what is tls/ssl?
DESCRIPTION
This Document will help You to understand the TLS/SSL on Tnransport LayerTRANSCRIPT
Outline:
Web Security
Executive Summary
Introduction to SSL/TLS
What is TLS/SSL?
Digital Certificates
Authentication and Verification
Services of SSL
The Four Upper Layer Protocols
Record Protocol
Change Cipher Spec Protocol
Alert Protocol
Handshake Protocol
Secure Socket Layer (SSL)
Where, What and How about SSL
Architecture
Transport Layer Security (TLS)
TLS Overview
Public Key Certificates
Implementation & Applications of SSL/TLS
Summary
References
Security:
Web is now widely used by businesses, government firms and individuals.
But Internet & Web space are vulnerable.
Have a variety of threats related to
Integrity: Someone might alter content
Confidentiality: Anyone can see content
Denial of service:
Authentication: Not clear who you are talking with
need added security mechanisms
Executive Summary:
Transport Layer Security or TLS, widely known also as Secure Sockets Layer or SSL, is the most popular application of public key cryptography in the world. It is most famous for securing Web browser sessions, but it has widespread application to other tasks TLS/SSL can be used to provide strong authentication of both parties in a communication session, strong encryption of data in transit between them, and verification of the integrity of that data in transit TLS/SSL can be used to secure a broad range of critical business functions such as Web browsing, server-to-server communications, email client-to-server communications, software updating, database access, virtual private networking and others However, when used improperly, TLS can give the illusion of security where the communications have been compromised It is important to keep certificates up to date and check rigorously for error conditions In many, but not all applications of TLS, the integrity of the process is enhanced by using a certificate issued by an outside trusted
Certificate Authority (CA) This paper will explore how TLS works, best practices for its use, and the various applications in which it can secure business computing.
Introduction:
Secure Sockets Layer (SSL)
Developed by Netscape Corporation
Versions 1, 2, and 3 (released in 1996)
Transport Layer Security (TLS)
Successor of SSL
IETF standards track protocol, based on SSL 3.0
Last updated in RFC 5246 (2008)
Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are cryptographic protocols that provide security for communications over networks such as the Internet.
TLS and SSL encrypt the segments of network connections at the Transport Layer end-to-end.
As the science of business computing, and of computing security in particular, has advanced, the trend has been to find security weaknesses everywhere where complexity and functionality grow, so do the opportunities for abuse of systems by malicious actors.
The solutions to these problems are varied and must be explored individually, but one technology shows up often: TLS or Transport Layer Security, often known by the name of the predecessor technology, SSL or Secure Sockets Layer
TLS is best known as the technology which secures Web browser sessions for banking and other sensitive tasks, but it can be used for much more. Client-server communication with a variety of server types, in addition to Web servers, benefits from use of TLS. Server-to-server communications also need to be secured and can be through TLS. Clients updating applications and other software on their PCs should only do so through a secure connection, which is why such update applications usually use TLS or SSL. This paper will explore these and other applications of TLS that can secure the enterprise in the myriad places in which it can be attacked.
TLS provides 3 basic benefits:
It provides authentication of the communicating parties, either one-way or in both directions
It encrypts the communication session “on the wire”
It ensures the integrity of the data transferred
What is TLS/SSL?
TLS/SSL is a tunneling protocol that works at the transport layer. It provides encryption, authentication and integrity verification of data, and does so by means of digital certificates.
Digital Certificates
A digital certificate is an electronic document which confirms the identity of an entity – which could be a user, a server, a company, a program on a client, just about anything – and associates that entity with a public key. The digital certificate is the entity’s identification to the public key infrastructure. Each party to a TLS secured communication can evaluate the contents of the certificate. The most examined field is the Common Name Each then compares it to what they expect. It is also wise to check the issuer of the certificate. Is the issuer a trusted party? For more on these issuers see Trusted Certificate Authorities,
Users can generate their own digital certificates, called self-signed certificates, with free tools. But such certificates are inherently untrustworthy and the real value of certificates comes when they are issued by a trusted CA. Users can create and run their own CA on their network and sometimes this makes sense, but in many cases it is necessary to use an outside trusted CA which outside parties can also trust Symantec™ is the largest CA.
Authentication and Verification
Public key cryptography allows two parties to authenticate each other. Each party has two keys, which are large numeric values. A message exchanged between the parties is run through a hashing algorithm. A hash function takes a block of data and creates a value from it, known as a
hash or digest Make even a small change in the data and the hash changes significantly. At the same time there is no way to recreate the data from the hash.
