Internet Security protocols

Internet Security protocols

Internet security protocols are a set of standardized rules and procedures that govern how data is

transmitted, authenticated, and protected over the Internet (Khilar et al., 2022). These protocols

ensure the confidentiality, integrity, and availability of information exchanged between

networked devices

SET

Secure Electronic Transaction (SET) was an internet protocol developed in the 1990s to enhance

the security of online credit card transactions. SET was a joint effort by major credit card

companies, including Visa, MasterCard, and American Express, to establish a standardized

Certification Authority (CA). The CA would verify the merchant's identity and issue a digital

certificate that contained the merchant's public key.

Cardholder Registration: Similarly, cardholders had to register with a CA and obtain a digital

certificate containing their public key. This certificate was used to authenticate the cardholder

during transactions.

Payment Gateway: A payment gateway acted as an intermediary between the merchant and the

cardholder's bank. It received the transaction details from the merchant and verified the

authenticity of the merchant and cardholder using their digital certificates.

Secure Channel: SET utilized secure channels, typically SSL/TLS, to ensure the confidentiality

and integrity of the communication between the merchant, the payment gateway, and the

accessed by the intended recipient

According to El et al., (2017), the electronic payment step of the electronic business system is

one of the most critical steps, and the security of this step must be assured. SSL/TLS and SET

are two methods that are frequently brought up in conversations about protecting online credit

card transactions. E-commerce players have not really accepted SET due to implementation

challenges, although SSL/TLS is widely used for Internet e-commerce security despite the fact

that it does not handle all security vulnerabilities. SET has not really been adopted since there

have been implementation issues. The three-domain (3D) security schemes, such as 3-D Secure

and 3D SET, have lately been suggested as potential methods for enhancing the safety of e-

commerce financial transactions. We developed a safe and effective E-Payment protocol by

SET Security Threats/Attack

Man-in-the-Middle (MitM) Attacks: SET transactions could be susceptible to MitM attacks,

where an attacker intercepts the communication between the cardholder, merchant, and payment

gateway. The attacker can eavesdrop on sensitive information, modify the transaction details, or

impersonate one of the parties involved.

Fraudulent or Compromised Certificates: The security of SET heavily relied on digital

certificates issued by Certification Authorities (CAs). If a CA's private key is compromised, an

cardholder.

users into believing they are engaging in a secure transaction when, in fact, they are interacting

with an attacker.

Replay Attacks: In a replay attack, an attacker intercepts a valid SET transaction and re-transmits

it at a later time to fraudulently authorize a duplicate transaction. This could lead to unauthorized

payments or goods being delivered multiple times.

Malicious Software: SET could be vulnerable to attacks involving malicious software, such as

keyloggers or malware that targets the cardholder's or merchant's systems. These threats could

capture sensitive information, such as passwords or private keys, compromising the security of

the transaction.

increased the likelihood of implementation errors and vulnerabilities.

Certificate Management: SET relied heavily on digital certificates issued by Certification

Authorities (CAs). If a CA's private key was compromised, it could lead to fraudulent certificates

being issued or the impersonation of legitimate entities in SET transactions.

Trust Model: The trust model used in SET introduced potential vulnerabilities. It relied on users

trusting the CAs to correctly issue and manage digital certificates. If a CA was compromised or

issued certificates without proper verification, it could undermine the security of the protocol.

Lack of Forward Secrecy: SET did not provide forward secrecy, meaning that if an attacker

obtained a cardholder's private key, they could decrypt past transactions. This lack of forward

Complexity and Implementation Issues: Previous research has identified the complexity of SET

as a challenge. The protocol involves multiple entities, complex message exchanges, and

Lack of Merchant Adoption: Adoption of SET by merchants has been limited, despite its security

features. Research has highlighted the reluctance of merchants to invest in infrastructure

upgrades and the perceived complexity of SET implementation as barriers to adoption.

versions, security mechanisms, and certification processes have hindered widespread adoption

Problem Statement:

