Acn 2013-2014

What are SSL and TLS?
SSL Secure Socket Layer TLS Transport Layer Security both provide a secure transport connection between applications (e.g., a web server and a browser) SSL was developed by Netscape SSL version 3.0 has been implemented in many web browsers (e.g., Netscape Navigator and MS Internet Explorer) and web servers and widely used on the Internet SSL v3.0 was specified in an Internet Draft (1996) it evolved into TLS specified in RFC 2246 TLS can be viewed as SSL v3.1
The Secure Socket Layer (SSL) Protocol

q SSL was originally designed to primarily protect HTTP sessions: In the early 1990s there was a similar protocol called S-HTTP However, as S-HTTP capable browsers were not free of charge and SSL version 2.0 was included in browsers of Netscape Communications, it quickly became predominant SSL v.2 contained some flaws and so Microsoft Corporation developed a competing protocol called Private Communication Technology (PCT) Netscape improved the protocol and SSL v.3 became the defacto standard protocol for securing HTTP traffic Nevertheless, SSL can be deployed to secure arbitrary applications that run over TCP In 1996 the IETF decided to specify a generic Transport Layer Security (TLS) protocol that is based on SSL
SSL (Secure Socket Layer)

transport layer security service originally developed by Netscape version 3 designed with public input subsequently became Internet standard known as TLS (Transport Layer Security) uses TCP to provide a reliable end-to-end service SSL has two layers of protocols
Broad overview
SSL runs on top of TCP Provides an API similar to that of TCP Technically, SSL runs in the application layer Advantage: does not require changes to TCP From the programmers point of view, it is in the transport layer Same API as for TCP Runs only with TCP, not UDP Primarily used for HTTP traffic
Location of SSL and TLS in the Internet model
Where SSL Fits

HTTP SMTP POP3 80 25 110 HTTPS SSMTP SPOP3 443 465 995
Secure Sockets Layer Transport Network Link
Services Provided by SSL

SSL encrypts data so that no one who intercepts is able to read it. SSL can assure a client that they are dealing with the real server they intended to connect to. SSL can prevent any unauthorized clients from connecting to the server. Services Fragmentation Compression Message Integrity Confidentiality Framing
7
SSL architecture
SSL Handshake Protocol SSL Change Cipher Spec Protocol SSL Alert Protocol applications (e.g., HTTP)
SSL Record Protocol TCP IP
Architecture
Record Protocol to transfer application and TLS information A session is established using a Handshake Protocol
INITIALIZES SECURE COMMUNICATION
ERROR HANDLING
HANDLES COMMUNICATION WITH THE APPLICATION

Protocols INITIALIZES COMMUNCATION BETWEEN CLIENT & SERVER
HANDLES DATA COMPRESSION
Handshake Protocol
Change Cipher Spec TLS Record Protocol
Alert Protocol
SSL Components
SSL Handshake Protocol negotiation of security algorithms and parameters key exchange server authentication and optionally client authentication SSL Record Protocol fragmentation compression message authentication and integrity protection encryption SSL Alert Protocol error messages (fatal alerts and warnings) SSL Change Cipher Spec Protocol a single message that indicates the end of the SSL handshake
Key Exchange Algorithms
To Exchange an authenticated and confidential message, the client and server each need six cryptographic secrets (Four keys and two initialization vector). To create these secrets, one pre-master secret must be established between the two parties. SSL defines six key-exchange methods to establish this pre-master secret
Null
There is no key exchange in this method. No pre-master secret is established between the client and the server.
RSA key Exchange; Server Public key
In this method, the pre-master secret key is 48byte random number created by the client encrypted with the server s RSA public key and sent to the server. The server needs to send its RSA Encryption/Decryption certificate.
Anonymous Diffie-Hellman Key Exchange
This is the simplest and most insecure method. The premaster secret is established between the client and server using Diffe-Hellman (DH) protocol. The Diffe-Hellman half keys are sent in plaintext. It is called Anonymous Diffie-Hellman because neither party is known to the other. The most serious disadvantage of this method is the Manin-the-Middle attack.
Ephemeral Diffie-Hellman Key Exchange
To thwart the Man-in-the-Middle attack, the Ephemeral DiffieHellman key exchange can be used. Each part sends a Diffie-Hellman key signed by its private key. The receiving needs to verify the signature using public key of the sender. The public key for verification are exchanged using either RSA or DSS digital signature certificate.
Fixed Diffie-Hellman
Another solution is the fixed Diffie-Hellman method. All entities in a group can prepare fixed Diffie-Hellman parameters (g and p). Then each entity can create a fixed Diffie-Hellman half-key (gx ). For additional security, each individual half-key is inserted into a certificate verified by a Certificate Authority (CA)
Fortezza
Fortezza is a registered trademark of the U.S. National Security Agency (NSA). It is a family of security protocols developed for the Defense Department.
Encryption/Decryption Algorithms
There are several choices for the Encryption/Decryption Algorithm. These are divided into six group as shown in figure. All block protocols use an 8-byte initialization vector(IV) except for Fortezza which used 20-byte IV.
NULL
The NULL category simply encryption/decryption algorithm. defines the lack of an
Stream RC Two RC algorithms are defined in stream mode. Block RC

