1. email or call for office visit, or call Kathy Cheek, 404 894-5696
ECE-6612
Prof. John A. Copeland
fax
Office: Centergy 5138, VL-w315
or call for office visit, or call Kathy Cheek,
Chapter 7a - Secure Socket Layer (SSL)
and Secure Electronic Transactions (SET)

2. Router SSL SSL IPsec IPsec Process Process Application Application
Buffers Packets that
Transport
need to be forwarded
Transport
Layer
(based on IP address).
Layer
(TCP,UDP)
(TCP,UDP)
IPsec
IPsec
Network
Network
Network
Network
Layer (IP)
Layer
Layer
Layer (IP)
Token Ring
E'net Data
Token Ring
E'net Data
Link Layer
Link Layer
Data-Link Layer
Data Link Layer
Token Ring
Ethernet
E'net Phys.
Token Ring
Phys. Layer
Layer
Phys. Layer
Phys. Layer 2

3. The combinations are called:
HTTPS SFTP ESMTP
TLS is Transport Layer Security (is not “IPsec Transport Level Security”)
TLS is used for (SMTP/TLS or POP/TLS or IMAP/TLS)
SSL is used for secure Web access (HTTPS)
Secure Shell, SSH, is Telnet + SSL + other features
Secure Copy, SCP, copies files using SSH (no other FTP functions) 3

4. HTTPS HTTPS is HTTP with SSL (Secure Socket Layer).
SSL Encrypt
HTTPS is HTTP with SSL (Secure Socket Layer).
HTTPS uses the TLS/SSL default TCP port,which is TCP port 443 4

5. Fig. 7.3 SSl Record Protocol Operation5

6. SSL Handshake - First Part
Time
Gray areas are optional in some circumstances. 6

7. SSL Handshake - Second Part
Time
Gray areas are optional in some circumstances. 7

8. WireShark* View of HTTPS (TLS = SSL) Connection
*Capture Filter: ether host 00:0d:56:fe:2b:af

9. Programming with SSL NAME [from UNIX “#man ssl”]
SSL - OpenSSL SSL/TLS library
DESCRIPTION
The OpenSSL ssl library implements the Secure Sockets Layer (SSL v2/v3)
and Transport Layer Security (TLS v1) protocols. It provides a rich API
which is documented here.
At first the library must be initialized; see SSL_library_init(3). [(3) ->use #man 3 ...]
Then an SSL_CTX object is created as a framework to establish TLS/SSL
enabled connections (see SSL_CTX_new(3)). Various options regarding
certificates, algorithms etc. can be set in this object.
When a network connection has been created, it can be assigned to an
SSL object. After the SSL object has been created using SSL_new(3),
SSL_set_fd(3) or SSL_set_bio(3) can be used to associate the network
connection with the object.
Then the TLS/SSL handshake is performed using SSL_accept(3) or SSL_con-
nect(3) respectively. SSL_read(3) and SSL_write(3) are used to read
and write data on the TLS/SSL connection. SSL_shutdown(3) can be used
to shut down the TLS/SSL connection. 9

10. SET (Secure Electronic Transactions)
• Provides a secure communications channel among all the parties involved in a transaction: Customer, Seller, Customer’s credit provider, Seller’s bank.
• Provides trust by the use of X.509v3 certificates.
• Ensures privacy because information is only made available to the parties that need it.
* Cardholder account authentication to the Merchant (Cardholder must have a Certificate issued by the credit company). Merchant may issue a temporary Certificate to issue the session is not high-jacked).
* Verifies that Merchant has a business relationship with a financial institution.
* Integrity of data customer sends to Merchant (order info tied to funds transfer). 10

11. SET - Steps in a Transaction
1. Customer opens account with credit (card) company or bank that supports SET.
2. Bank issues an X.509 certificate to the Customer with RSA Public-Private Keys.
3. Merchant has two certificates, one for signing messages and one for key exchange.
----
4. Customer places an order.
5. The Merchant sends the customer a copy of his certificate.
6. The Customer sends Order Information (OI) encrypted so the Merchant can read it, and Payment Information (PI) encrypted so the Merchant can not read it.
---
7. Merchant requests payment by sending PI to the “Payment Gateway” (who can decrypt it) and verifies Customer’s credit is good.
8. Merchant confirms the order to the Customer.
9. Merchant ships goods to Customer.
10. Merchant sends request for payment to the Payment Gateway which handles transfer of funds. 11

12. Secure Electronic Transactions (SET)12

13. Dual-Sig = E cus-private [ H( H(PI) || H(OI) ) ]
SET - Dual Signature
Dual-Sig = E cus-private [ H( H(PI) || H(OI) ) ]
The Dual signature allows proof that:
1. Merchant has received Order Information.
2. Bank has received Payment Information and verified the Customer signature.
3. Customer has linked OI and PI and can prove later that PI was not related to a different purchase. 13

14. 14

15. Customer’s Purchase Request15

16. 16

17. Threats to the Net