View source for Security in E-Commerce Systems

==Introduction==
In e-Commerce Systems two things must be guaranteed:
* The communication partner must in fact be the person he says he is.
* The communication must be secure.

The first demand can be fulfilled by an authentication with certificates.<br>
And the second demand can be fulfilled by encryption with SSL.


==Technologie==
The most used protection technologie in e-Commerce Systems is PKI (Public Key Infrastructure).
A PKI consists of a Registration Authority (RA) and a Certification Authority (CA).


Tasks of the RA:
* Reception of certificate requests
* Authentication of persons and authorities
* Verification of data
* communicates confidentially with the CA
* Distribution and verification of certificates
* direct interface to the customer


Tasks of the CA:
* Generation of certificates
* Prolongation/Renewal/Withdrawal
* Validation, Cross Certification


For more information about PKI and Certificates see also: [[Digital Certificates and Digital Signatures]].


==Weak Points==
The most frequent weak points in e-Commerce Systems are:
* too short and too simple passwords
* weak encryption (with too short keys)
* careless use with passwords and access data