Initial knowledge of HTTPS

Initial knowledge of HTTPS

HTTPS is also known as "TLS-based HTTP, SSL-based Http,http security", a secure communication protocol for computer networks that is widely used on the Internet.

That is, HTTPS is a secure version of HTTP, and before we know why HTTPS is secure, we should first know why HTTP is not secure.

Why is HTTP not secure

The information transmitted over the HTTP protocol is clear text. Network packets from the client/browser to the server during this period, need to go through multiple network devices. Our login ID, password and other information can easily be obtained by any of these network devices.

If one of the network devices is controlled by hackers, in addition to obtaining the data we send, we can also falsify the data we send and send it.

This is one of the problems that the HTTP transport faces: A man-in-the-middle attack, in which an attacker on a delivery path can sniff or eavesdrop on the contents of the transmitted data.

HTTPS encryption

HTTPS addresses this issue by using the "encryption" approach.

Using the symmetric encryption Algorithm (AES)

The first thing we think of is symmetric encryption algorithm, if HTTPS is using symmetric encryption algorithm What is the situation?

Symmetric encryption algorithms both encrypt and decrypt keys that need to be used are the same.

If both the client and the server have an identical key, then the client encrypts the data before sending it to the server by using the secret key key, and the data obtained by the middleman cannot be decrypted. After the server uses key decryption, the execution is completed to return the same data encrypted by the key to the client.

The whole process looks fine, but ignores one point, that is, if the secret key key is generated by the server, how do you tell the client? In fact, no matter what the way to tell the client, it is possible to cause the key to leak, once the key leaks, the entire encryption work is meaningless.

So in fact, HTTPS encryption is not used in the symmetric encryption algorithm this way.

Using asymmetric encryption Algorithms (RSA)

HTTPS uses another smart encryption algorithm, an asymmetric encryption algorithm.

An asymmetric encryption algorithm generates two keys (Key1 and Key2). Generally key1 encrypted data, key1 itself can not be decrypted, need to key2 to decrypt; everything key2 encrypted data, Key2 itself can not be decrypted, only key1 can decrypt.

HTTPS implementation

Let's look at how RSA is used in https:

1. The server uses RSA technology to generate a pair of key K1 and K2 before sending the message.
2. Server to the K1 with MINGWENFA to the client, the intermediary may intercept, but no use, K1 encrypted data need K2 to be able to crack, and K2 in the hands of the server.
3. K1 to the client, the client will generate a transfer key key that is then ready for symmetric encryption (AES), and then encrypt the key with the received K1 and pass it to you.
4. After the service side K2 out key with the hand, only the server and the client know the symmetric encryption key.
5. The next message is made using symmetric encryption, which means that asymmetric encryption solves the problem of how to safely pass the key keys.

You might have a problem here, why not encrypt the information directly with asymmetric encryption, but encrypt the AES key?

Because the average time spent on asymmetric encryption and decryption is longer, in order to save time and improve efficiency, we usually just use it to exchange keys instead of transmitting data directly.

HTTPS certificate

We have already solved the problem of message security passing through encryption technology, so is it not foolproof from now on? The answer is certainly not.

Let's imagine if our service side (S) and client (C) will pass through a hacker server, called the H bar, let's see how H can hack out our encryption defenses.

1. s generates a K1, which is sent to C using clear text;
2. H received K1, and did not forward to C, but first generated a key, using K1 encryption sent to S, that is, for S, H disguised as C;
3. At the same time, H generates a new K1, which is sent to c,c using plaintext to tell h the encrypted key, that is, for C, H pretends to be s;
4. In this way, in fact, H becomes a message forwarder between S and C, not only can know the message sent between S and C, but also can forge the message to send;

So it seems that our previous efforts are fall short.

So at this point we need to introduce a very authoritative third party, an organization dedicated to authenticating the legality of the website, which can be called CA (Certificate Authority). Each website provider can request a certificate from a CA that allows them to bring a CA signature when establishing a secure connection. CA security is verified by the operating system or browser.

Your Windows, Mac, Linux, Chrome, Safari, etc. will be installed with a list of CA certificates that they consider safe, and only the websites with which you establish a secure connection have the signatures of those CAs, and the operating system and browser will consider the link to be secure. Otherwise, there may be a man-in-the-middle attack.

Once a CA-issued certificate is used in an illegal way, all certificates previously issued by the CA are considered unsafe, which allows all CAs to be very careful when issuing certificates, so CA certificates are generally trustworthy.

Summarize

The addition of an S (Security) technology behind HTTP is a hybrid of three technologies, symmetric encryption + Asymmetric encryption + CA authentication. Of course, this is basically the basic principle of HTTPS, the actual HTTPS protocol is more complicated than the above description, and any one of the steps, the entire process will not be safe.

This is why the HTTPS protocol upgrade from SSL 1.0 to SSL 3.0, and then TLS 1.0 is now replaced by TLS 1.3, which is behind the details of the optimization, in case there are any mistakes.

The TLS protocol increases the security of the transport layer over the SSL protocol.

Reference links

Where is the "HTTPS" security?

HTTPS Small white Knowledge (i)

Initial knowledge of HTTPS