What is e-commerce? | Security | Programming | Statistics

Encryption and Decryption:
Encryption is the transformation of data into a numerical (cipher) format that to all intents and purposes cannot be easily understood by unauthorized people. In order to easily recover the contents of an encrypted signal, the correct decryption key is required. Its purpose is to ensure privacy and keep information hidden from persons for whom it is not destined, including persons that have access to coded data. Decryption is the process by which encrypted data is returned to a legible format.

Digital Certificates / Digital IDs:
A digital certificate is an electronic "passport" that establishes your credentials when doing business or other transactions on the Web. It is issued by a certification authority (CA). It contains your name, a serial number, expiration dates, a copy of the certificate holder's public key (used for encrypting messages and digital signatures), and the digital signature of the certificate-issuing authority (Thawte for example) so that a recipient can verify that the certificate is real. It is probable that in the near future organizations and individuals will have several digital certificates (IDs) for a range of different activities in which they are required to validate their identities. For example, a person working within a government department may use one digital ID to access confidential information within an intranet while using another separate ID to make on line purchases. The government or department can be the authority that issues digital certificates.

Certificate Authority:
A certificate authority (CA) is an authority within a network that issues and manages security credentials and public keys for encrypting and decrypting messages. A CA will authenticate documents to verify the identity of the person or organization prior to issuing a digital certification. A hierarchy of digital authorities may exist with different purposes within the Public Key Infrastructure (PKI). Depending on the implementation of the PKI the certificate may include the owner's public key, the expiration date of the certificate, the owner's name, as well as any other information regarding the public key owner. The certifying authorities structure is incredibly complex and must be changed in some way before it could be easily applied to Internet users, but will be essential to a large scale evolution in e-commerce.

Digital Signatures:
A digital signature, which should not be confused with digital certificate, is an electronic signature than can be used to authenticate the identity of a message's sender, a document's signatory, or a credit card owner. It can also be used to ensure that the original content of a message or document has not been changed. A digital signature is usually generated from a digital certification using public and private key technology. (It is important to note that a digital signature is not the saved image of a real signature, a relatively common error). The additional benefits of a digital signature are that they are easy to transport, cannot be easily repudiated, cannot be imitated by another person, and can be automatically time-stamped. A digital signature can be used with any type of message, whether it be encrypted or not, and ensures that the receiver is able to confirm the identity of the sender and that the message has arrived intact. A digital certificate also contains the digital signature of the certificate-issuing authority so that anyone is able to verify that the certificate is real.

If you are interested in learning more about cryptography and public and private keys we recommend you visit the Frequently Asked Questions page of the RSA at http://www.rsasecurity.com/

At PanamaCOM we have the experience needed to create secure e-commerce applications.