CHAPTER 7_Cryptography Flashcards
Emphasis: Replay Attacks
Replay AttacksA big concern in distributed environments is the replay attack, in which an attacker captures some type of data and resubmits it with the hopes of fooling the receiving device into thinking it is legitimate information. Many times, the data captured and resubmitted are authentication information, and the attacker is trying to authenticate herself as someone else to gain unauthorized access.
Bullets: Algebraic attack
Cryptanalysis attack that exploits vulnerabilities within the intrinsic algebraic structure of mathematical functions.
Emphasis: work factor
As explained earlier in this chapter, work factor is the amount of time and resources it would take for someone to break an encryption method. In asymmetric algorithms, the work factor relates to the difference in time and effort that carrying out a one-way function in the easy direction takes compared to carrying out a one-way function in the hard direction. In most cases, the larger the key size, the longer it would take for the bad guy to carry out the one-way function in the hard direction (decrypt a message).
Bullets: Chosen-plaintext attack
Cryptanalysis attack where the attacker can choose arbitrary plaintexts to be encrypted and obtain the corresponding ciphertexts.
Emphasis: The pad must be made up of truly random values
• The pad must be made up of truly random values. This may not seem like a difficult task, but even our computer systems today do not have truly random number generators; rather, they have pseudorandom number generators.
Emphasis: asymmetric algorithms
Cryptography algorithms are either symmetric algorithms, which use symmetric keys (also called secret keys), or asymmetric algorithms, which use asymmetric keys (also called public and private keys). As if encryption were not complicated enough, the terms used to describe the key types only make it worse. Just pay close attention and you will get through this fine.
Emphasis: Trusted Platform Module
Trusted Platform ModuleThe Trusted Platform Module (TPM) is a microchip installed on the motherboard of modern computers and is dedicated to carrying out security functions that involve the storage and processing of symmetric and asymmetric keys, hashes, and digital certificates. The TPM was devised by the Trusted Computing Group (TCG), an organization that promotes open standards to help strengthen computing platforms against security weaknesses and attacks.
Emphasis: block cipher
When a block cipher is used for encryption and decryption purposes, the message is divided into blocks of bits. These blocks are then put through mathematical functions, one block at a time. Suppose you need to encrypt a message you are sending to your mother and you are using a block cipher that uses 64 bits. Your message of 640 bits is chopped up into 10 individual blocks of 64 bits. Each block is put through a succession of mathematical formulas, and what you end up with is 10 blocks of encrypted text. You send this encrypted message to your mother. She has to have the same block cipher and key, and those 10 ciphertext blocks go back through the algorithm in the reverse sequence and end up in your plaintext message.
Bullets: One-time pad
Encryption method created by Gilbert Vernam that is considered impossible to crack if carried out properly
Bullets: Diffie-Hellman algorithm
First asymmetric algorithm created and is used to exchange symmetric key values. Based upon logarithms in finite fields.
Bullets: Acquirer (merchant’s bank)
The financial institution that processes payment cards.
Emphasis: asynchronous
Synchronous cryptosystems use keystreams to encrypt plaintext one bit at a time. The keystream values are “in synch” with the plaintext values. An asynchronous cryptosystem uses previously generated output to encrypt the current plaintext values. So a stream algorithm would be considered synchronous, while a block algorithm using chaining would be considered asynchronous.
Bullets: Cryptology
The study of both cryptography and cryptanalysis
Explanations: El Gamal
El Gamal is a public key algorithm that can be used for digital signatures, encryption, and key exchange. It is based not on the difficulty of factoring large numbers but on calculating discrete logarithms in a finite field. El Gamal is actually an extension of the Diffie-Hellman algorithm.
Bullets: Cookies
Data files used by web browsers and servers to keep browser state information and browsing preferences.
Bullets: Replay attack
Valid data transmission is maliciously or fraudulently repeated to allow an entity gain unauthorized access.
Bullets: One-way hash
Cryptographic process that takes an arbitrary amount of data and generates a fixed-length value. Used for integrity protection.
Bullets: Statistically unpredictable keystream
Bits generated from the keystream generator cannot be predicted.
Emphasis: one-time pad
A one-time pad is a perfect encryption scheme because it is considered unbreakable if implemented properly. It was invented by Gilbert Vernam in 1917, so sometimes it is referred to as the Vernam cipher.