The sending party to the communications uses their private key to encrypt the hash value. This encrypted value is called a digital signature. The message and signature are sent to the recipient party. The recipient party uses the sender’s public key to decrypt the signature. They generate a hash of the message using the same algorithm as the sender and compare the values.
If the values are the same then two things are certain: the data has not been tampered with and the sender is who they purport to be. This is because the private key corresponding to the public key in the certificate was used to sign the data, and the private key should only be accessible by the sender named in the certificate.
Neither authentication nor integrity verification are mandatory in TLS You can use it simply so that the bits on the wire are encrypted. But authentication isa core feature, important to most customers.
Services of SSL:
SSL Provides several services on data received from the application layer.
Fragmentation:
First SSL divides the data into blocks of 2^14 bytes or less.
Compression:
Each fragment of data is compressed using one of the lossless compression method negotiated between the client and server. This service is optional.
Message Integrity:
To preserve the integrity of data, SSL uses a keyed Hash function to create a MAC.
Confidentiality:To provide confidentiality, the original data and the MAC are encrypted using symmetric key cryptography
Framing:
A header is added to the encrypted payload. The payload is then passed to a reliable transport protocol.
The Four Upper Layer Protocols
Application Encryption Protocol
Encrypt/Decrypt application data
Change Cipher Spec Protocol
Alert to a change in communication variables
Alert Protocol
Messages important to SSL connections
Handshaking Protocol
Establish communication variables
SSL Record Protocol
Services provided are:
Confidentiality
using symmetric encryption with a shared secret key defined by Handshake Protocol
IDEA, RC2-40, DES-40, DES, 3DES, Fortezza, RC4-40, RC4-128
message is compressed before encryption
Message integrity
using a MAC (Message Authentication Code) created using a shared secret key and a short message
SSL Change Cipher Spec Protocol:
one of 3 SSL specific protocols which use the SSL Record protocol
a single message
Purpose of message
Cause copy of pending state to current state.
Updates cipher suite to be used on the current connection.
SSL Alert Protocol:
conveys SSL-related alerts to peer entity
Consists of two bytes
1st byte : warning or fatal
2nd byte: code for specific alerts
specific alert types
unexpected message, bad record mac, decompression failure, handshake failure, illegal parameter
close notify, no certificate, bad certificate, unsupported certificate, certificate revoked, certificate expired, certificate unknown
compressed & encrypted like all SSL data
SSL Handshake Protocol:
The most complex part of SSL.
allows server & client to:
authenticate each other
to negotiate encryption & MAC algorithms
to negotiate cryptographic keys to be used
comprises a series of messages in phases
Establish Security Capabilities
Server Authentication and Key Exchange
Client Authentication and Key Exchange
Finish
The client(Alice) and server(Bob) must agree on various parameters to establish the connection
Alice request a secure connections and presents a list of Cipher Suites
Bob picks the strongest supported Cipher Suite
Bob sends back his digital certificate
o Including the certificate authority and his public key
By encrypting using the server’s public key, Alice send a random number to Bob securely
Alice and Bob generate key material from the random number
Secure connection established
`
SSL Handshake Protocol:
This protocol allows the server and client to authenticate each other and to negotiate an encryption and MAC algorithm and cryptographic keys to be used to protect data sent in an SSL record.
TLS (Transport Layer Security)
SSL Key Exchange (Simplified)
1. SSL client connects to an SSL server
2. Server then sends its own certificate that contains its public key
3. Client then creates a random key (premaster key) and uses server's public key to encrypt it
4. Client then sends encrypted premaster key to the server
5. Server then decrypts it (only the server that has the matching private key can decrypt it) and uses decrypted premaster key to create secret session key
6. Now both client and server uses secret session key for further communication
Secure Socket Layer (SSL):
Where SSL fits?
SSL runs over TCP:
Confidentiality (Privacy)
Data integrity (Tamper-proofing)
Server authentication (Proving a server is what it claims it is)
– Used in typical B2C transaction
Optional client authentication
– Would be required in B2B (or Web services environment in which program talks to program)
What security is provided?
By providing:
Endpoint Authentication
Unilateral or Bilateral
Communication Confidentiality
For preventing:
Eavesdropping
Tampering
Message Forgery
SSL Architecture:
EncryptionSymmetric-key Cryptography Eavesdropping
Message Digest Cryptographic Hash Tampering
Authentication & Digital signature Public-key Cryptography
Message Forgery
TLS (Transport Layer Security)
TLS uses stronger encryption algorithms and has the ability to work on different ports. Additionally, TLS version 1.0 does not interoperate with SSL version 3.0.
