Ssl https
- 2. Presentation plan What is HTTP?
- 3. Presentation plan What is SSL?
- 4. What is SSL? Secure Sockets Layer (SSL) is a computer networking protocol for securing connections between network application clients and servers over an insecure network, such as the internet, due to numerous protocol and implementation flaws and vulnerabilities SSL was originally specified in the 1990s as a proprietary protocol that allowed Netscape browser clients using the Hypertext Transfer Protocol (HTTP) to communicate securely with Netscape web servers. SSL eventually came to be used to secure authentication and encryption for communication at the network transport layer. Netscape Communications was a computer services company best known for its Web browser, Navigator. Navigator was one of the two most popular Web browsers in the 1990s.
- 5. Presentation plan What is SSL? How does SSL work?
- 6. How does SSL work? SSL runs above the transport layer and the network layer, which are responsible for the transport of data between processes and the routing of network traffic over a network between client and server, respectively, and below application layer protocols such as HTTP and the SMTP (Simple Mail Transport Protocol). The "sockets" part of the term refers to the sockets method of passing data between a client and a server program in a network, or between processes in the same computer.
- 7. How does SSL work? SSL uses a combination of public key and symmetric key encryption to secure a connection between two machines, typically a web or mail server and a client system, communicating over the internet or another TCP/IP network.
- 8. How does SSL work? The SSL protocol includes two subprotocols: the record protocol the "handshake" protocol.
- 9. The record protocol • The record protocol defines how communicating hosts exchange data using SSL, including specifications for how data is to be prepared for transmission and how it is to be verified or decrypted on receipt.
- 10. The handshake protocol •The handshake protocol defines how a client and server establish an SSL connection, including the negotiation of which cryptographic systems each host is willing (or unwilling) to use for communication, as well as the exchange of cryptographic material, such as public keys and session keys for encryption or authentication of transmitted data.
- 11. How does SSL work? Once the server has been authenticated, the client and server establish cipher settings and a shared key to encrypt the information they exchange during the remainder of the session. This provides data confidentiality and integrity.
- 12. How does SSL work? This whole process is invisible to the user. For example, if a webpage requires an SSL connection, the URL will change from HTTP to HTTPS, and a padlock icon will appear in the browser once the server has been authenticated.
- 13. How does SSL work? •The handshake also allows the client to authenticate itself to the server. In this case, after server authentication is complete, the client must present its certificate to the server to authenticate the client's identity before the encrypted SSL session can be established.
- 14. Presentation plan What is HTTP? What is SSL? How does SSL work? What is TSL?
- 15. What is TSL? After the IETF officially took over the SSL protocol to standardize it through an open process, version 3.1 of SSL was released as TLS 1.0.
- 16. What is SSL? SSL was deprecated for use on the internet by the Internet Engineering Task Force (IETF) in 2015 and has been replaced by the Transport Layer Security (TLS) protocol. While TLS and SSL are not interoperable, TLS is backwards-compatible with SSL 3.0.
- 17. What is TSL? Many attacks against SSL have focused on SSL implementation issues, but the POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerability is a known flaw in the SSL 3.0 protocol itself, exploiting the way in which it ignores padding bytes when running in cipher block chaining mode. This flaw allows an attacker to decrypt sensitive information, such as authentication cookies. TLS 1.0 is not vulnerable to this attack because it specifies that all padding bytes must have the same value and must be verified.
- 18. What is TSL? Other key differences between SSL and TLS that make TLS a more secure and efficient protocol are: message authentication, key material generation, cipher suites, TLS supporting newer and more secure algorithms. TLS 1.2 is the most recent version, but publication of the next version is expected to be approved in 2017; the update is likely to be called either TLS 1.3 or TLS 2.0.
- 19. Presentation plan What is SSL? How does SSL work? What is TSL? What is HTTP?
- 20. What is HTTP? HTTP (Hypertext Transfer Protocol) is the set of rules for transferring files (text, graphic images, sound, video, and other multimedia files) on the World Wide Web. As soon as a Web user opens their Web browser, the user is indirectly making use of HTTP. HTTP is an application protocol that runs on top of the TCP/IP suite of protocols (the foundation protocols for the Internet). HTTP concepts include the idea that files can contain references to other files whose selection will elicit additional transfer requests. Any Web server machine contains, in addition to the Web page files it can serve, an HTTP daemon, a program that is designed to wait for HTTP requests and handle them when they arrive.
- 21. What is HTTP? The Web browser is an HTTP client, sending requests to server machines. When the browser user enters file requests by either "opening" a Web file (typing in a Uniform Resource Locator or URL) or clicking on a hypertext link, the browser builds an HTTP request and sends it to the Internet Protocol address (IP address) indicated by the URL. The HTTP daemon in the destination server machine receives the request and sends back the requested file or files associated with the request. (A Web page often consists of more than one file.)
- 22. What is HTTPS? HTTP + SSL/TSL = HTTPS (Hypertext Transfer Protocol Secure)
- 23. Thank you for your attention