Explanation Bullets: PKI supplies the following security services:
- Confidentiality
- Access control
- Integrity
- Authentication
- Nonrepudiation
Explanations: Types of Asymmetric Systems
As described earlier in the chapter, using purely symmetric key cryptography has three drawbacks, which affect the following:
Emphasis: Pretty Good Privacy (PGP)
Pretty Good Privacy (PGP) was designed by Phil Zimmerman as a freeware e-mail security program and was released in 1991. It was the first widespread public key encryption program. PGP is a complete cryptosystem that uses cryptographic protection to protect e-mail and files. It can use RSA public key encryption for key management and use IDEA symmetric cipher for bulk encryption of data, although the user has the option of picking different types of algorithms for these functions. PGP can provide confidentiality by using the IDEA encryption algorithm, integrity by using the MD5 hashing algorithm, authentication by using the public key certificates, and nonrepudiation by using cryptographically signed messages. PGP uses its own type of digital certificates rather than what is used in PKI, but they both have similar purposes.
Emphasis: Certificates
CertificatesOne of the most important pieces of a PKI is its digital certificate. A certificate is the mechanism used to associate a public key with a collection of components in a manner that is sufficient to uniquely identify the claimed owner. The standard for how the CA creates the certificate is X.509, which dictates the different fields used in the certificate and the valid values that can populate those fields. The most commonly used version is 3 of this standard, which is often denoted as X.509v3. Many cryptographic protocols use this type of certificate, including SSL.
Explanations: Digital Signatures
To do a digital signature, do I sign my name on my monitor screen?Response: Sure.
Bullets: Diffusion
Transposition processes used in encryption functions to increase randomness.
Bullets: MARS
Developed by the IBM team that created Lucifer
Emphasis: The Registration Authority
The Registration AuthorityThe registration authority (RA) performs the certification registration duties. The RA establishes and confirms the identity of an individual, initiates the certification process with a CA on behalf of an end user, and performs certificate life-cycle management functions. The RA cannot issue certificates, but can act as a broker between the user and the CA. When users need new certificates, they make requests to the RA, and the RA verifies all necessary identification information before allowing a request to go to the CA.
Bullets: Stream cipher
Algorithm type that generates a keystream (random values), which is XORd with plaintext for encryption purposes.
Bullets: Public key
Value used in public key cryptography that is used for encryption and signature validation that can be known by all parties.
Explanations: What Does It Mean When an Algorithm Is Broken?
I dropped my algorithm.Response: Well, now it’s broken.
Explanations: Side-Channel Attacks
All of the attacks we have covered thus far have been based mainly on the mathematics of cryptography. Using plaintext and ciphertext involves high-powered mathematical tools that are needed to uncover the key used in the encryption process.
Explanations: Certificate Authorities
How do I know I can trust you?Response: The CA trusts me.
Emphasis: session key
A session key is a single-use symmetric key that is used to encrypt messages between two users during a communication session. A session key is no different from the symmetric key described in the previous section, but it is only good for one communication session between users.
Bullets: CMAC
Cipher message authentication code that is based upon and provides more security compared to CBC-MAC.
Bullets: A keystream not linearly related to the key
If someone figures out the keystream values, that does not mean she now knows the key value.
Explanations: Running and Concealment Ciphers
I have my decoder ring, spyglasses, and secret handshake. Now let me figure out how I will encrypt my messages.
Explanations: PKI Steps
Now that we know some of the main pieces of a PKI and how they actually work together, let’s walk through an example. First, suppose that John needs to obtain a digital certificate for himself so he can participate in a PKI. The following are the steps to do so:
Bullets: El Gamal algorithm
Asymmetric algorithm based upon the Diffie-Hellman algorithm used for digital signatures, encryption, and key exchange.
Explanations: Analytic Attacks
Analytic attacks identify algorithm structural weaknesses or flaws, as opposed to brute force attacks, which simply exhaust all possibilities without respect to the specific properties of the algorithm. Examples include the Double DES attack and RSA factoring attack.
Bullets: Confusion
Substitution processes used in encryption functions to increase randomness.
