u6.1 Secure Protocols & VPN. TLS - SSH

u6.1 Secure Protocols & VPN. TLS - SSH

1. Security Services

   • Origin Authentication
     • Without authentication = man in the middle attack can happen
     • Uses digital signatures
       • RSA used
       • Usual that the server is only authenticated
         • Client authenticates server
           • Client is not usually authenticated
   • Confidentiality
   • Integrity
     • Provided by including a cryptographic checksum
   • sec services Implemented partly at session & transport layer
     • Advantages
       • end to end protection
       • Application can control when the secure channel is used
     • disadvantages
       • Application must be modified
   • Key exchange
   • All services supplied in 1 package
     • IPSEC, different packages IE: AH / ESP / IKE

2. Most common use is WWW

   • HTTP: over TLS
     • http = https
   • Policy does not play such a big part in TLS as with IPSEC

3. TLS Handshake

   • Establishes a session key by generating a shared secret
     • Keys for bulk encryption / message auth derived from that shared secret
       • Key Exchange service provides for key agreement
         • RSA used as the asymmetric algorithm for auth
           • Diffe-Helman can also be used
             • 2 round trips
               • 4 number calculations
           • 3 Round trips
             • 2 number calculations

4. Provides a mechanisim for re-keying

   • This provides for session resumption
     • So that the next web page can leverage the encryption processes used to establish a secure connection to the initial page.
     • Authentication and shared secrets are re-used across multiple transport sessions

5. Uses TCP to provide an End to End service