing a hard drive and making off with it, you need to encrypt the data at rest. Both options are valid and not mutually exclusive.

0

You can encrypt the data, and pass that encrypted over the protected socket (Encrypted connection).

  • You can encrypt your data using private key (i.e., secrets)

  • Your company creates an encrypted connection (i.e., a protected socket) using SSL/TLS. E.g., VPN

It's not always mandatory to encrypt all the data and pass everything via an encrypted connection. It's too much overhead when on decrypting that much large data.

  1. Your personal data is secured by you. You do encryption for this. Then you send over whatever (encrypted or non-secure) connection. Your data remains non-tinkered in the receiving side too. ---- You guaranteed non-tampering of your data.
  2. You will use your company's secure connection (VPN) to access outside company just like you access from inside your network. This is the real purpose of the VPN (or encrypted connection). If you send your encrypted data over an encrypted connection then it's just a processing overhead. Don't do this. But, if the company has only a secure connection then send your encrypted data over the secure connection, then at the receiver side, your data remains intact.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .