"Graphical HTTP" HTTPS security protocol

Related blog: https://www.cnblogs.com/chentianwei/p/9374341.html (speak more clearly, there are pictures)

Disadvantages of HTTPS 7.1http

1. With clear text, the content will be tapped.
2. The identity of the communicating party is not verified, and the disguise is encountered.
3. The message integrity could not be proven and could be tampered with.

7.11 Communication is tapped

There is a risk of eavesdropping at any corner of the Internet.

Packet capture, Sniffer grab bag and sniffer, such as the widely used Wireshark tool.

• Communication encryption: HTTP over SSL is HTTPS. Secure Socket Layer SSLis added.
• Content encryption: Message body for algorithm encryption (not the entire communication line encryption, there is a risk of being cracked)

7.12 not verified, encounter camouflage

Because the HTTP protocol is not authenticated, anyone can send a request, leaving a variety of pitfalls:

• Masquerading server. Unable to determine whether the request was sent to a true target server, the request could be intercepted, and the response was returned using the spoofed server.
• Also, the client may be disguised.
• Unable to determine where the request came from (no certificate)
• Servers are also received for meaningless requests and cannot block massive Dos attacks (denial of service attacks: The server resources are stained with a large amount of request information, resulting in a real request not being processed)

Verifying your identity through certificates issued by a certificate authority is a security guarantee:

7.13 cannot prove the integrity of the message, the intermediary attack

Man-in-the-middle attach man-in-the-middle attack: The attacker would tamper with the request and response, making communication between the server and the client appear to be normal, but is actually already under control.

How to prevent tampering:

Commonly used MD5 and SHA-1, such as hash value verification method, and used to confirm the file digital signature method, still can not fully guarantee security.

(See blog: 6.66 content-md5 header)

MD5 is a hash value generated by a one-way function. itself could still be tampered with. Therefore, you must use HTTPS.

SSL provides authentication and encryption processing, summary functionality .

7.2 HTTP + encryption + authentication + Integrity protection = HTTPS

7.23 Public-key Cryptography Public secret key cipher algorithm

The encryption algorithm is public, but the key is confidential. The password can be decrypted only by means of a secret key.

Both parties use this algorithm to encrypt and decrypt the contents of the communication to ensure the security of the information. But

how to safely pass the key to each other? This is the dilemma of symmetric cryptographic algorithms. (Common key crypto system shared secret key encryption)

Answer: Use the public key encryption algorithm. Also called asymmetric key encryption algorithm .

The public key consists of a private key and any number of public key keys. The party receiving the ciphertext holds the private key, and the party sending the cipher holds the public key. A message encrypted with a public key can only be solved by private key.

Therefore, the server only needs to provide the public key to the client.

HTTPS's hybrid encryption mechanism:

1. Key exchange Link: Client obtains public key, encrypt transmission ' symmetric key ' to server through asymmetric encryption algorithm
2. The Communication Exchange message link: The two sides use the symmetric key encryption method, exchanges the message.

7.24 Certificate proving public key correctness

Client access to the public key can be hacked by hackers, customers get a fake public key, how to do?

Answer: Use a public key certificate issued by a digital certification authority.

Business process for Server operators to request digital certificates:

Application---ID---Make a public key to the application, assign the public key to the signature, and bind the key with the certificate.

1. The server sends the public key and certificate to the client.
2. The client authenticates the digital signature on the certificate with the public key of the digital certificate certification authority.
3. Once verified, the client can safely use the public key of the server.

?? : Most browsers will have public keys for common certification bodies.

The client can also use a digital certificate. In areas of high security: for example, internet banking's online bank login uses a client certificate.

Expansion: The credibility of the certification body first, the certification body has been hacked by the incident occurred.

Secure communication mechanism for 7.25 HTTPS

The cost of HTTPS makes the site not always used

1. Encryption consumes more CPUs, cache
2. Purchasing a certificate is also a cost, a certificate of 600 yuan/year.

SSL causes slow communication, and slow processing. 2-100 times slower than HTTP.

There is a dedicated server for this issue to improve the problem, but this is the cost.

"Graphical HTTP" HTTPS security protocol