SSL / TLS
SSL: used to secure network communication
• Encrypts data before transmission and during transmission
• Developed by Netscape
• Operates above TCP
What SSL can do?
• Uses TCP/IP Layer.
• Allows both server and Client to authenticate themself (Server must, client optional)
• Allow both machine establish encrypted connection.
SSL Concerns:
• Authentication.
• Confidentiality
• Integrity
SSL Features:
• Provides: Confidentiality: messages are encrypted form, Authentication: entities
identify each other, Reliability: maintain integrity checks.
• Widely supported for TCP & Web
• Primarily works for ecommerce stores.
SSL Architecture:
• SSL to Specific to TCP, Doesn't work with UDP.
• Provides API to Applications.
• C and Java libraries.
• Designed to act like Transport + Network Layer.
SSL Socket & Ports:
• SSL Commonly used for HTTP and HTTPS.
• SSL default port is 443.
IETF: Internet Engineering Task Force:
1. Creates standard for the internet.
2. Produce RFC (Request For Comment) which describe technical Foundations such as
(Addressing, routing, transport technologies) + specify Protocols.
SSL Architecture Layers:
3. Lower Layer (Record Layer): One component= SSL Record Layer + Provides Integrity
and Confidentiality.
4. Upper Layer (Handshake Layer) – Three components: Handshake, Change Ciper, Alert.
They manage SSL message exchange.
SSL Component Functions:
Lower Layer (5):
5. Formats upper layer message
6. Fragments data into blocks. + Optionally compress data
7. Encrypts data
8. Adds header and hash MAC address (HMAC)
9. Hands the formatted blocks -> TCP layer
Upper Layer: Most complex part of SSL, Creates SSL session between Server and Client
• Server and Client authentication.
• Key algorithm negotiation.
• Establish key.
○ Session is identified by unique cryptographic security parameters.
○ Multiple TCP connection share the same Session.
○ Handshake Layer uses 4 phases to complete.
Cipher Suite:
Set of algorithms used in SSL/TLS. Ensure how data exchanges, encrypted, integrity during
communication.
Change Cipher Protocol:
Simplest part of SSL. Uses SSL record protocol (lower layer)
• it consist a single message between server and client.
• When entity send change ciper msg, it changes from pending -> secure(encrypted)
state.
• After handshake from pending -> Active state
• Message size is 1 Byte.
Alert Protocol:
Report & Notify about connection closures and errors.
Two parts of alerts:
10. Warning: no impact
11. Fatal error: Impact/break the connection.
HTTPS -> SSL/TCP:
TCP handles the acknowledgements for both handshake and encrypted data.
• Uses cumulative ack + Syn for secure and reliable connections
SSL EXAMPLE:
Q/ How can both way make sure it's public key is coming from the right source?
A/ Using it's digital certificate issues by Certificate Authority (CA)
SSL Benefits:
12. Creates trust.
13. User confidence
14. Customer retention for enterprises
15. Reduce data theft.
Transport Layer Security Protocol:
Release by IETF, designed to provide security at Transport Layer ensure no eavesdrop and
tamper.
Benefits:
16. Encryption
17. flexibility
18. Ease of deployment
19. Ease of Use.
TLS feature:
20. Enable secure communication.
21. Operate above TCP (like SSL)
22. used to secure data from web browser to website.
23. Similar architecture to SSL. 1. Record Protocol + 2. Handshake Protocol.
TLS Architecture:
The record protocol contains 5 separate sub-protocols:
24. Handshake: secure connection
25. Application: Data Transmission.
26. Alert: errors & notify
27. Change Ciper Spec: modify encryption parameters.
28. Heartbeat: Check if connection is alive.
Comparison between SSL and TLS:
SSL TLS
Version: 3.0 1.0
Create Master key Message Digest Pseudo-Random
Secret:
Protocol: Message Authentication Code Hashed Message Authentication
Code
Complexity: Complex than TLS Simple
TLS/SSL Versions:
• SSL v1.0: Developed by Netscape, Never Publicly Released, Full of Flaws.
• SSL v2.0: Complete Redesign of SSL v1.0, Full of flaws.
• SSL v3.0: Complete Redesign of SSL v3.0, Introduced TLS foundation.
• TLS v1.0: Renamed when SSL became open standard, bought by IETF, identical to SSL
V3.0, Hashed MAC Address (HMAC), Major Vulnerability: BEAST.
• TLS v1.1: Similar to TLS 1.0, deprecated "EXPORT grade", protection against CBC
"BEAST" attack.
* TLS v1.0 & v1.1 deprecated (Not recommended to use) because failed most compliance
(HIPPA, NIST)
• TLS v1.2: Similar to TLS v1.1, Improved key generation, introduced AEAD
(Authenticated Encryption with Associated Data) ciphers.
• TLS V1.3: Major change from prior versions, shorter handshake (2 messages instead of
5+), Forward and AEAD required, Favors simplicity & security.
TLS Compatibility between Client and Servers:
Compatible:
29. TLS v1.3 -> TLS v1.3/ TLS v1.2
30. TLS v1.2 -> TLS v1.3/ TLS v1.2
Compatible but not secure:
31. TLS v1.2 -> TLS v1.1/ TLS v1.0
32. TLS v1.1/ TLS v1.0 -> TLS v1.2/ TLS v1.1/ TLS v1.0 (Not recommended)
Incompatible: Anything else. Because it's downgrade, insecure, deprecated.
HTTPs- Secure Browsing:
Hyper Text Transfer Protocol (HTTP) is used for web browsing.
• Similar to https, only difference https is secure.
• HTTPs stands for HTTP over SSL. this protocol used to provide encrypted +
authenticated communication between client and server.
QUIC: UDP Transport Protocol built on top of HTTP/2
• Makes connection faster & More secure. Eliminates latency + reliability issues.
• Works with TLS v1.3 for encryption and authentication.
• Port: 443
Working of HTTPs:
Uses both SSL/TLS.
33. Request https:// followed by URL
34. Browser imitates connection to web server -> triggers SSL/TLS
35. Browser uses port 443
36. SSL protocol goes through handshake protocol for secure session.
37. Website send certificate to browser, SSL Handshake progresses to exchange secrets.
38. After verification users gets padlock icon, When an extended validation certificate is
installed on a website -> address bar turns green.
Use of HTTPs:
39. Provides Confidentiality + Server authentication + integrity
40. prevents data from eavesdrop and identity theft -> common attacks on HTTPs
41. The use of http and HTTPs require more computing power in client and server to carry
encryption & handshake.