SSL

Question 1

SSL accomplishes two things

Answer 1

Trust and Encryption

Trust - Users have an expectation when using an application

Question 2

The Reality of Security

Answer 2

• Wireless networks are open to listening
• Network services can be hijacked, or replaced
• Man-in-the-middle attacks are easy.
• SSL vulnerabilites are infamous

Question 3

What does SSL accomplish?

Answer 3

• Trust
  
  • SSL proves that server is who they claim to be
• Encryption
  
  • SSL scrambles data between a server and its users

Question 4

Encryption

Answer 4

Encryption - is just converting something that you can see into something that you can’t see and then being able to convert it back again.

• Encryption converts something to code
• It can secure important data in transit

Question 5

SSL

Answer 5

When we are talking about SSL, we’re talking about securing important data acroos a network so that means that that’s doing that in transit.

So we do that in a couple of different ways in SSL.

Symmetric Key Encryption

Public Key Encryption (asymmetric key cryptography)

Question 6

Symmetric Key Encryption

Answer 6

is the creation of ONE complicated key that could be used to scramble something. You only use that one key to encode and decode information. Both the receiver and the sender have that one key for encryption and decryption.

Question 7

Public Key Cryptography

(Asymmetric Key Cryptography)

Answer 7

Uses TWO different keys. You have a private key that is always kept in a secure location. It’s never let out of the server that it operates on. And we create a public key that is mathematically linked to the private key. The public key is not identical to the private key. They are different. But because they’re mathematically keyed to one another, when someone gets a hold of the public key which is freely available across the network. All that person has to do is take their content, encode it with the public key, send it to the server and then because the private key is mathematically linked to the public key, it is able to decrypt what was encoded with the public key.

Question 8

Symmetric Keys

Answer 8

• Symmetric keys are identical at both ends
• Symmetric keys need to be secured
• Symmetric keys can be inconvenient to distribute

Question 9

Asymmetric Keys

Answer 9

• Asymmetic keys are different at each end
• The private key must be secured
• The public key can be freely distributed
• Only the private key can decrypt public-key encodings

Question 10

Public and Private SSL

Question 11

SSL vs TLS vs OpenSSL

Security Standards to encrypt data going accorss a network

Answer 11

SSL is Secured Socket Layer and is a security standard invented in the mid-90’s to secure web traffic for Netscape.

TLS is Transport Layer Security and came after SSL, based upon its success in the late 90’s. Both of them secure network communications with encryption.

OppenSSL was developed as an open source standard that uses SSL and TLS to protect both operating system and programs.

Question 12

Vunerabilities

Answer 12

HeartBleed

Timing

Denial of Service

OCSP interception

CSS injection