Secure Socket Layer (SSL)

SSL is a #Security Service developed by Netscape to provide Transport Layer# security for web servers and clients. It could be implemented as part of the underlying Protocol Suite or embedded in specific packages such as browsers and web servers.

An association between client and server called SSL session will be established by SSL Handshake Protocol, which could be shared among multiple SSL connection that are transient, #p2p, communications links. Each SSL connection is private (encrypted with Symmetric Cryptographic algorithms#) and reliable (message integrity check by Message Authentication Code (MAC)# using SHA, MD5 etc. hash functions on compressed SSL data), and for each web component (provide suitable services). The session could define a set of Cryptographic parameters such as keys and algorithms used which could be shared by multiple connections. The session is kept alive by SSL Alert Protocol, where the peer’s identity can be authenticated with Asymmetric Cryptographic Scheme#. SSL Change Cipher Spec Protocol would be used if the peer wants the consequent messages to be encrypted for transmission. With SSL session, there is no need to exchange security parameters for each SSL connection which could be expensive.

The main security services, that is guarantee message integrity# and Confidentiality#, are provided by SSL Record Protocol. The former is done via MAC with shared secret key used for encryption, the latter with Handshake protocol. The operations are done as shown below:

  • Splitting application data into multiple fragments.
  • Compressing each fragment.
  • Appending a MAC to each fragment’s end.
  • Encryption of the fragment.
  • Appending SSL Record Header to each fragment’s head.

It is preceded by Transport Layer Security (TLS)#.

Links to this page
  • Transport Layer Security (TLS)

    TLS is an upgrade over #Secure Socket Layer (SSL) version 3 (SSLv3) defined in RFC 5246. It has now been widely adopted as it is more secure and efficient than its predecessor in message authentication, key material generation and supported cipher suites. It uses the same record format and MAC# generation algorithm, HMAC, as SSLv3. That being said, the algorithm XORs the padding bytes with the secret key padded to the block length instead of concatenated with the secret key as in SSLv3. Furthermore, the MAC calculation also including the field TLSCompressed.version which defined the protocol version being used.

  • TNS3131 Chapter 7: Web Security
  • RC4

    RC4 is a simple and fast, byte-oriented #Stream Cipher, designed by Ron Rivest and owned by RSA DSI, which accepts variable key size. It is widely adopted such as in #SSL/TSL and Wireless WEP. The key forms random permutation of all 8-bit values and use that to collect input information processed a byte at a time. It has been proved to be insecure and easily breakable recently.

#networking #security #p2p #)