For an e-commerce site, the standard practice is to use a protocol like Transport Layer Security (TLS). TLS employs a hybrid encryption model. It uses asymmetric encryption during the initial handshake to authenticate the server and securely establish a shared secret. This secret is then used to generate a unique, temporary symmetric session key. The bulk of the data exchanged between the customer's browser and the server is encrypted using this efficient symmetric key. This method meets the requirement as the customer does not need to possess or manage a persistent, individual key; a new key is generated for each session and discarded afterward.

A. Asymmetric encryption: While used for the initial key exchange in a TLS session, it is too computationally intensive for encrypting the entire data stream of an e-commerce transaction.
C. S/MIME: This is a standard for securing email, not websites. It requires users to have individual public/private key pairs and digital certificates, which violates the stated requirement.
D. PGP: This is a data encryption program, also primarily used for email, that requires each user to generate and manage their own public/private key pair. ---

1. National Institute of Standards and Technology (NIST). (2019). Special Publication 800-52 Revision 2: Guidelines for the Selection

Configuration

and Use of Transport Layer Security (TLS) Implementations.

Section 3.3.1

Handshake Protocol: "The primary purpose of the Handshake Protocol is to allow the peers to agree upon the security parameters for the Record Layer

authenticate themselves

and instantiate the security parameters. The peers agree on a cipher suite

and if necessary

use public-key cryptography to establish shared secrets." This section details the use of asymmetric cryptography for establishing a shared secret.

Section 2.2.2

Record Protocol: "The Record Protocol is used for the encryption and integrity protection of the application data... The keys used for the encryption and integrity protection are generated from the master secret

which is computed by the Handshake Protocol." This clarifies that the actual application data is protected using keys derived from the handshake

which are symmetric keys.

2. Rivest

R. L. (2017). 6.857 Computer and Network Security

Lecture 10: SSL/TLS. MIT OpenCourseWare.

Slide 10-11

"TLS Handshake": The lecture notes explicitly describe the TLS handshake process where the client and server use public-key (asymmetric) cryptography to agree on a "pre-master secret

" which is then used to derive symmetric keys for the session.

Slide 10-13

"TLS Record Protocol": This slide explains that after the handshake

"all transmitted data is encrypted with symmetric session key

" highlighting the use of symmetric encryption for the bulk data transfer.

3. Stallings

W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson.

Chapter 17

Section 17.2

"TLS Protocol": This chapter describes the TLS architecture

stating

"The TLS Record Protocol provides confidentiality using symmetric encryption... The TLS Handshake Protocol allows the server and client to authenticate each other and to negotiate an encryption and MAC algorithm and cryptographic keys to be used to protect data sent in a TLS record." This text confirms the hybrid nature where symmetric encryption handles the bulk data.