Despite the security advantages of SET, merchant adoption remains low, primarily due to

complexity, implementation challenges, and interoperability issues. Additionally, user experience

and usability concerns, such as additional authentication steps and the need for digital

certificates, have hindered widespread acceptance of SET. Furthermore, the lack of

standardization and compatibility across different SET implementations and versions has created

inconsistencies, making interoperability difficult. The research will focus on identifying

merchants while ensuring its security features are maintained. User experience and usability

enhancements will be explored, seeking ways to streamline the transaction process and mitigate

user frustration. The study will also address interoperability challenges by proposing

standardized protocols and security mechanisms, aiming for seamless coordination between

stakeholders. Furthermore, the research will investigate the threats and vulnerabilities identified

in SET to enhance its security posture. This includes analyzing potential attacks, such as man-in-

the-middle, data interception, or unauthorized access, and proposing countermeasures to mitigate

these risks. Additionally, the study will explore the impact of emerging technologies, such as

mobile devices and blockchain, on SET security and propose ways to leverage these technologies

to enhance the protocol.

The SSL protocol operates at the transport layer of the TCP/IP protocol stack and is commonly

used in combination with HTTP to create HTTPS (HTTP Secure) connections. When a client,

such as a web browser, initiates a connection to a server that supports SSL, a process known as

the SSL handshake takes place to establish a secure connection.

According to Weaver, Secure Sockets Layer (SSL) is a protocol that is based on the Web and is

used to encrypt data transfers that take place over the internet. A review of the symmetric-key

and public-key cryptography (also known as PKC), which are the two forms of encryption on

which SSL is based, is also required if we are to comprehend how SSL accomplishes its tasks. If

receiver need to be utilizing the same cryptographic technique, and they need to keep a secret

safe. In the case of symmetric-key cryptography, this secret is a random number known as a key,

and in the case of public-key cryptography, this secret is the private key of a public/private key

pair. Large messages are broken up into numerous smaller messages, each of which can have a

maximum size of 16 kilobytes, so that the data can be transported. Following the addition of an

optional compression step, each message is followed by the addition of a message authentication

code, which is a hash derived from the plaintext, the two nonces, and the pre master secret. Both

the plaintext and the MAC that was attached have now been encrypted using the symmetric-key

scheme that was negotiated and the session key that was computed.

Threats of SSL

Man-in-the-Middle (MitM) Attacks: SSL/TLS connections are susceptible to MitM attacks

where an attacker intercepts and alters the communication between the client and the server. This

can allow the attacker to decrypt and read sensitive data or even inject malicious content into the

communication.

Weak Cipher Suites: The choice of weak or outdated cipher suites in SSL/TLS configurations

Expired or Invalid Certificates: SSL/TLS relies on digital certificates to verify the authenticity of

the server. If a certificate expires, becomes invalid, or is issued by an untrusted or compromised

impersonate the server or perform man-in-the-middle attacks by presenting fake or malicious

certificates.

Certificate Authority Compromise: If a trusted CA is compromised, attackers can issue

fraudulent certificates for legitimate websites, allowing them to impersonate those websites and

deceive users into sharing sensitive information.

Implementation Flaws: SSL/TLS implementations can have vulnerabilities or flaws in their code,

which can be exploited by attackers. These implementation flaws can lead to security

validation.

data to interception and manipulation.

POODLE (Padding Oracle on Downgraded Legacy Encryption): This vulnerability affected

SSLv3 and earlier versions of SSL/TLS (Purchina et al., 2022). It allows attackers to decrypt

secure connections by exploiting a flaw in the CBC (Cipher Block Chaining) mode of operation.

As a result, SSLv3 is now considered insecure and should be disabled.

many SSL/TLS implementations. It allowed attackers to retrieve sensitive information from the

DROWN (Decrypting RSA with Obsolete and Weakened eNcryption): DROWN is an attack that

targets SSLv2, exploiting its weak encryption. It allows attackers to decrypt TLS sessions even if

ROBOT (Return Of Bleichenbacher's Oracle Threat): ROBOT is a vulnerability that affects RSA

encryption in SSL/TLS. It allows attackers to decrypt ciphertexts and gain access to sensitive

Key Management Complexity: SSL involves the management of cryptographic keys, including

key generation, distribution, storage, and revocation. Previous research has identified challenges

Certificate Authority (CA) Trust: SSL relies on trusted CAs to issue digital certificates that verify

the authenticity of websites. However, challenges have been identified regarding the

trustworthiness of CAs, their validation processes, and potential vulnerabilities in the CA

infrastructure.

from the user's perspective. Issues such as SSL warning fatigue, complex certificate error

