S-HTTP supports several cryptographic mechanisms and key management methods, but specializes in the RSA suite. Negotiation of modes is based on the security requirements of the clients and the servers. This allows great flexibility in the type of transaction that needs to take place, what certificates are to be used, whether they are signed or unsigned, and what is needed for each transaction. Client might require the server's response to be encrypted. A new set of headers specifying negotiation parameters are added to the shttp message.
Initial headers tell the recipient how to unwrap the encapsulated message.
At the Fourth WWW conference in Boston, there was a demonstration of Mosaic with an S-HTTP CCI ready and working. What NCSA has done is add some tags to HTML to take care of the encryption hints needed by the CCI to process the request. This example uses PGP as the encryption type, although in theory, S-HTTP allows any number of encryption schemes. The CCI application verifies that all 32 bits of the ID string are present, then uses the key ID to look up the public key for the server in question. Using this method allows for the transmission of data in an encrypted form, storage of the data on an untrusted server, and verification of both data and the keys used to encrypt it .