What is SSL ?
- SSL ⇒ Secure Socket Layer
- SSL is designed to provide security and compression services to data generated from the application layer
- So, SSL provide security to the data that is transferred between web browser and server
- SSL encrypt the link between a web server and a browser which ensures that all data passed between them remain private and free from attack.
Secure Socket Layer Protocols:
- SSL record protocol
- Handshake protocol
- Change-cipher spec protocol
- Alert protocol
Some Keypoints on SSL ⇒
- The internet and web has become widely popular today. However, it is vulnerable to serious attacks.
- For this purpose, various security approaches are possible.
- These approaches are mainly dependent on which network layer they operate on
- The SSL (Secure Socket Layer) is a whole new layer of protocol which operates above the Internet TCP protocol and below high-level application protocols
- There are different protocols which are associated with SSL which are used in the management of SSL exchanges.
- One among those is SSL handshake protocol.
SSL Handshake Protocol
- It is one the most complex protocols of SSL.
- It allows client and server to:
- Authenticate each other
- To negotiate encryption & MAC algorithm.
- To negotiate cryptographic keys to be used.
- The Handshake Protocol is used before any application data is transmitted.
- The handshake protocol is made up of a series of messages exchanged between both parties (server & client) which is of the format
- These messages are communicated as a series of messages in phases (4 phases)
- The reason it's called handshake because it's between two partied - client and server come across each other for the first time
- The handshake involves a number of steps that start from validating the identity of the other party and concludes with the generation of a common key – secret key if you may call it.
- So, the SSL handshake is nothing but a conversation between two parties (client and server) wanting to accomplish the same purpose – securing the communication with the help of symmetric encryption.
Imagine this SSL Handshake Process as a dialog between the two.
Let’s see how it goes.
Client: “Hello there. I want to establish secure communication between the two of us. Here are my cipher suits and compatible SSL/TLS version.”
Server: “Hello Client. I have checked your cipher suits and SSL/TLS version. I think we’re good to go ahead. Here are my certificate file and my public key. Check ‘em out.”
Client: “Let me verify your certificate. (After a while) Okay, it seems fine, but I need to verify your private key. What I’ll do is, I will generate and encrypt a pre-master (shared secret key) key using your public key. Decrypt it using your private key and we’ll use thing master key to encrypt and decrypt the information”
Server: “Done.”
[Now that both the parties know who they’re talking to, the information transferred between them will be secured using the master-key. Keep in mind that once the verification part is over, the encryption takes place through the master-key only. This is symmetric encryption.]
Client: “I’m sending you this sample message to verify that our master-key works. Send me the decrypted version of this message. If it works, our data is in safe hands.”
Server: “Yeah, it works. I think we’ve accomplished what we were looking for.”
