[skill][https][ssl/tls] HTTPS相關知識匯總

標籤：服務   hand   轉寄   串列   item   ide   簡單   計算   rest   

結論前置：

　　A 身分識別驗證

　　　　認證， 伺服器憑證

　　B 密鑰協商

　　　　RSA   DHE / ECDHE   PSK

　　C 加密通訊

加密通訊採用對稱式加密，使用B階段協商出來的密鑰。

B 階段如果使用 RSA 協商，可以用伺服器憑證在協商過程中解密到 C過程中的密鑰。從而解密通訊內容。（此方式下，採用旁路方式就可以）。

B 階段如果使用DHE/ECDHE協商，至少需要建立連結時的server魔數（也許還需要私密金鑰即伺服器憑證）才能計算出加密金鑰。簡單來說協商過程也是一次一密。

於是，應該有兩種情況可以解密https。

情況一：與server 通訊，即時獲得兩個資訊：1，session 資訊。2，server魔數。 這種情況下，只需要旁路就可以了。

情況二：串列在網路中，做中間人。需要伺服器憑證做認證與簽名，流程我暫時還沒搞清楚。然後，需要與兩端握手並協商密鑰，然後做兩端加解密，並內容轉寄。

 

引用一段有用的內容[1] 

A WAF applies filter rules on traffic at an "application" level (e.g. it tries to detect SQL injection attempts). This requires that the WAF sees the traffic, i.e. whatever SSL which may have happened on the client side must stop at the WAF. But you usually want some SSL to protect the traffic between the client and the WAF (in fact, you usually want it more on that link than between the WAF and the server itself, since WAF and server are usually nearby to each other).There are two ways for a WAF to see SSL-protected traffic:The WAF has a copy of the private key used by the (SSL-aware) server, and thus can decrypt the data as it flows. (This can imply some restrictions on the cipher suites used by the server; namely, no DHE).The WAF itself runs a SSL server, and that is the one which the client sees. The WAF decrypt the data, runs its magic on it, and then forwards it to the server over a new connection which may or may not be SSL-protected.Which one you use depends on what your WAF instance can do and how you configured it.

 

 

概念：

http://www.guokr.com/post/114121/

http://www.guokr.com/post/116169/

http://www.guokr.com/post/148613/

 

https://en.wikipedia.org/wiki/HTTPS

 

雙向認證，單項認證：

http://www.jianshu.com/p/0a7b028e2465

http://edison0663.iteye.com/blog/996526

 

瀏覽器安全控制項：

最主要的功能就是防止用戶端作業系統木馬程式截取使用者關鍵資訊的輸入（銀行卡帳號/密碼）。

http://wiki.mbalib.com/wiki/%E5%AE%89%E5%85%A8%E6%8E%A7%E4%BB%B6

 

完全正向保密  PFS（perfect forward secrecy）

　　http://baike.baidu.com/item/%E5%AE%8C%E5%85%A8%E6%AD%A3%E5%90%91%E4%BF%9D%E5%AF%86

　　https://en.wikipedia.org/wiki/Forward_secrecy

　　https://www.sslchina.com/deploying-forward-secrecy/

　　https://zh.wikipedia.org/wiki/%E5%89%8D%E5%90%91%E5%AE%89%E5%85%A8%E6%80%A7

 

PFS 密鑰協商：

　　https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange

　　https://zh.wikipedia.org/wiki/%E8%BF%AA%E8%8F%B2-%E8%B5%AB%E7%88%BE%E6%9B%BC%E5%AF%86%E9%91%B0%E4%BA%A4%E6%8F%9B

　　** https://program-think.blogspot.com/2016/09/https-ssl-tls-3.html

 

TLS:

　　https://en.wikipedia.org/wiki/Transport_Layer_Security

　　https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_handshake

其他：

　　1190000004985253 

　　http://www.admin5.com/special/https/

　　**** [1] https://security.stackexchange.com/questions/44563/is-ssl-required-for-sites-hosted-behind-waf

免費認證：

　　https://letsencrypt.org/

 

RFC：

　　https://tools.ietf.org/html/rfc5246 

 

題外內容：TOR

https://en.wikipedia.org/wiki/Tor_(anonymity_network)

 

TODO：

 STARTTLS

 

[skill][https][ssl/tls] HTTPS相關知識匯總