Emphasis: Initialization Vectors
Initialization VectorsInitialization vectors (IVs) are random values that are used with algorithms to ensure patterns are not created during the encryption process. They are used with keys and do not need to be encrypted when being sent to the destination. If IVs are not used, then two identical plaintext values that are encrypted with the same key will create the same ciphertext. Providing attackers with these types of patterns can make their job easier in breaking the encryption method and uncovering the key. For example, if we have the plaintext value of “See Spot run” two times within our message, we need to make sure that even though there is a pattern in the plaintext message, a pattern in the resulting ciphertext will not be created. So the IV and key are both used by the algorithm to provide more randomness to the encryption process.
Bullets: Rijndael
Developed by Joan Daemen and Vincent Rijmen
Bullets: Cryptography
Science of secret writing that enables an entity to store and transmit data in a form that is available only to the intended individuals
Explanation Bullets: Out of these contestants, Rijndael was chosen. The block sizes that Rijndael supports are 128, 192, and 256 bits. The number of rounds depends upon the size of the block and the key length:
- If both the key and block size are 128 bits, there are 10 rounds.
- If both the key and block size are 192 bits, there are 12 rounds.
- If both the key and block size are 256 bits, there are 14 rounds.
Emphasis: Online Certificate Status Protocol (OCSP)
Online Certificate Status Protocol (OCSP) is being used more and more rather than the cumbersome CRL approach. When using just a CRL, the user’s browser must either check a central CRL to find out if the certification has been revoked or the CA has to continually push out CRL values to the clients to ensure they have an updated CRL. If OCSP is implemented, it does this work automatically in the background. It carries out real-time validation of a certificate and reports back to the user whether the certificate is valid, invalid, or unknown. OCSP checks the CRL that is maintained by the CA. So the CRL is still being used, but now we have a protocol developed specifically to check the CRL during a certificate validation process.
Explanation Bullets: Disadvantages of end-to-end encryption include the following:
- Headers, addresses, and routing information are not encrypted, and therefore not protected.
Explanation Bullets: Advantages of link encryption include the following:
- All data are encrypted, including headers, addresses, and routing information.
- Users do not need to do anything to initiate it. It works at a lower layer in the OSI model.
Emphasis: knapsack
Over the years, different versions of knapsack algorithms have arisen. The first to be developed, Merkle-Hellman, could be used only for encryption, but it was later improved upon to provide digital signature capabilities. These types of algorithms are based on the “knapsack problem,” a mathematical dilemma that poses the following question: If you have several different items, each having its own weight, is it possible to add these items to a knapsack so the knapsack has a specific weight?
Bullets: Issuer (cardholder’s bank)
The financial institution that provides a credit card to the individual.
Emphasis: online encryption
Link encryption, which is sometimes called online encryption, is usually provided by service providers and is incorporated into network protocols. All of the information is encrypted, and the packets must be decrypted at each hop so the router, or other intermediate device, knows where to send the packet next. The router must decrypt the header portion of the packet, read the routing and address information within the header, and then re-encrypt it and send it on its way.
Bullets: Keyspace
A range of possible values used to construct keys
Emphasis: Message Integrity
Message IntegrityParity bits and cyclic redundancy check (CRC) functions have been used in protocols to detect modifications in streams of bits as they are passed from one computer to another, but they can usually detect only unintentional modifications. Unintentional modifications can happen if a spike occurs in the power supply, if there is interference or attenuation on a wire, or if some other type of physical condition happens that causes the corruption of bits as they travel from one destination to another. Parity bits cannot identify whether a message was captured by an intruder, altered, and then sent on to the intended destination. The intruder can just recalculate a new parity value that includes his changes, and the receiver would never know the difference. For this type of protection, hash algorithms are required to successfully detect intentional and unintentional unauthorized modifications to data. We will now dive into hash algorithms and their characteristics.
Bullets: Multipurpose Internet Mail Extension
Standard that outlines the format of e-mail messages and allows binary attachments to be transmitted through email.
Emphasis: The pad must be securely distributed and protected at its destination
• The pad must be securely distributed and protected at its destination. This is a very cumbersome process to accomplish, because the pads are usually just individual pieces of paper that need to be delivered by a secure courier and properly guarded at each destination.
Bullets: Digital Rights Management (DRM)
Access control technologies commonly used to protect copyright material
Bullets: Secure Shell (SSH)
Network protocol that allows for a secure connection to a remote system. Developed to replace Telnet and other insecure remote shell methods.
Bullets: Hybrid cryptography
Combined use of symmetric and asymmetric algorithms where the symmetric key encrypts data and an asymmetric key encrypts the symmetric key.
