Download presentation
Presentation is loading. Please wait.
Published byRuby Craig Modified over 9 years ago
1
SSL and https for Secure Web Communication CSCI 5857: Encoding and Encryption
2
Outline Server-side certificates The SSL protocol –Algorithm selection –Certificate exchange –Key generation SSL data transmission –Encryption and information integrity Initiating secure sessions
3
Web Security Problems Encryption of sensitive data sent between client and server Authentication of server –How does client know who they are dealing with? Information integrity –How do we know third party has not altered data en route? Change so item shipped to Darth Address information Bob’s web site Alice thinks she is at Bob’s site, but Darth is spoofing it Bob’s web site
4
Certificates Web sites that deal in ecommerce must have certificates for authentication –Installed at server –Transmitted to client for authentication –Validated by browser using CA’s public key Client Browser Request for secure session Web Server Web Container (JSP, ASP) Certificate signed by CA CA
5
Certificates Public keys stored in browser –Can request from other CAs via public key infrastructure as needed
6
Secure Socket Layer Protocol Latest upgrade: Transport Layer Security (TLS) Same structure as SSL, somewhat more secure
7
SSL Protocol: Phase 1 Phase 1: Information exchange Problem: Large number of encryption algorithms in use –How do client and server agree on which to use? –How does client tell server which ones it supports?
8
SSL Protocol: Phase 1 Client passes preferred algorithms to server via https request Public key encryption algorithms Private key encryption algorithms Hash algorithms Compression algorithms Also random number for key generation Server replies with algorithms that will be used Also passes own random number
9
SSL Protocol: Phase 2 Phase 2: Server Authentication and Key Exchange Server passes their certificates to client –Client uses issuer public key to verify identity –Client retrieves server public key from certificate –Server may pass chain of certificates for authentication
10
SSL Protocol: Phase 2 If no certificate containing a public key, separate public key must be passed Certificate contains RSA public key, so no separate key passed No certificate, so Diffie- Hellman key exchange parameters passed
11
SSL Protocol: Phase 2 Server can also request appropriate client certificates to authenticate client –Online banking –Remote access to company database
12
SSL Protocol: Phase 3 Phase 3: Client Authentication and Key Exchange Client sends certificate or public key if requested by server
13
SSL Key Generation Client generates “pre-master key” Sends to server encrypted with server public key Client and server use to generate master key used to create cipher keys –Also use client, server random numbers exchanged in phase 1
14
SSL Key Generation
16
Key material used to generate: –Keys for encryption and authentication (MAC) –IV’s for cipher block chaining
17
Phase 4: Final Handshake Client and server verify protocols and keys Sender signs/encrypts “finished” message Receiver decrypts/verifies message to confirm keys
18
SSL Data Transmission Message broken into blocks Block compressed Compressed block hashed with authentication key to get MAC (message integrity) Compressed block + MAC encrypted with cipher key Encrypted block + record protocol header with version/length information sent
19
SSL Data Transmission MAC algorithm is modified HMAC –Two stage hash with secret MAC key inserted at each stage –Values similar to IPAD and OPAD also inserted
20
Sessions and SSL Connection: single transmission between client and server Session: set of connections for some purpose –Example: Ecommerce payment session: Credit card, Address, etc. Can reuse same keys for all connections in session –Much more efficient than restarting SSL protocol each connection
21
Https Protocol When started, requests secure session from server –Uses separate port in some servers Invokes SSL protocol
22
Https protocol is expensive –Should not do unless necessary Once done with secure transactions, should go back to using non-secure channel –Return to non-secure port Https Protocol
Similar presentations
© 2024 SlidePlayer.com Inc.
All rights reserved.