SSL - Secure Sockets Layer
 | Developed by
Netscape
(a very good article on SSL can be found here). |
| Currently, SSL is in version 3.0. |
| It is a client/server security scheme, it runs in transport layer (OSI) between HTTP and
TCP/IP). |
| SSL handles the encryption automatically as part of the data transmission
process. |
| Because SSL runs in the transport layer it can be used to support e-mail,
FTP, and other services. |
| It works as follows:
- Client issues CLIENT-HELLO message that includes a list of ciphers
supported by the client.
- The server responds with SERVER-HELLO with a list of ciphers and a digital
certificate (including the servers public key).
- The client may or may not validate the certificate (typically the
certificates are pre-loaded on the client).
- A session specific symmetric secret key is established based
on random numbers generated by the client and verified by the server..
- The encrypted session is run (data is exchanged) between the client and
server.
- When the session is over the secret key is discarded.
|
SSL Features
| Separate algorithms for encryption, authentication, and data integrity
with separate keys. |
| Efficiency is improved by encrypting the "connection" that moves
the data. |
| Certificate-based authentication is enabled between the client and server. |
| Not dependent on a specific protocol; although designed for TCP/IP, it can
run on X.25, OSI. It cannot run on IP UDP |
| Is noticeably slower due to encryption/decryption process. |
TLS - Transport Layer Security
| Formalizes the SSL protocol. |
| RFC
2246 |
| From RFC 2246:
 | The primary goal of the TLS Protocol is to provide privacy and data
integrity between two communicating applications. |
| The protocol is composed of two layers:
- TLS Record Protocol - used for encapsulation of various higher
level protocols.
- TLS Handshake Protocol - allows the server and client to
authenticate each other and to negotiate an encryption
algorithm and cryptographic keys before the application protocol transmits
or receives its first byte of data.
|
| At the lowest level, layered on top of some
reliable transport protocol (e.g., TCP/IP]), is the TLS Record
Protocol. |
| The TLS Record Protocol provides connection security that has two
basic properties:
- The connection is private. Symmetric cryptography is used for data
encryption (e.g., DES [DES], RC4 [RC4], etc.) The keys for this
symmetric encryption are generated uniquely for each connection and
are based on a secret negotiated by another protocol (such as the
TLS Handshake Protocol). The Record Protocol can also be used
without encryption.
- The connection is reliable. Message transport includes a message
integrity check using a keyed MAC. Secure hash functions (e.g., SHA,
MD5, etc.) are used for MAC computations. The Record Protocol can
operate without a MAC, but is generally only used in Dierks &
Allen Standards Track this mode while another protocol is using the
Record Protocol as a transport for negotiating security parameters.
|
|
|