Bullets: Triple DES
Symmetric cipher that applies DES three times to each block of data during the encryption process.
Emphasis: email Standards
email StandardsLike other types of technologies, cryptography has industry standards and de facto standards. Standards are necessary because they help ensure interoperability among vendor products. Standards usually mean that a certain technology has been under heavy scrutiny and has been properly tested and accepted by many similar technology communities. A company still needs to decide what type of standard to follow and what type of technology to implement.
Explanations: The Diffie-Hellman Algorithm
The first group to address the shortfalls of symmetric key cryptography decided to attack the issue of secure distribution of the symmetric key. Whitfield Diffie and Martin Hellman worked on this problem and ended up developing the first asymmetric key agreement algorithm, called, naturally, Diffie-Hellman.
Explanations: Cryptosystems
A cryptosystem encompasses all of the necessary components for encryption and decryption to take place. Pretty Good Privacy (PGP) is just one example of a cryptosystem. A cryptosystem is made up of at least the following:
Bullets: Authorization
Upon proving identity, the individual is then provided with the key or password that will allow access to some resource.
Explanations: Hardware vs. Software Cryptography Systems
Encryption can be done through software or hardware, and there are trade-offs with each. Generally, software is less expensive and provides a slower throughput than hardware mechanisms. Software cryptography methods can be more easily modified and disabled compared to hardware systems, but it depends on the application and the hardware product.
Emphasis: Wireless Security Woes
Wireless Security WoesWe covered the different 802.11 standards and the Wired Equivalent Privacy (WEP) protocol in Chapter 6. Among the long laundry list of security problems with WEP, not using unique session keys for data encryption is one of them. If only WEP is being used to encrypt wireless traffic, then in most implementations, just one static symmetric key is being used over and over again to encrypt the packets. This is one of the changes and advancements in the 802.11i standard, which makes sure each packet is encrypted with a unique session key.
Explanations: Triple-DES
We went from DES to Triple-DES (3DES), so it might seem we skipped Double-DES. We did. Double-DES has a key length of 112 bits, but there is a specific attack against Double-DES that reduces its work factor to about the same as DES. Thus, it is no more secure than DES. So let’s move on to 3DES.
Explanations: Cryptography Notation
In some resources, you may run across rc5-w/r/b or RC5-32/12/16. This is a type of shorthand that describes the configuration of the algorithm:
Bullets: Caesar cipher
Simple substitution algorithm created by Julius Caesar that shifts alphabetic values three positions during its encryption and decryption processes
Emphasis: Diffie-Hellman
To understand how Diffie-Hellman works, consider an example. Let’s say that Tanya and Erika would like to communicate over an encrypted channel by using Diffie-Hellman. They would both generate a private and public key pair and exchange public keys. Tanya’s software would take her private key (which is just a numeric value) and Erika’s public key (another numeric value) and put them through the Diffie-Hellman algorithm. Erika’s software would take her private key and Tanya’s public key and insert them into the Diffie-Hellman algorithm on her computer. Through this process, Tanya and Erika derive the same shared value, which is used to create instances of symmetric keys.
Bullets: Avalanche effect
Algorithm design requirement so that slight changes to the input result in drastic changes to the output.
Explanation Bullets: Some important characteristics of ECB mode encryption are as follows:
- Operations can be run in parallel, which decreases processing time.
- Errors are contained. If an error takes place during the encryption process, it only affects one block of data.
- Only usable for the encryption of short messages.
- Cannot carry out preprocessing functions before receiving plaintext.
Explanations: Session Keys
Hey, I have a disposable key!Response: Amazing. Now go away.
Bullets: Transport mode
Mode that IPSec protocols can work in that provides protection for packet data payload.
Explanations: Block and Stream Ciphers
Which should I use, the stream cipher or the block cipher?Response: The stream cipher, because it makes you look skinnier.
Emphasis: Response: The stream cipher, because it makes you look skinnier
Which should I use, the stream cipher or the block cipher?Response: The stream cipher, because it makes you look skinnier.
Bullets: Digital envelope
Message is encrypted with a symmetric key and the symmetric key is encrypted with an asymmetric key. Collectively this is called a digital envelope.
