CertiGuide to Security+  9  Chapter 2:  Communication Security (Domain 2.0; 20%)       9  2.3  The Web            9  2.3.1  SSL/TLS (Secure Sockets Layer / Transport Layer Security)

2.3.1  SSL/TLS (Secure Sockets Layer / Transport Layer Security) 1 2 Transport Layer Security (TLS)

SSL, or Secure Sockets Layer, is a protocol developed by Netscape for securely transmitting confidential information like credit card numbers across the Internet, between a web browser and web server, by means of public key encryption technology. It provides assurance that transmitted data remains private and unmodified, thanks to the encryption of traffic.

It also provides a way for the sender to verify the server’s identity and determine that the server, to which the data is sent, is authorized to have the data. This is achieved by allowing the user to view the certificate information for the server (as we’ll detail in Chapter 4, certificates are digital “documents” containing identifying information verified by a trusted third party). In practice, most users never inspect server certificates, but theoretically, it could be done.

A key part of an SSL communication session is the SSL handshake, in which the server authenticates itself to the client (see above), the client and server agree on an encryption algorithm and encryption keys to use for the rest of the conversation, and (optionally) the client authenticates itself to the server. SSL typically uses a 9-message handshake process, including an optional cipher selection, but it’s often simplified and described as a 6-step handshake:

1. Client sends hello to server
   
   
2. Server sends hello to client
   
   
3. Server sends its digital certificate to client
   
   
4. Client computes a preliminary secret key, and encrypts it using the server’s public key sent in the server’s certificate, then sends the encrypted secret key to the server
   
   
5. The client computes some additional keys and encryption initialization information to be used in the conversation, and sends a “finished” message to the server.
   
   
6. The server also computes additional keys and initialization information, and sends a “finished” message to the client

This process is illustrated in Figure 23.

Originally SSLv2, as supplied with Netscape browsers, supported only DES encryption, which is considered weak today. SSLv3 adds support for optional encryption algorithm selection, so that an appropriate algorithm could be chosen for each application using SSL. SSL implementations can (but are not required to) support a huge variety of encryption ciphers, from 3DES to RSA, RC2 to DSA, MD5 hashing for message integrity verification (without encryption, if desired), etc.¹⁹¹

2.3.1  SSL/TLS (Secure Sockets Layer / Transport Layer Security) 1 2 Transport Layer Security (TLS)