1. Certificates ID on the Internet

2. SSL In the early days of the internet content was simply sent unencrypted. It was mostly academic traffic, and no one was buying stuff from Amazon using credit cards, so the potential for serious fraud was low. Plus, grad students (who ran the systems) are inherently trustworthy You can still see some unencrypted traffic with wireshark if you go to an http site

3. SSL Secure Sockets Layer (SSL, sometimes called TLS for Transport Layer Security) addresses this by encrypting the payloads of packets sent on the wire. Sometimes described as a “shim” between the application and transport layer – First, establish a TCP socket – Then, conduct an additional negotiation to do things like securely exchange session encryption keys – Finally, exchange payload data in encrypted format

4. SSL Remember, the payload is encrypted, but the IP and TCP headers are not. This means an attacker can still do traffic analysis on you; they may not be able to tell what the content is, but they can tell you’re communicating with the site and can see source and destination Ips

5. Certificates How do you know the server you’re talking to really belongs to, for example, NPS? – Somebody subverts DNS and when you type in www.nps.edu it goes to their IP www.nps.edu – Man-in-the-middle attack: there’s someone between you and the real server, talking to both sides To prevent this (to an extent) we can use certificates

6. Certificates How do you know Joe Blow you see on the street is who he says he is? You can ask for his driver’s license – Issued by a trusted third party – Somewhat difficult to forge

7. Certificates A certificate is a “driver’s license” form of ID— a trusted third party (called the certificate authority) does some amount of due diligence and confirms you are who you say you are, then issues you a cryptographically signed certificate For a web server, this includes the server name, institution information, and the public half of a public/private key pair

8. Certificate Info

9. Issued by: GoDaddy Information about the server Public key for the server Signed by GoDaddy (hash of certificate created, then encrypted with the CA’s private key). The encrypted hash can be decoded with the CA’s public key and compared to your own hash of the information in the certificate to confirm the certificate has not been altered

10. Certificates The certificate is placed on your web server configuration, with access to your private key The web server distribution (eg, Firefox, IE Explorer, Safari, etc) have a list of trusted CAs with predefined CA certificates preloaded These are the “state DMVs” that issue driver’s licenses that we are willing to recognize as valid identification You can also load your own CAs, for example for DoD, which is not preloaded on most commercial web browsers

11. Certificates You go to a web site. It uses https and has a cert. Your browser downloads the cert and checks to see if it is signed by an approved CA. If so, the access is allowed If not, the browser will usually present you with a dialog that asks whether you want to accept the cert For development work, many people use “self signed certs,” or set up their own CA and sign the cert themselves.

12. How Secure? Sort of! A number of CAs trusted by web browsers (“DMVs”) have been shown to have lax security measures and their private signing keys were compromised, for example DigiNotar by Iranian authorities Some CAs are owned by, for example, the PLA. In a more secure environment you’d want to remove these CAs from your browser Against a state actor relying on the public CAs is risky— stick with the NSA for defense against that Even sophisticated private actors can sometimes subvert certificate-based security