Topic: Implementation of SSL & TLS for Application servers 03/19/08
Internet - network for everyone.
Everyone and everything open.
Highly insecure Internet
Thus, Netscape Corporation -protocol SSL.
For secure Transactions.
SSL – Secured Socket Layer
Protocol for data encryption .
Open & nonproprietary protocol .
Enhance and ensure transactional data
Securing transactions on the Web using Apache-SSL.
Securing user access for remote access
Securing e-mail services (IMAP, POP3)
Transport Layer Security(TLS)
Provides security at transport layer.
Non –proprietory version of SSL.
Allows two parties to exchange messages in secure environment.
Position of TLS: 03/19/08
TLS requirements :
* entity authentication protocol
*message authentication protocol
Each party uses a predefined function to create session keys.
Digest calculated & appended to each message .
Message & digest are encrypted using encryption /decryption protocols.
Each party extracts necessary keys and parameters for message authentication & encryption/decryption .
* In Greek means “secret writing.” *Refers to the science and art of transforming messages to make them secure and immune to attacks. Types of Cryptography: Symmetric-Key Cryptography Asymmetric-Key Cryptography
Use two keys – public & private key.
keys -completely independent .
a private key cannot be deduced from a public one.
sign a message using public key, only the holder of the private key can read it.
public key is open.
Private key is secret.
03/19/08 Asymmetric Encryption/Decryption
Simulate the security properties of a handwritten signature
Two algorithms- 1. for signing which involves the user' private key ,
2. for verifying signatures which involves the user's public key .
TCP/IP Protocol Suite Hash function
TCP/IP Protocol Suite Sender site
Your public key:
Your name & e-mail address:
Expiration date of the public key:
Name of the company:
Serial number of the Digital ID
03/19/08 Bob’s private key Bob’s public key Anyone can get Bob's Public Key, but Bob keeps his Private Key to himself Bob’s Co-workers Pat Doug Susan
03/19/08 "Hey Bob, how about lunch at Taco Bell. I hear they have free refills!" HNFmsEm6UnBejhhyCGKOKJUxhiygSBCEiC0QYIh/Hn3xgiK BcyLK1UcYiY lxx2lCFHDC/A