SSL avançado

SSL avançado

1. comunicação SSL entre client e server

   • 1. client enviar um CLIENT HELLO para o server junto com os paramentros de ciframento propostos
     • o SSL Protocol version
     • o Session ID
     • o List of Cipher Suites supported by the client
     • o List of CLIENT HELLO Extensions
   • 2. O server responde com Server Hello com paramentros acordados e também enviar o certificado dele (pegou de um orgão autorizado - site)
     • • SSL/TLS Protocol version
     • cipher suites Agreeded
     • • Certificate of the server (Without the private key of course)
   • 4. agora que a autenticação foi confirmada temos que encriptar os dados
     • Client uses the data provided from the server to generate a pre-master secret
       • encrypts it with the server’s public key (obtained from the server’s certificate)
     • sends the encrypted pre-master secret to the server
     • server uses its private key to decrypt the pre-master secret
     • the server performs a series of steps (which the client also performs, starting from the same pre-master secret) to generate the master secret
       • • Both the client and the server use the master secret to generate the session keys
   • 5. • Both the client and the server use the master secret to generate the session keys
   • 6. • The SSL Handshake is done
     • The Client and the Server send each other messages which are encrypted/decrypted using the session keys generated in the previous step
   • 7. • It is now that the Client sends the actual HTTP Request packet to the Server in the encrypted form
   • Fases de negociação
     • Fase 1 - estabelecimento dos parametros de segurança
     • Fase 2 - Server autentication e Key exchange
     • Fase 3 - assinatura digital / certificado do client e server
     • Fase 4 - Key generation
     • Fase 5
       • envia os dados encrip
       • Fim do SSL handshake
   • www.itau.com.br
   • DNS atua para fazer a resolução do nome
   • Com o IP destino acontece o TCP handshack (Syn, Synack, ack)
   • The client will now forward the requests to the Destination IP on port 443 (Default TLS/SSL port)
   • The control is now transferred to the SSL Protocol in the application layer.
   • Upon receiving the CLIENT HELLO, the server has access to the following information
     • ip/o Port Number (443)/o Protocol Version (TLS 1.0)/o List of Cipher Suites/o Session ID/o List of CLIENT HELLO Extensions etc
   • • The Client uses the SERVER HELLO to perform SERVER AUTHENTICATION
     • https://support.microsoft.com/en-us/help/257587/description-of-the-server-authentication-process-during-the-ssl-handsh
     • 3. o cliente recebeu este certificado e tem que ver se é válido ou não
       • checa o campo valid
       • se é assinado por uma autoridade reconhecida
         • Todo browser tem esse cadastrado
   • • The CLIENT & the SERVER send each other a message informing that future messages from them will be encrypted with the session key

2. session keys

   • are symmetric keys used to encrypt and decrypt information exchanged during the SSL session
   • to verify its integrity (that is, to detect any changes in the data between the time it was sent and the time it is received over the SSL connection).