HTTPS and SSL
Organizing confusing concepts
Reference: Opentutorials Course, minix.tstory.com, Professor Bill Buchanan's Website
HTTPS vs HTTP
What is HTTP?
An abbreviation for Hypertext Transfer Protocol, which refers to the communication protocol for transmitting Hypertext, namely HTML
What is HTTPS?
The last
Sin HTTPS stands for Over Secure Socket Layer, and as the word Secure suggests, we can infer that it is an HTTP with enhanced securitySince HTTP transmits data in an unencrypted manner, it is very easy to intercept messages exchanged between the Server and the client
It is not safe!
ex) During the process of sending a password to the Server for login or viewing important confidential documents, malicious eavesdropping or data tampering can occur!
That is why HTTPS was created to address this!
HTTPS and SSL
Many people understand HTTPS and SSL as the same thing (including my past self...)
This is like understanding the Internet and the Web as the same thing!
Why?Just as the Web is one of the services running on top of the Internet,
HTTPS is also a Protocol running on top of the SSL Protocol!
When HTTP operates on top of SSL, it becomes HTTPS!
SSL and TLS
These two are actually the same thing!
SSL was invented at Netscape, and as it became widely used, it was transferred to the standards organization
IETFand renamed to TLSTLS 1.0 succeeds SSL 3.0
So the official name is TLS
but, the name SSL is used much more frequently than TLS!
SSL Digital Certificate
What is an SSL Certificate?
An electronic document where a third party guarantees the communication between the Client and the Server
Right after the Client connects to the Server, the Server delivers the SSL certificate information to the Client
The Client verifies whether this certificate information is trustworthy, and then proceeds with the next steps
Benefits of Using SSL Digital Certificates
Communication content can be prevented from being exposed to attackers
Encryption is needed for this!
The Client can determine whether the server it is trying to connect to is a trustworthy server
Malicious modification of communication content can be prevented
Types of Encryption Used in SSL
What is Encryption?
When transmitting information to a remote location, if someone intercepts it in the middle, security is threatened
In this case, encryption makes it so that even if someone intercepts the information, they cannot interpret it, while the recipient at the destination can interpret it!
Even for information that is not being sent to anyone but is only viewed by oneself, making it so that no one else can understand it and only oneself can understand it is also encryption!
What is Decryption?
Reverting encrypted information back to its pre-encrypted state!
What is a Key?
The reference data for encryption & decryption
You must have the Key to encrypt and decrypt information
Symmetric-key Algorithm
An encryption method where
encryptionanddecryptioncan both be performed with the same keyThe side performing
encryptionand the side performingdecryptionhave the same Key!
Practice) Encrypting with a Symmetric Key
Create a txt file for practice
Encrypt with the symmetric key
Command explanation
enc -e -des3Encrypt using the des3 method
-in plaintext.txt -out ciphertext.binSave the encryption result of plaintext.txt to the ciphertext.bin file
Check the encrypted file
Decrypt with the symmetric key
Command explanation
enc -dDecrypt the ciphertext.bin file into the plaintext2.txt file using the above option
Check the decryption result
Decryption is possible simply by entering the public key!
This is the problem with symmetric keys
If the public key is exposed, security is compromised
Problems with the Symmetric Key Method
It is difficult to deliver the symmetric key between the people exchanging encrypted messages
If the symmetric key is leaked, an attacker who obtains the key can decrypt the encrypted content, rendering the encryption useless...!
This problem is called the "key distribution problem".
Public-key/Asymmetric Cryptography
An encryption method introduced to improve the "key distribution problem" of symmetric keys
Unlike symmetric keys, there are two Keys
If you encrypt with
Akey, you can decrypt withBkey,If you encrypt with
Bkey, you can decrypt withAkey
One of the two keys is designated as the private key,
and the other is designated as the public key!
Example of Public Key Method
The private key is kept only by oneself,
The public key is provided to others
The person who received the public key encrypts the information using the public key
The encrypted information is sent to the person who has the private key
The owner of the private key decrypts the encrypted information using the
private keyIn this process, even if the public key is leaked, the information cannot be decrypted without knowing the private key, so it is safe!
why?
Because the public key can encrypt but cannot decrypt!
Application of the Public Key Method
The owner of the private key encrypts the information using the
private keyand then transmits the encrypted information along with thepublic keyThe person who obtained the information +
public keydecrypts the encrypted information using the public keyIn this process, if the
public keyis leaked, there is a risk that the data will be decrypted by an attackerbut, despite this risk, the reason for encrypting with the private key is because the purpose is not to protect the data!
Being able to decrypt the encrypted data with the
public keymeans that the data was encrypted by theprivate keythat is paired with the public key!In other words, the
public keyguarantees the identity of the person who provided the data!Why?
Because successfully decrypting using the
public keycertifies that the information was transmitted by the person who holds theprivate key!This is the principle behind certificates!
This is called a digital signature
Practice) Using RSA Public Key
RSA Public KeyGenerate a key named
private.pem
Command explanation
opensslUsing openssl
genrsaGenerate a private key using the RSA method
1024Refers to the complexity of the encryption
The larger the number, the safer it is, but it requires more computing power!
Check the generated private key
Generate a public key for the created private key
Command explanation
-in private.pemTake the file named private.pem
-out public.pemCreate a file named public.pem
Result explanation
writing RSA keyMeans that an RSA method Key has been generated
Create a file to encrypt
Encrypt with the generated public key
Command explanation
opensslUsing openssl
-encryptEncrypt
-inkey public.pemUse public.pem as the key
This means the person with the public key performs the encryption
In other words, this is a command used when secretly transmitting information to the person who has the private key!
-in file.txtEncrypt the file.txt file
-out file.sslExport the encrypted file as file.ssl
Check the file encrypted with the public key
Through this, we can confirm that when someone tries to open the file encrypted with the
public keyduring the process of transmitting it to the person who has theprivate key, the content cannot be read, i.e., it is encrypted!
Decrypt with the private key
Command explanation
opensslUsing openssl
-decryptDecrypt the encryption
-inkey private.pemUse the private.pem file for decryption
-in file.sslThe file.ssl file
-out decrypted.txtExport the decrypted file as decrypted.txt
Check the file decrypted with the private key
Disadvantages of Public Key/Asymmetric Key Method
Asymmetric keys are slower than symmetric keys...
They are difficult to use in situations where speed is important... (video chat, messenger, etc.)
Because of this, most encryption protocols that prioritize speed use a mix of symmetric and asymmetric keys.
Symmetric Key/Asymmetric Key Protocols
Notable examples include wireguard Section 5.2 built into the Linux kernel, and the messenger app Signal's X3DH (which is also used in WhatsApp!).
SSL Certificate ... continue studying from here
Still studying....
Last updated