Bullets: Data Encryption Algorithm
Algorithm chosen to fulfill the Data Encryption Standard. Block symmetric cipher that uses a 56-bit true key size, 64-bit block size, and 16 rounds of computation.
Bullets: Encipher
Act of transforming data into an unreadable format
Bullets: Running key cipher
Substitution cipher that creates keystream values, commonly from agreed-upon text passages, to be used for encryption purposes
Bullets: Expansion
Expanding the plaintext by duplicating values. Commonly used to increase the plaintext size to map to key sizes.
Bullets: End-to-end encryption
Encryption method used by the sender of data that encrypts individual messages and not full packets.
Bullets: Plaintext
Data in readable format, also referred to as cleartext
Emphasis: Key Derivation Functions
Key Derivation FunctionsFor complex keys to be generated, a master key is commonly created, and then symmetric keys are generated from it. For example, if an application is responsible for creating a session key for each subject that requests one, it should not be giving out the same instance of that one key. Different subjects need to have different symmetric keys to ensure that the window for the bad guy to capture and uncover that key is smaller than if the same key were to be used over and over again. When two or more keys are created from a master key, they are called subkeys.
Bullets: Key
Sequence of bits that are used as instructions that govern the acts of cryptographic functions within an algorithm
Explanations: Hashes, HMACs, CBC-MACs, CMACs—Oh My!
MACs and hashing processes can be confusing. The following table simplifies the differences between them.
Bullets: Out-of-band method
Sending data through an alternate communication channel.
Emphasis: Internet Protocol Security (IPSec)
The Internet Protocol Security (IPSec) protocol suite provides a method of setting up a secure channel for protected data exchange between two devices. The devices that share this secure channel can be two servers, two routers, a workstation and a server, or two gateways between different networks. IPSec is a widely accepted standard for providing network layer protection. It can be more flexible and less expensive than end-to-end and link encryption methods.
Emphasis: Social Engineering Attacks
Social Engineering AttacksAttackers can trick people into providing their cryptographic key material through various social engineering attack types. Social engineering attacks have been covered in earlier chapters. They are nontechnical attacks that are carried out on people with the goal of tricking them into divulging some type of sensitive information that can be used by the attacker. The attacker may convince the victim that he is a security administrator that requires the cryptographic data for some type of operational effort. The attacker could then use the data to decrypt and gain access to sensitive data. The attacks can be carried out through persuasion, coercion (rubber-hose cryptanalysis), or bribery (purchase-key attack).
Emphasis: Secure Electronic Transaction (SET)
Secure Electronic Transaction (SET) is a security technology proposed by Visa and MasterCard to allow for more secure credit card transaction possibilities than what is currently available. SET has been waiting in the wings for full implementation and acceptance as a standard for quite some time. Although SET provides an effective way of transmitting credit card information, businesses and users do not see it as efficient because it requires more parties to coordinate their efforts, more software installation and configuration for each entity involved, and more effort and cost than the widely used SSL method.
Bullets: RSA algorithm
De facto asymmetric algorithm used for encryption, digital signatures, and key exchange. Based upon the difficulty of factoring large numbers into their original prime numbers.
Bullets: Initialization vectors (IVs)
Values that are used with algorithms to increase randomness for cryptographic functions.
Explanations: Why Can’t We Call an Apple an Apple?
The idea of a hashing function is simple. You run a message through a hashing algorithm, which in turn generates a hashing value. It must have been too simple, because someone threw in a lot of terms to make it more confusing:
Explanations: Known-Plaintext Attacks
In known-plaintext attacks, the attacker has the plaintext and corresponding ciphertext of one or more messages. Again, the goal is to discover the key used to encrypt the messages so other messages can be deciphered and read.
Emphasis: Secure Shell
Secure ShellSecure Shell (SSH) functions as a type of tunneling mechanism that provides terminal-like access to remote computers. SSH is a program and a protocol that can be used to log into another computer over a network. For example, the program can let Paul, who is on computer A, access computer B’s files, run applications on computer B, and retrieve files from computer B without ever physically touching that computer. SSH provides authentication and secure transmission over vulnerable channels like the Internet.
Bullets: Persistent memory
There are two kinds of keys present in the static memory: Endorsement Key (EK) and Storage Root Key (SRK):
Bullets: Digital signature
Ensuring the authenticity and integrity of a message through the use of hashing algorithms and asymmetric algorithms. The message digest is encrypted with the sender’s private key.