IETF standard RFC 2246 similar to SSLv3
with minor differences
In record format version number
Uses HMAC for MAC
A pseudo-random function expands secrets
Has additional alert codes
Some changes in supported ciphers
Changes in certificate negotiations
Changes in use of padding
Changes from SSL 3.0 to TLS:
TLS is the successor technology to SSL, which was developed by Netscape in 1994. The first public release was SSL version, and was quickly followed by version. The TLS specification was released in 1999 in RFC 2246, and is only a minor modification of SSL 3.
Changes have come at a much slower pace since then, with TLS 1.1 and 1.2 largely concerned with security improvements. TLS is still widely called SSL, especially in product names, even if the term is strictly inaccurate. TLS versions are designed to interact with and roll back to earlier protocols such as SSL 3. In fact, in the protocol handshake, TLS 1.0, 1.1 and 1.2use the version numbers 3.1, 3.2 and 3.3
One of the main differences you’ll see between SSL and TLS versions are the cryptographic features, including the ciphers, hash algorithms and key exchange mechanisms they support. As time and versions advance, support for weaker features is dropped from the protocol and stronger ones added.
Fortezza removed
Additional Alerts added
Modification to hash calculations
Protocol version 3.1 in Client Hello, Server Hello
What is TLS?
Protocol layer
Requires reliable transport layer (e.g. TCP)
Supports any application protocols
TLS: Privacy:
Encrypt message so it cannot be read
Use conventional cryptography with shared key
DES, 3DES
RC2, RC4
IDEA
TLS: Key Exchange:
Need secure method to exchange secret key
Use public key encryption for this
“key pair” is used - either one can encrypt and then the other can decrypt
slower than conventional cryptography
share one key, keep the other private
Choices are RSA or Diffie-Hellman
TLS: Integrity:
Compute fixed-length Message Authentication Code (MAC)
Includes hash of message
Includes a shared secret
Include sequence number
Transmit MAC with message
Receiver creates new MAC
should match transmitted MAC
TLS allows MD5, SHA-1
TLS: Authentication:
Verify identities of participants
Client authentication is optional
Certificate is used to associate identity with public key and other attributes
TLS: Architecture:
TLS defines Record Protocol to transfer application and TLS information
A session is established using a Handshake Protocol
TLS: Record Protocol:
TLS: Handshake:
Negotiate Cipher-Suite Algorithms
Symmetric cipher to use
Key exchange method
Message digest function
Establish and share master secret
Optionally authenticate server and/or client
Handshake Phases:
Hello messages
Certificate and Key Exchange messages
Change Cipher Spec and Finished messages
Implementation of SSL/TLS:
SSL and TLS have been widely implemented
Open source software projects
○ Open SSL, NSS, or Gnu TLS
Microsoft Windows
○ Part of its Secure Channel
Browsers
○ Google Chrome
○ Internet Explorer, etc.
Client Side:
<? Php //-------------------------------------Message Encryption Start .......................//
$plan_text=$_POST['text'];
$befor_cipher=$plan_text;
$strlen=strlen($plan_text)."<br />";
$abc=array("a","b","c","d","e","f","g","h","i","j","k","l","m","n","o","p","q","r","s","t","u","v","w","x","y","z");
$count=0;
$replace=array();
for($count=0; $count<$strlen; $count++)
{
foreach($abc as $key=>$value)
{
if($plan_text[$count]==$value)
{
$replace[$count]=$abc[25-$key];
}
}
}
$cipher_text=implode($replace);
//.................................................... Message Encrption End .......................... //
//........................................ Codding For Connection Start ....................//
$host = "192.168.1.9";
$port = 25003;
//set_time_limit(0);
echo "<h1>Message Sent</h1><br />";
echo "Plan Text : ".$befor_cipher;
echo "<br />Cipher Text : ".$cipher_text;
// create socket
$socket = socket_create(AF_INET, SOCK_STREAM, 0) or die("Could not create socket\n");
// connect to server
$result = socket_connect($socket, $host, $port) or die("Could not connect to server\n");
// send string to server
socket_write($socket, $cipher_text, strlen($cipher_text)) or die("Could not send data to server\n");
// close socket
socket_close($socket);
// ...........................................Codding for connection End.............................//
?>
Server Side:
<?php
//.............................................Codding for SERVER Connection Start.........................//
// set some variables
$host = "192.168.1.9";
$port = 25003;
// don't timeout!