Problem Statement:

The previous research on SSL has identified gaps, threats, and vulnerabilities that require further

investigation and resolution to enhance the security and usability of SSL. Therefore, the problem

statement for this research is as follows: The objective of this research is to address the identified

gaps, threats, and vulnerabilities in SSL to improve its overall security and usability. The study

aims to investigate the challenges related to key management complexity, certificate authority

awareness in SSL. The research will delve into the complexities of key management in SSL,

exploring ways to simplify and enhance secure key generation, distribution, storage, and

revocation practices. Additionally, the study will examine the trustworthiness and validation

processes of CAs, proposing mechanisms to strengthen the CA infrastructure and address

potential vulnerabilities in SSL certificate issuance. Furthermore, the research will address

compatibility and interoperability challenges by investigating inconsistencies in SSL

implementation across different browsers and platforms. It will propose solutions to ensure

consistent SSL support and behavior, reducing potential vulnerabilities resulting from

compatibility issues.

PGP Pretty Good Privacy

PGP (Pretty Good Privacy) is a widely used internet security protocol that provides encryption

and authentication for secure communication, primarily for email messages (Tripathi et al.,

2022). PGP was created by Phil Zimmermann in 1991 and has become a de facto standard for

end-to-end encryption and digital signatures.

Key features and components of the PGP protocol

public key is used for encrypting messages, while the private key is kept secret and used for

decrypting messages.

Digital Signatures: PGP enables the use of digital signatures to verify the authenticity and

integrity of messages. A sender can sign a message using their private key, and the recipient can

use the sender's public key to verify the signature, ensuring that the message hasn't been

tampered with during transmission.

Key Management: PGP employs a web of trust model for key management. Users can sign each

other's public keys to establish a level of trust. This decentralized approach allows users to

independently verify the authenticity of public keys and build a network of trusted contacts.

Certificate Revocation Challenges: Revoking compromised or invalid certificates in S/MIME

can be challenging. Ensuring that revoked certificates are recognized and no longer trusted by all

different email clients or platforms can result in compatibility issues or weaken security.

Implementation Flaws: Vulnerabilities can exist in the implementation of S/MIME within email

clients or servers. These implementation flaws can range from buffer overflows to insecure

handling of cryptographic operations, potentially exposing sensitive information.

when handling email attachments or clicking on links to mitigate the risks associated with

Challenges/ Problem Statement

Usability Challenges: Previous research has highlighted challenges related to the usability of

S/MIME, including complex key management processes, the need for user education and

technical expertise, and difficulties in integrating S/MIME with various email clients and

platforms.

Interoperability Issues: S/MIME interoperability challenges have been identified, stemming from

differences in the interpretation and implementation of the S/MIME standard across different

adoption of S/MIME.

identified regarding the trust model's effectiveness, the potential for compromised or fraudulent

CAs, and the management of certificate revocation.

Key Management Complexity: Effective key management is crucial for S/MIME security.

However, challenges have been identified regarding the complexity of generating, distributing,

and managing cryptographic keys, as well as securely storing and protecting private keys.

User Awareness and Adoption: Lack of user awareness and understanding of S/MIME, its

benefits, and its implementation practices have been identified as challenges. Limited adoption

of S/MIME by individual users and organizations has been attributed to factors such as

complexity, perceived inconvenience, and the availability of alternative secure communication

methods.

Problem Statement

the wider adoption and effective usage of S/MIME in various email environments. The research

will examine the specific usability challenges associated with S/MIME, focusing on key

management processes, user education, and the integration of S/MIME with different email

clients and platforms. The aim is to identify strategies and improvements that simplify the user

experience and increase the ease of adoption. Additionally, the study will address interoperability

challenges by investigating inconsistencies in the interpretation and implementation of the

S/MIME standard across different email systems. The research will propose recommendations

and best practices to promote better interoperability and compatibility between S/MIME

implementations.

Furthermore, the research will explore the limitations of the trust model in S/MIME, considering

complexity of key management in S/MIME, aiming to identify user-friendly approaches, tools,

and best practices for key generation, distribution, storage, and protection. The goal is to simplify

focus on raising awareness and promoting user adoption of S/MIME. By identifying barriers to

adoption, misconceptions, and user concerns, the research will propose strategies for educating