SSL/TLS Under Lock and Key

A Guide to Understanding SSL/TLS Cryptography

Paul Baka, Jeremy Schatten, Hollie Acres

• Publisher: Keyko Books
• Year: 2020
• ISBN:
  9780648931614
• Edition: 1
• Topic: Informatique
• Subtopic: Cryptographie

If you are looking for a comprehensive, soup-to-nuts resource on SSL/TLS, look no further. This book, geared towards bridging the gap between the absolute beginner and the veteran IT Professional, combines the theoretical and the practical in equal measure.

The first half of our book focuses on foundational theory, covering topics such as:

• Symmetric vs Asymmetric cryptography
• One-Way functions
• Digital Signatures
• Key Generation
• History and Context

The second half encourages fledgling administrators to jump in with both feet, outlining the quirks of common tasks such as:

• Generating a signing request for a certificate (CSR)
• Generating a self-signed certificate (and when it is safe to do or not do so)
• Converting certificates between different formats including java keystores
• Configuring servers to meet best practices, not in a vacuum, but for thesecurity and compatibility needs of your business vertical.

Are you a systems administrator just starting out? A developer looking to not just implement, but to understand?Or perhaps SSL/TLS has been a topic you've avoided over the years because it is very dense and implementation can be fraught with fidgety pitfalls. You can read this book cover to cover, crosswalk to the copiously linked RFCs, or use it as a desk reference.

This is SSL/TLS for everyone.

Chapter 1
SSL, TLS and Cryptography

Cryptography

Cryptography is the practice of creating and solving codes. It predates the earliest computers by over 1000 years! It can be used to hide important messages so that they can only be read by the intended recipient. In-fact, any attempt at obfuscating a message qualifies as a form of cryptography. One famous example of a cryptographic scheme is often performed by school children; milk (from the dairy aisle) is applied to a piece of paper with a Q-Tip in order to form letters, these letters are invisible unless the paper is given to someone in the know — by holding the paper up to the warmth of a light bulb, the sugars in the milk are gently burned, revealing the hidden message.

In the context of computer systems, “encryption” is a formalized cryptographic system making use of a different kind of hidden message - one that has been altered by applying a particular set of rules (or algorithm) known as a “cipher”. Another set of rules can then be used to “decrypt” and change it back to its original form. The prototypical example of this is “3-back” or “The Caesar Cipher”, famously regarded to have been the favorite way for Julius Caesar to communicate in secret.

The Caesar Cipher

The Caesar Cipher works by assigning each letter of the alphabet an ascending numerical value starting with A equal to 1, B equal to 2 and so on. We then replace each letter of our message with the letter whose numerical value is 3 less than the real letter, as displayed in the table below (Table 1.0).

Table 1.0: Caesar Cipher

A	=	X	H	=	E	O	=	L	V	=	S
B	=	Y	I	=	F	P	=	M	W	=	T
C	=	Z	J	=	G	Q	=	N	X	=	U
D	=	A	K	=	H	R	=	O	Y	=	V
E	=	B	L	=	I	S	=	P	Z	=	W
F	=	C	M	=	J	T	=	Q
G	=	D	N	=	K	U	=	R

Table 1.1: Caesar Cipher Example

I

L

O

V

E

C

R

Y

P

T

O

G

R

A

P

H

Y

F

I

L

S

B

Z

O

V

M

Q

L

D

O

X

M

E

V

While cryptographic systems vary in complexity, scale and design, cryptographers have agreed upon a set of standard terms. Some of these terms are:

• “Plaintext” is the original message, unaltered.
• “Ciphertext” refers to the encoded message.
• “Encryption” is the act of converting plaintext into ciphertext, and
• “Decryption” is the act of converting a ciphertext back into plaintext by putting the cipher through its paces in reverse.

Modern computers make use of an input to the cipher called a “key”. The key is required to encrypt or decrypt the message. The two main subtypes of cryptography are differentiated by whether that key is the same for all parties involved (symmetric) or unique to each party (asymmetric).

