User privacy issues regarding certificates and the TLS protocol
Pino Persiano, Ivan Visconti · 2000
The aim of this paper is two-fold.1) We raise concerns regarding possible violations of user privacy relative to the use of X509 Certi cates and the Transport Layer Security protocol.We stress that this approach to secure network transactions, while preserving the interests of service providers, neglects to consider the right to privacy of the users.2) We propose the concept of a crypto certi cate and the Secure and Private Socket Layer protocol (SPSL protocol, in short) and show their eectiveness in preserving user privacy and, at the same time, protecting the interests of service providers.Focusing on the particular case of web transactions, we describe a system based on SPSL for secure and private web navigation.Our implementation includes an SPSL-proxy for an SSL-enabled web client and a module for the Apache web server along with administrative tools for the server side.The system has been developed starting from the implementation of an API for the SPSL protocol that we d escribe in the paper.Experimental results show t h a t S P S L i s an eective and ecient solution to the problem of privacy in web transaction.The protocol we propose and, consequently, the implementation we describe are fully dynamic and provide an adjustable level of privacy.Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page.