One RC algorithm is defined in block mode. DES
All DES algorithms are defined in block mode. IDEA

The IDEA algorithm defined in block mode is IDEA_CBC, with a 128bit key.
Fortezza
The one Fortezza FORTEZZA_CBC.
algorithm
defined
in
block
mode
is
Hash Algorithms for Message Integrity
NULL
The two parties may decline to use an algorithm. In this case, there is no hash function and the message is not authenticated.
MD5
The two parties may choose MD5 as the hash algorithm. In this case, a 128-key MD5 hash algorithm is used.
SHA-1
The two parties may choose SHA as the hash algorithm. In this case, a 160-bit SHA-1 hash algorithm is used.
Cipher Suite
The combination of key exchange, hash, and encryption algorithms defines a cipher suite for each SSL session. Each suite starts with the term SSL followed by the key exchange algorithm. The word WITH separates the key exchange algorithm from the encryption and hash algorithm.
DHE-RSA (Ephemeral Diffie-Hellman with RSA digital Signature. DH is fixed Diffie-Hellman DHE is Ephemeral Diffie-Hellman DH-anon is anonymous Diffie-Hellman
SSL Cipher Suite List
Client Hello - Cipher Suites

SSL_NULL_WITH_NULL_NULL = { 0, 0 }
PUBLIC-KEY ALGORITHM SYMMETRIC ALGORITHM HASH ALGORITHM CIPHER SUITE CODES USED IN SSL MESSAGES INITIAL (NULL) CIPHER SUITE
SSL_RSA_WITH_NULL_MD5 = { 0, 1 } SSL_RSA_WITH_NULL_SHA = { 0, 2 }
SSL_RSA_EXPORT_WITH_RC4_40_MD5 = { 0, 3 } SSL_RSA_WITH_RC4_128_MD5 = { 0, 4 } SSL_RSA_WITH_RC4_128_SHA = { 0, 5 } SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 = { 0, 6 } SSL_RSA_WITH_IDEA_CBC_SHA = { 0, 7 } SSL_RSA_EXPORT_WITH_DES40_CBC_SHA = { 0, 8 } SSL_RSA_WITH_DES_CBC_SHA = { 0, 9 } SSL_RSA_WITH_3DES_EDE_CBC_SHA = { 0, 10 }

Acn 2013-2014

Uploaded by

Copyright:

Available Formats

Acn 2013-2014

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Acn 2013-2014

Uploaded by

Copyright:

Available Formats

What are SSL and TLS?

The Secure Socket Layer (SSL) Protocol

SSL (Secure Socket Layer)

Location of SSL and TLS in the Internet model

Where SSL Fits

Secure Sockets Layer Transport Network Link

Services Provided by SSL

SSL Record Protocol TCP IP

HANDLES COMMUNICATION WITH THE APPLICATION

HANDLES DATA COMPRESSION

Change Cipher Spec TLS Record Protocol

Key Exchange Algorithms

RSA key Exchange; Server Public key

Anonymous Diffie-Hellman Key Exchange

Ephemeral Diffie-Hellman Key Exchange

Stream RC Two RC algorithms are defined in stream mode. Block RC

All DES algorithms are defined in block mode. IDEA

The one Fortezza FORTEZZA_CBC.

Hash Algorithms for Message Integrity

SSL Cipher Suite List

Client Hello - Cipher Suites

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.