Is SSL Encryption Symmetric or Asymmetric?

whysguy

Our client is undergoing an internal security review of the OpenDeploy application and they are looking for clarification on the type of encryption used for data transfer over SSL. The question is whether OpenDeploy uses symmetric or asymmetric keys for SSL. I am not an encryption guru, so I am not sure how to answer the question - or even if I am posing the question correctly.

We are currently on OpenDeploy 5.6, SP1 and here is what is stated in the documentation regarding encryption methods:

- Weak (40-bit) symmetric key file-based encryption
- Secure data transfer using Secure Sockets Layer-based (SSL) encryption


Note the explicit statement about the weak encryption method being symmetric, but the SSL encryption makes no note of either asymmetric or symmetric methods. However, in the documentation for previous versions of OpenDeploy, there is a clear effort to describe the encryption methods as Symmetric and Asymmetric:

- Weak (40-bit) symmetric key file-based encryption
- Strong (up to 168-bit) asymmetric key encryption using Secure Sockets Layer-based (SSL) encryption

I don't want to get into splitting hairs in the documentation, but it would help to understand this when discussing application security the Enterprise Architects. Any help on this issue would be appreciated.

Thanks

- Billy

Migrateduser

My knowledge of this subject is very limited. OpenDeploy uses SSL v.3, so you may want to check out web sites or docs that cover the details on how that works.

My understanding is that the exchange of keys between the OpenDeploy sender and receiver is asymmetric (using public and private keys.) The ensuing communication between the two parties is symmetric. I believe that's why the term asymmetric was removed from the OpenDeploy docs; i.e., it wasn't really an accurate term to use for the entire process.

I hope that helps more than it confuses...


Todd Scallan
Director of Product Management
Interwoven
t: 408-530-7167
e: tscallan@interwoven.com