HTTPS
HTTPS (HyperText Transfer Protocol Secure) is a secured version of HTTP, a text-based data transfer protocol using the request-and-respond method. While traditional HTTP communicates with plain text (which can be intercepted and read), HTTPS using a form of Public-key encryption to help provide Internet security for the information which is transferred.[1]
Function
Since HTTP packets can be easily intercepted and read, the primary goal of HTTPS is to encrypt this communication without significantly impacting the functionality of the World Wide Web. Using asymmetric encryption (SSL or TLS), the server and client connect to each other. The client sends a request for the server's public key, which the server sends. The client also supplies its public key, so each can communicate with the other securely. Each party can also verify the sender of each message, because each message is encrypted with the sender's private key, which only they should posses.[2]
However, there is still a flaw in this system alone. During the initial exchange, an attacker could intercept the server's public key, and send his own. The client would never know, but the attacker has essentially tapped into the entire exchange. To deal with this issue, servers using HTTPS have their public keys indexed by certificate authorities. When a client attempts to visit a site using HTTPS, the client checks the supplied public key against the one on file with a certificate authority. If they match, the process continues and the key as saved on the client's device for future use. If not, the user is shown a security warning. An increasing number of browsers even block access altogether in case of a supplied key/certificate mismatch.[3]
Asymmetric encryption is very slow and inefficient, however, so once connected, the host and client share a symmetric key which they use from then on. Now they can communicate with reasonable certainty that their exchange is private.