Title: What is SSL/TLS?
Course: Introduction to SSL/PKI > Section: SSL/TLS

What is SSL/TLS?

What Is A Protocol?

A communication/network protocol is a formal description of message formats and the rules two computers must follow to exchange those messages.

There are three basic purposes for communication protocols:

- To standardize the format of a communication
- To specify the order or timing of communication
- To allow all parties to determine the meaning of a communication

What Is A Socket?

A socket is one end-point of a two-way communication link between two programs running on the network.

What is SSL/TLS?

SSL (Secure Socket Layer) is a communication/network protocol created by Netscape in 1994 to ensure secure transactions between web servers and browsers.

Secure Sockets Layer (SSL) and its successor, Transport Layer Security (TLS), are cryptographic protocols which provide secure communications for such things as web browsing, e-mail, and other data transfers. There are slight differences between SSL 3.0 and TLS 1.0, but the protocol remains substantially the same. In general the term "SSL" applies to both protocols.

What Is The SSL Handshake?

The SSL handshake is an exchange of messages between the client and the server. It is used to establish secure (encrypted) communications between the client and the server.

What Is The Purpose Of The SSL Handshake?

The purpose of the SSL handshake is to create a symmetric (private/secret) key that only the client and server know. The key will be used to secure (encrypt) client/server communications.

SSL Handshake Using Diffi-Helman Key Exchange

No PKI certificates are involved. After the session key has been created, the client and server must authenticate each other.

SSL Handshake Using PKI Certificates

Scenario 1

As part of the SSL handshake the server sends it's PKI certificate to the client. The Certificate authenticates the server to the client. After the session key has been created, the server must authenticate the client.

Scenario 2

As part of the SSL handshake the client sends it's PKI certificate to the server. The Certificate authenticates the client to the server. After the session key has been created, the client must authenticate the server.

Scenario 3

As part of the SSL handshake the client and server exchange PKI certificates. After the session key has been created, the client and server have authenticate each other.

SSL Handshake Steps

1. The client sends a Client Hello message to the server specifying the list of cipher suites, compression methods and the highest protocol version it supports. It also sends random bytes which will be used later.

2. The server returns a Server Hello message, in which the server chooses the connection parameters from the choices offered by the client earlier.

3. When the connection parameters are known, the server sends its certificates to the client so it can be authenticated. (optional)

4. The server can request a certificate from the client, so that the connection can be mutually authenticated. (optional)

5. The client and server negotiate a common secret called the "master secret" key, possibly using the result of a Diffie-Hellman exchange, or simply encrypting a secret with a public key that is decrypted with the server's private key.

6. Data can now be securely exchanges using the "master secret" Key.

The following diagram shows what messages are used in the handshake protocol and in what sequence they are used.

Client |  | Server
Client Hello | ==> |
 | <== | Server Hello
 | <== | Server Certificate (optional)
 | <== | Server Key Exchange (optional)
 | <== | Certificate Request (optional)
Client Certificate | ==> |
Client Key Exchange | ==> |
Client Verify | ==> |
Change Cipher Spec | ==> |
Finished | ==> |
 | <== | Change Cipher Spec
 | <== | Finished

Typical Web Server / Web Browser SSL Connections

Typical Web Server / Web Browser Authentication

1. | A web browser requests a connection with a web server
2. | The web server sends web browser its certificate
3. | The web browser authenticates the web server (verifies received certificate)
4. | A secure communication connection is established between the web browser and the web server
5. | The web server requests a username and password from the web browser
6. | The web server authenticates the browser (verifies the received username and password)