set_time_limit(0);
// create socket
$socket = socket_create(AF_INET, SOCK_STREAM, 0) or die("Could not create socket\n");
// bind socket to port
$result = socket_bind($socket, $host, $port) or die("Could not bind to socket\n");
// start listening for connections
$result = socket_listen($socket, 10) or die("Could not set up socket listener\n");
// accept incoming connections
// spawn another socket to handle communication
$spawn = socket_accept($socket) or die("Could not accept incoming connection\n");
// read client input
$cipher_text = socket_read($spawn, 1024) or die("Could not read cipher_text\n");
echo "<h1>Message Received</h1><br />";
echo "Cipher text :".$cipher_text."<br />";
// close sockets
socket_close($spawn);
socket_close($socket);
//.............................................Codding for SERVER Connection End.........................//
//.................................................Decription Start.........................//
$strlen=strlen($cipher_text)."<br />";
$abc=array("a","b","c","d","e","f","g","h","i","j","k","l","m","n","o","p","q","r","s","t","u","v","w","x","y","z");
$count=0;
$replace=array();
for($count=0; $count<$strlen; $count++)
{
foreach($abc as $key=>$value)
{
if($cipher_text[$count]==$value)
{$replace[$count]=$abc[25-$key];}
}
}
$plan_text=implode($replace);
echo "Plan Text : ".$plan_text;
//...............................................Decription Enc.........................//
?>
Socket Programming in PHP
Introduction
Sockets are used for inter process communication. Inter process communication is generally based on client-server model. In this case, client-server is the applications that interact with each other. Interaction between client and server requires a connection. Socket programming is responsible for establishing that connection between applications to interact.
By the end of this tip, we will learn how to create a simple client-server in PHP. We will also learn how client application sends message to server and receives it from the same.
Using the Code
Aim: Develop a client to send a string message to server and server to return reverse of the same message to client.
PHP SERVER
Step 1: Set variables such as "host" and "port"
$host = "127.0.0.1";$port = 5353;// No Timeout set_time_limit(0);
Port number can be any positive integer between 1024 -65535.
Step 2: Create Socket
$socket = socket_create(AF_INET, SOCK_STREAM, 0) or die("Could not create socket\n");
Step 3: Bind the socket to port and host
Here the created socket resource is bound to IP address and port number.
$result = socket_bind($socket, $host, $port) or die("Could not bind to socket\n");
Step 4: Start listening to the socket
After getting bound with IP and port server waits for the client to connect. Till then it keeps on waiting.
$result = socket_listen($socket, 3) or die("Could not set up socket listener\n");
Step 5: Accept incoming connection
This function accepts incoming connection request on the created socket. After accepting the connection from client socket, this function returns another socket resource that is actually responsible for communication with the corresponding client socket. Here “$spawn” is that socket resource which is responsible for communication with client socket.
$spawn = socket_accept($socket) or die("Could not accept incoming connection\n");
So far, we have prepared our server socket but the script doesn't actually do anything. Keeping to our aforesaid aim, we will read message from client socket and then send back reverse of the received message to the client socket again.
Step 6: Read the message from the Client socket
$input = socket_read($spawn, 1024) or die("Could not read input\n");
Step 7: Reverse the message
$output = strrev($input) . "\n";
Step 8: Send message to the client socket
socket_write($spawn, $output, strlen ($output)) or die("Could not write output\n");
Close the socket
socket_close($spawn);socket_close($socket);
This completes with the server. Now we will learn to create PHP client.
PHP CLIENT
The first two steps are the same as in the server.
Step 1: Set variables such as "host" and "port"
$host = "127.0.0.1";$port = 5353;// No Timeout set_time_limit(0);
Note: Here the port and host should be same as defined in server.
Step 2: Create Socket
$socket = socket_create(AF_INET, SOCK_STREAM, 0) or die("Could not create socket\n");
Step 3: Connect to the server
$result = socket_connect($socket, $host, $port) or die("Could not connect toserver\n");
Here unlike server, client socket is not bound with port and host. Instead it connects to server socket, waiting to accept the connection from client socket. Connection of client socket to server socket is established in this step.
Step 4: Write to server socket
socket_write($socket, $message, strlen($message)) or die("Could not send data to server\n");
In this step, client socket data is sent to the server socket.
Step 5: Read the response from the server
$result = socket_read ($socket, 1024) or die("Could not read server response\n");echo "Reply From Server :".$result;
Step 6: Close the socket
socket_close($socket);
Application of SSL/TLS:
On top of the Transport Layer protocols
Primarily with TCP
Datagram Transport Layer Security(DTLS) for UDP
Encapsulating the application protocols
HTTP (HTTPS)
for securing WWW traffic
FTP (FTPS) SMTP, NNTP, etc.
References:
William Stallings, 5th Edition, “Transport-Level Security”, Chapter 16, Pages : 509-543
www.cse.buffalo.edu/DBGROUP/nachi/ecopres/fengmei
http://www.slideshare.net/leethree/ssl-intro