httpS and SSL/TLS handshake

What is HTTPS?

HTTPS stands for "Hypertext Transfer Protocol Secure". This is an extension of Hypertext Transfer Protocol (HTTP) for secure communication over a computer network. In HTTPS, the communication protocol is encrypted using Transport Layer Security (TLS) or Secure Socket Layer (SSL).
Here servers and clients are still using HTTP to communicate with each other, but over a secure SSL connection that encrypts and decrypts the client-server requests and responses. 
SSL ensures that all the requests and responses are directed to the legitimate destination and from a legitimate source, and also it ensures that only a legitimate server or a client can view the content of a request/response.
Eavesdroppers will monitor the traffic, but they will not be able to read the content in the traffic since its encrypted.

How SSL Works? 

A Secure Socket Layer connection between client and server initiate with a "handshake". The goal is to satisfy the client about the server, to have an agreement on a "cipher suite" which has the encryption algorithm that both the parties are going to use in future communication, and the key agreement for this algorithm. 
Once the connection is established, both parties can use the agreed algorithm and keys to securely communicate with each other.

SSL/TLS Handshake

  1. First, "The Client Hello". Here, the client sends the cipher suites and client-compatible SSL/TLS versions.

  2. Server responds with the server-compatible cipher suite from the list of cipher suites that came from the client, and also the SSL/TLS version that both the client and server are compatible to use. Also, server will send the session ID for the particular session and the server certificate which contain the server's "Public Key". So now, the server and the client both agreed on a cipher suite and a SSL/TLS version. Cipher suite is a set of algorithms. The set of algorithms that cipher suites usually contain includes,
        1. A key exchanging algorithm.
        2. A bulk encryption algorithm.
        3. A message authentication code (MAC) algorithm.  

  3. Client validate and verify the server certificate and extract the public key. At the same time, client generates a random seed (a random string).

  4. Client encrypt the previously created random seed using the server's public key, and send it back to the server. 

  5. Server decrypt the message from server's private key and gets the random seed generated by the client.

  6. Now finally since both the parties have the random seed, using it as the input for an algorithm, they generate a symmetric key for message encryption. This key is called as the "shared secret key". Normally for this "Diffie-Hellman" key exchange algorithm will used. 😊  


**Below is a simple diagram to make your life easy 😂**   


   

Comments

Post a Comment

Popular posts from this blog

RMI (intro)

Image
What is RMI?  RMI stands for Remote Method Invocation. It is an application programming interface (API) that allows an object running on one Java Virtual  Machine (JVM) to invoke methods on an object running on another Java Virtual Machine (JVM), client server architecture is a good example where RMI is used. Basically, RMI provides for communication between programs written in the Java programming language. Architecture  In an RMI application there are two programs, a server side program and a client side program. Inside the server side program, a remote object is created and reference of that object is made available for clients. The client side program requests the remote object from the server to invoke its methods.  (A diagram to represent RMI architecture) Stub & Skeleton? Stub is a representation the remote object in the client and its acts as a gateway for the client program. Skeleton is the object that in the server-side. stub communicates with
Read more

Let's Configure HTTP'Secure' in Apache-Tomcat

Image
What is HTTPS?.. if you don't have any idea about what is HTTPS, refer my previous blog post about HTTPS . If you have an idea about HTTPS and SSL/TLS handshake, you are good to go 😊  Creating a digital  certificate We can create a digital certificate using "Java KeyStore (JKS)". This is a repository of security certificates. We can generate a keystore file using keytool command. in order to work with keytool, you must have "JAVA" installed in your computer.  keytool is a key and certificate management utility that allows users to administrate their own public/private key pairs, and the keystore file we are going to generate bellow will also be our local tomcat server's server certificate.   Options  When creating a "keystore", we need to provide some options and values to it. -genkey/-genkeypair -alias  -keyalg  -keystore  -keysize -validity -sigalg -storepass -keypass -dname  -genkey/-genkeypair -genkey
Read more

Mitigate CSRF with Double Submit Cookies

Image
I previously explained what is CSRF  and how we can mitigate a CSRF attack using Synchronizer token pattern technique. In this blog post I'm going to talk about another CSRF mitigation technique called "Double Submit Cookies Pattern"  😉 What is Double Submit Cookies Pattern? This is a technique, that sends a random seed or a "token" as we call it, in both a cookie and as a request parameter, with the server verifying if the cookie value and the request value match. Why DSCP? Now its obvious that a third party entity cannot perform a CSRF attack without the CSRF token, and in here attacker or the third party entity cannot get the token because its in a cookie, and third party web pages cannot retrieve cookies from another web page that has a different domain. For example, assume that the genuine web page is banker.com, and the attacker's web page is attacker.com, when a user logged in to the banker.com, and accidentally redirect to attacker
Read more