SSL/TLS (Secure Sockets layer/transport Layer Security)

# Protocol Overview

Abbreviation	Name	Default port	Security Policy	Describe
HTTP	Hyper text Transfer Protocol (Hypertext Transfer Protocol)	TCP80	The HTTP protocol is plaintext and the transmitted content is sniffed and tampered with.	Application-layer communication protocol between a client browser or another program and a Web server
SSL/TLS	Secure Sockets layer (Secure Socket layers) Transport Layer Security (Transport layer safety)	TCP443	1) Authenticate users and servers to ensure that data is sent to the correct client and server; 2) Encrypt data to prevent the data from being stolen in the middle; 3) Maintain the integrity of the data and ensure that the data is not changed during transmission.	The ssl (Secure Socket Layer) is the main web-based secure transport protocol designed by Netscape Corporation and is widely used on the web. The IETF (www.ietf.org) standardizes SSL, which is RFC2246, and calls it TLS (Transport Layer Security). Technically, the difference between TLS1.0 and SSL3.0 is very small, such as ssl/tls can strengthen some common application layer protocols (such as: FTP, Security for SMTP, POP, Telnet).   SSL and TLS are between the application layer and the TCP layer, and the network connection is encrypted at the transport layer. The application layer data is no longer passed directly to the transport layer, but to the SSL layer, the SSL layer encrypts the data received from the application layer and adds its own SSL header to
HTTPS	HTTP over SSL	TCP443	In fact, a layer of SSL encapsulation is added outside of the original HTTP data. HTTP protocol The original GET, POST and other mechanisms, basically intact.	Can be easily understood as a combination of "HTTP protocol" and "SSL/TLS protocol"

# Symmetric and Asymmetric encryption
encryption---PlainText into ciphertext, decryption---ciphertext into clear text. In both of these processes, a key is required.
symmetric key encryption (shared key) means that both parties share the same single key, which is used for both encryption and decryption. the principle of symmetric encryption algorithm is easy to understand, the communication side with key encryption plaintext, the other party received after the same key to decrypt the plaintext can be obtained. symmetric key encryption is an effective method for encrypting large amounts of data. The most common is des. DES3, RC4 and so on.
  Asymmetric encryption (public key cryptography)Both sides use different keys to encrypt and decrypt plaintext, both sides of the communication must have their own public key and private key. Both the public key and the private key are mathematically related (the principle of prime product factor).

A public key

(public key)-----used to encrypt and verify the signature, is for everyone to use, public communication between the two parties, published in the public repository, can also be published by e-mail, or through the website to provide downloads. The private key (private key) is-----confidential and is only known to be used for decryption and signature;

Both the public key and the private key can be used to encrypt data and decrypt the encrypted data with the corresponding other. In other words , the content encrypted with public key can only be decrypted with the private key, and the content encrypted with the private key can only be decrypted. the public key encrypts the data, and then the private key decrypts the condition known as encrypted decryption, private keys encrypt data, and public key decryption is generally referred to as signature and authentication signature .  The main limitation of asymmetric encryption is the relatively low speed. In practice, public-key algorithms are typically used only at critical times, such as when a symmetric key is exchanged between entities, or when a hash of a message is signed. commonly used asymmetric encryption generally has RSA, DSA, DH and so on. RSA is generally used.   Public key exchange (key exchange)
The communicating parties Exchange public keys with each other. after the public key exchange, the two parties encrypt the data sent with each other's public key and decrypt the received data with their own private key. because the public key and the private key is characterized by, after any one of the encrypted plaintext, can only be solved with the other, so that the maximum degree of security.   validation mechanisms (signing and validating signatures)when a transmits the data to B, it is signed with its own private key, because the private key is only owned by itself, which produces a file that cannot be generated by others, and it forms a digital signature. when B receives data from a and verifies the signature with a's public key, it confirms that the data was sent from a.

The figurative analogy of key negotiation
Suppose a communicates with B, A is the SSL client and B is the SSL server side, and the encrypted message is placed in square brackets [] to highlight the difference between the plaintext messages. The description of the handling action of both parties is enclosed in parentheses ().

A : I want to talk to you safely, I here the symmetric encryption algorithm has DES,RC5, the key exchange algorithm has RSA and DH, Digest algorithm has MD5 and SHA.

B : We use Des-rsa-sha to combine this pair. This is my certificate, with my name and public key, you take it to verify my identity.

(Send the certificate to a).

There is nothing else to say at the moment.

A :(check the name of B on the certificate is correct, and verify the authenticity of B's certificate through the certificate of the CA that is already in hand, if one of the errors, issue a warning and disconnect, this step ensures the authenticity of B's public key)

(generates a secret message that will be treated as the encryption key, the cryptographic initialization vector (IV), and the HMAC key.) This secret message-the protocol, known as per_master_secret-, is encrypted with the public key of B, encapsulated in a message called Clientkeyexchange. Due to the use of B's public key to ensure that third parties cannot eavesdrop)

I generated a secret message, and encrypted with your public key, to you (send Clientkeyexchange to B) Note, below I will use encrypted method to send you a message!

(Process secret messages, generate encryption keys, encrypt initialization vectors, and keys for HMAC)

[I'm done.]

B : (The secret message in Clientkeyexchange is decrypted with its own private key, then the secret message is processed, the encryption key is generated, the initialization vector and the HMAC key are encrypted, and both parties have negotiated a cryptographic method safely)

Note that I will also start to send you a message in an encrypted way!

[I'm done.]

A : [My secret is ...]

B : [Others will not hear ...]

# Reference Information

Overview of the operating mechanism of SSL/TLS protocol
Http://www.ruanyifeng.com/blog/2014/02/ssl_tls.html
Detailed SSL/TLS principle
http://segmentfault.com/a/1190000002554673

Introduction to digital certificates and CA literacyhttp://kb.cnblogs.com/page/194742/

OpenSSL and SSL digital certificate concept Sticker
http://segmentfault.com/a/1190000002568019

Linux cryptographic authentication capabilities and OpenSSL details
http://lanlian.blog.51cto.com/6790106/1281720

# Packet Analysis

WireShark:Https://wiki.wireshark.org/SSL Ssldump:http://ssldump.sourceforge.net/ using Wireshark to observe the SSL/TLS handshake process-bidirectional authentication/One-way authentication http://blog.csdn.net/fw0124/article/details/40983787

Cipher Suite ciphersuite tls_ ECDHE_rsa_with_aes_256_gcm_sha384 "TLS" naturally refers to the TLS protocol. "ECDHE" is the use of elliptic curves with ephemeral keys Diffie-hellman key exchange (that is, to create a new key for each session and not write it down afterwards). "RSA" indicates the security of TLS handshake protection with RSA asymmetric encryption. "AES_128_GCM" is to protect true data exchange with AES asymmetric encryption with 256-bit key in cipher block link mode. "GCM" (Galois/Counter mode). "SHA384" indicates a secure hash algorithm with SHA384 bit

 

#ssl Tools

https://www.trustasia.com/tools/

Http://web.chacuo.net/netsslcsr

SSL/TLS (Secure Sockets layer/transport Layer Security)