Emphasis: security association (SA)
Each device will have at least one security association (SA) for each secure connection it uses. The SA, which is critical to the IPSec architecture, is a record of the configurations the device needs to support an IPSec connection. When two devices complete their handshaking process, which means they have agreed upon a long list of parameters they will use to communicate, these data must be recorded and stored somewhere, which is in the SA. The SA can contain the authentication and encryption keys, the agreed-upon algorithms, the key lifetime, and the source IP address. When a device receives a packet via the IPSec protocol, it is the SA that tells the device what to do with the packet. So if device B receives a packet from device C via IPSec, device B will look to the corresponding SA to tell it how to decrypt the packet, how to properly authenticate the source of the packet, which key to use, and how to reply to the message if necessary.
Emphasis: The pad must be as long as the message
• The pad must be as long as the message. If it is not as long as the message, the pad will need to be reused to cover the whole message. This would be the same thing as using a pad more than one time, which could introduce patterns.
Bullets: Key clustering
Instance when two different keys generate the same ciphertext from the same plaintext
Bullets: Cryptanalysis
Practice of uncovering flaws within cryptosystems
Bullets: DES-EDE3
Uses three different keys for encryption, and the data are encrypted, decrypted, encrypted.
Emphasis: Triple-DES (3DES)
We went from DES to Triple-DES (3DES), so it might seem we skipped Double-DES. We did. Double-DES has a key length of 112 bits, but there is a specific attack against Double-DES that reduces its work factor to about the same as DES. Thus, it is no more secure than DES. So let’s move on to 3DES.
Bullets: Statistical attack
Cryptanalysis attack that uses identified statistical patterns.
Bullets: Steganography
Method of hiding data in another media type with the goal of secrecy
Explanation Bullets: Advantages of end-to-end encryption include the following:
- It provides more flexibility to the user in choosing what gets encrypted and how.
- Higher granularity of functionality is available because each application or user can choose specific configurations.
- Each hop device on the network does not need to have a key to decrypt each packet.
Emphasis: one-way function
A one-way function is a mathematical function that is easier to compute in one direction than in the opposite direction. An analogy of this is when you drop a glass on the floor. Although dropping a glass on the floor is easy, putting all the pieces back together again to reconstruct the original glass is next to impossible. This concept is similar to how a one-way function is used in cryptography, which is what the RSA algorithm, and all other asymmetric algorithms, are based upon.
Bullets: Padding
Adding material to plaintext data before it is encrypted.
Bullets: Session keys
Symmetric keys that have a short lifespan, thus providing more protection than static keys with longer lifespans.
Bullets: Substitution cipher
Encryption method that uses an algorithm that changes out (substitutes) one value for another value
Bullets: Scytale cipher
Ancient encryption tool that used a type of paper and rod used by Greek military factions
Emphasis: Methods of Encryption
Methods of EncryptionAlthough there can be several pieces to an encryption process, the two main pieces are the algorithms and the keys. As stated earlier, algorithms used in computer systems are complex mathematical formulas that dictate the rules of how the plaintext will be turned into ciphertext. A key is a string of random bits that will be used by the algorithm to add to the randomness of the encryption process. For two entities to be able to communicate via encryption, they must use the same algorithm and, many times, the same key. In some encryption technologies, the receiver and the sender use the same key, and in other encryption technologies, they must use different but related keys for encryption and decryption purposes. The following sections explain the differences between these two types of encryption methods.
Emphasis: International Data Encryption Algorithm (IDEA)
International Data Encryption Algorithm (IDEA) is a block cipher and operates on 64-bit blocks of data. The 64-bit data block is divided into 16 smaller blocks, and each has eight rounds of mathematical functions performed on it. The key is 128 bits long, and IDEA is faster than DES when implemented in software.
Emphasis: HTTP Secure
HTTP SecureHTTP Secure (HTTPS) is HTTP running over SSL. (HTTP works at the application layer, and SSL works at the transport layer.) Secure Sockets Layer (SSL) uses public key encryption and provides data encryption, server authentication, message integrity, and optional client authentication. When a client accesses a web site, that web site may have both secured and public portions. The secured portion would require the user to be authenticated in some fashion. When the client goes from a public page on the web site to a secured page, the web server will start the necessary tasks to invoke SSL and protect this type of communication.
