SSL and TLS Flashcards
Why is web security important?
The web is widely used for a range of purposes.
What type of threats is the web vulnerable to?
- integrity
- confidentiality
- denial of service
- authentication
What does SSL stand for?
Secure Socket Layer
What is SSL?
A standard protocol that provides a range of security services to your application data.
Where does SSL sit in the TCP/IP model?
In-between the application layer and the TCP layer.
What is a basic application example for SSL?
- Client contacts Server
- Client conveys secret info to Server
- Client wants to authenticate the server.
What is the SSL Architecture?
SSL is broken into two parts “layers”:
1. Record Protocol
2. Multiple Protocols (Handshake, Change Cipher Spec, Alert Protocols)
What is the SSL Handshake Protocol?
Allows the server & Client to:
- Authenticate each other
- Negotiation encryption & MAC algorithms
- Negotiate cryptographic keys to be used
What is the SSL Change Cipher Spec Protocol?
Handles and notifies the client if there’s any change in the Cipher Spec.
What is the SSL Alert Protocol?
Handles warnings and errors of web communication.
What is an SSL session?
An association between a client and a server.
What does it mean that SSL sessions are stateful?
The session state includes security algorithms and parameters.
What might a session include?
Multiple secure connections between the same client and server.
What does connections of the same session share?
The session state.
What are sessions used for?
To avoid expensive negotiation of new security parameters for each connection (reconnection).
What is a session state?
Carries the following information:
- Session identifier
- Peer certificate
- Compression method
- Cipher Spec
What is a session identifier?
A random number to identify a session.
What is a Peer certificate?
Authenticates that the server or client is connected to a valid client or server.
What is Cipher Spec?
Used to understand what type of encryption/security algorithm is used to secure communications.
What are the two responsibilities of the SSL Record Protocol Services?
- Message integrity
- Confidentiality
- Compress before encryption
How does SSL Record protocol work?
Split the application data into fragments. For each fragment:
- Compress it
- Append MAC value
- Encrypt fragment
- Append SSL Record Header
What are the phases of the Handshake Protocol?
Phase 1: Negotiation of the session ID, and security algorithms
Phase 2: Server can send it certificate and key exchange message and requests the client certificate
Phase 3: Client sends certificate if request and may send verification messages. Client always sends its key exchange message
Phase 4: Change Cipher Spec and finish handshake
What is the Change Cipher Spec?
Practically a single message that indicates the end of the SSL handshake.
What is TLS?
Transport Layer Security, same principle as SSL but may vary MAC, alert codes, verify message etc.