Symmetric Cryptography

In Symmetric Cryptography, all parties share the same key to both encrypt and decrypt the message. Look again at the previous 3-back example, pretend that instead of 3-back, the cipher was “n-back” where n is a single digit number (0 - 9) known only to the parties privy to the communication. This would be a 4-bit key, since it takes 4 bits in binary to express the decimal range of 0 to 9.

Image 1.0: Symmetric encryption

Symmetric Cryptography is also commonly known as a “shared secret”.

In digital practices, keys are much longer than 4 bits, and are derived from a key generation algorithm instead of being thought up. If a key, used to secure sensitive information, truly only had 10 possible values, that information would be very easy to guess! Although Symmetric Cryptography has some really great advantages, it also features some painful disadvantages.

Table 1.2: Symmetric Pros and Cons

Pros	It is extremely fast. Key management is very simple — there is only one key to manage.
Cons	As everyone shares the same key, it’s impossible to figure out who’s who in a conversation. At times, knowing who’s who is really important, and being able to do it is referred to in cryptography as “non-repudiation”.

This kind of cryptography requires the key to be transferred via a secure channel prior to the commencement of the communication. Otherwise, anyone eavesdropping on the wire will also have the private key and thus the ability to decrypt the private message. Not good!

The number of possible keys is referred to as the “keyspace”. Ideally the keyspace should be large enough to deter anyone from attempting a Brute Force Attack, which is when every possible key is easily tested until the correct one is discovered.

Asymmetric Cryptography

In Asymmetric Cryptography, each participant has not one, but two keys. These keys are intrinsically linked. Information that is encrypted using the “public key”, can then only be decrypted using the corresponding “private key”.

Image 1.1: Asymmetric encryption

The keys cannot be derived from each other without a prohibitively massive amount of computation. Mathematically, this relies on the factorization of large prime numbers and “one-way” functions which are easy to perform, but difficult to reverse. The opposite is also true; that which is encrypted using the private key can only be decrypted by the corresponding public key. In fact, this latter property is the foundation for digital signatures. Asymmetrical Cryptography comes with its own advantages and disadvantages.

Table 1.3: Asymmetric Pros and Cons

Pros	It inherently identifies parties uniquely. It can be put to use immediately — you can share a public key with anyone.
Cons	It’s slow. It requires more work administratively to manage keys. Without third party verification, there is no guarantee that the public key belongs to the person who you expect. You could be encrypting messages that can only be decrypted by an attacker!

SSL/TLS: The Best of Both Worlds

SSL/TLS; the core topic covered by this book, leverages both asymmetric cryptography and symmetric cryptography in order to reap the benefits from both strategies. SSL/TLS is considered a “protocol” - a formal set of rules defined by the Internet Engineering Task Force (IETF) as a document called a “Request for Comments” (RFC)1.

SSL stands for “Secure Sockets Layer”
TLS stands for “Transport Layer Security”

One of the main goals of SSL/TLS was for it to be protocol agnostic. In practice, this means that it establishes a secure tunnel that other applications can take advantage of without fundamentally redesigning each and every protocol in order to have a secure variant and an insecure variant. For example, HTTPS is HTTP over SSL/TLS. FTPS is FTP over SSL/TLS, and SMTPS is simply SMTP over SSL/TLS. SSL/TLS does not care what information travels over it, if it is stateless or stateful, or even if it is at Layer 4 or Layer 7 of the OSI model.

But how does this work?

First, SSL/TLS leverages asymmetric encryption in order to forge a channel over which a symmetric key can be passed between server and client. The communication begins when the client sends the server a message known as the “client hello”. Included in this first message are details of what versions of SSL/TLS are supported by the client, as well as what ciphers they’re able to speak for each protocol version they support. Finally, included in this message is a randomly generated value which will be used to create the symmetric key. The server, in turn, responds with the “server hello”, informing the client which SSL/TLS version as well as which cipher it would like to use in order to establish the communication. This will be covered further in Chapter 2.

Typically, administrators will configure a server t...