SSL/TLS protocol operating mechanism

Communication security on the Internet, based on SSL/TLS protocol

First, the role

HTTP communications that do not use SSL/TLS are non-encrypted traffic. All information is transmitted in plaintext, bringing three major risks.

(1) eavesdropping risk (eavesdropping): Third parties can learn the content of the communication.

(2) Tamper risk (tampering): Third parties may modify the content of the communication.

(3) Impersonation risk (pretending): A third party may participate in the communication by impersonating another person.

The SSL/TLS protocol is designed to address these three risks and is expected to achieve:

(1) All information is encrypted and third parties cannot eavesdrop.

(2) has a calibration mechanism, once tampered with, the communication parties will immediately find.

(3) equipped with identity card to prevent identity being impersonating.

The Internet is an open environment, both sides of the communication are unknown identities, which has brought great difficulty to the design of the protocol. Moreover, the Protocol must be able to withstand all the unthinkable attacks, which makes the SSL/TLS protocol extremely complex.

Two. Basic Operating Procedures

The basic idea of the SSL/TLS protocol is to use public key cryptography, that is, the client requests the public key to the server, then encrypts the information with the public key, and the server receives the ciphertext and decrypts it with its private key.

However, there are two problems here.

(1) How to ensure that the public key is not tampered with?

WORKAROUND: Place the public key in the digital certificate. As long as the certificate is trustworthy, the public key is trustworthy.

(2) Public key encryption calculation is too large, how to reduce the elapsed time?

Workaround: Each conversation, the client and server side generates a "conversation key" that encrypts the information. Because the "conversation key" is symmetric encryption, the operation is very fast, and the server public key is used only to encrypt the "conversation key" itself, which reduces the time spent on cryptographic operations.

Therefore, the basic process of the SSL/TLS protocol is this:

(1) The client requests and validates the public key from the server side.

(2) Both parties negotiate to generate a "dialog key".

(3) The two parties use the "dialogue key" for encrypted communication.

The first two steps of the above process, also known as the handshake stage.

Three. Detailed process of the handshake phase

SSL/TLS protocol operating mechanism