SSL

From Grayhat cheatsheets
Jump to navigationJump to search
  • SSL: Secure Socket Layer, predecessor of TLS. It encrypts in the application layer of TCP/IP, and in the session adn presentation layers of the OSI model.
  • TLS: Transport Layer Security, created from and old SSL version. It encrypts traffic, just like SSL. Both are used in web browsing, email, fax, VoIP, messaging...

They must guarantee secrecy, integrity and authenticity.

A plaintext of the client ssl version, cypher settings, session data, etc is sent. The server sends the same in plaintext, as well as the certificate, and the client uses the certificate to authenticate. Client and server establish a master secret to generate the session key, which is a symmetric key used to encrypt and decrypt a session. The details depend on the cypher settings.

Browsers come with trusted root certificate authorities and intermediates, this is, there are entities (which emitted these default certificates) that are trusted by the browser. In firefox, go to Settings > Security > Certificates > Authorities, to view these default certificates.

Certificates have a public and a private key. The public key is a signed statement which relates the identity of an entity to the public key. That entity has a private key, which can be used to sign a message, which can be decrypted with the public key. It can also be used to sign public keys from other users, to establish a trust relationship.

  • Private Key infrastructure (PKI) are hardware, software, policies, etc, used to sign a digital certificate (creation, management, distribution, use, etc). There are certificate black lists.

There are Certificate Authorities (CA), Validation Authorities (VA), Registration Authorities (RA). CA chains is when a trusted authority claims to trust another authority, and immediately we trust it as a consequence.

To achieve a certificate for our own website means that we pay to a CA so that they show to the rest of the world that they trust us and that we promised to be good ;)