1. Network Security Gene Itkis
Intro to SSL/TLS
Network Security
Gene Itkis

2. Gene Itkis: CS558 Network Security
Origins
Internet Engineering Task Force (IETF)
Documents: RFC 2246
ANSI
X9.42
ITU
X.509
Netscape
5/1/2018
Gene Itkis: CS558 Network Security

3. Gene Itkis: CS558 Network Security
History
1993 – Mosaic (“browser #1”)
1994 – Netscape Browser released
SSL v1 design complete – never released
SSL v2 released in Navigator 1.1
Badly broken (bad seeds for PRNG)
1995 – Explorer released
PCT (MS), SSL v3 (Netscape)
– TLS 1.0
1999 – WTLS
5/1/2018
Gene Itkis: CS558 Network Security

4. Gene Itkis: CS558 Network Security
Architecture
Application (HTTP)
SSL
TCP IP
5/1/2018
Gene Itkis: CS558 Network Security

5. Alternative architectures
Separate Layer
Over TCP: SSL
Over IP: IPSec
Application-Specific
SHTTP
Parallel
Kerberos; Kerberos with TLS?
5/1/2018
Gene Itkis: CS558 Network Security

6. Gene Itkis: CS558 Network Security
SSL choices
Connection-oriented
SSL, TLS do not support UDP
But WTLS does
No non-repudiation
But signatures are used for AKE
“Only protects the pipe”
Attacks are mounted on data before and after “the pipe”
5/1/2018
Gene Itkis: CS558 Network Security

7. Gene Itkis: CS558 Network Security
SSL security services
Server authentication
Client authentication is optional
Encryption
Message integrity
5/1/2018
Gene Itkis: CS558 Network Security

8. Gene Itkis: CS558 Network Security
SSL phases
Handshake
Set protocol details
Authenticate server
Establish keys
Data transfer
5/1/2018
Gene Itkis: CS558 Network Security

9. Gene Itkis: CS558 Network Security
Handshake
ClientHello
Supported options
ServerHello
Options to be used
ServerCertificate (ServerKeyExchange)
ServerHelloDone
ClientKeyExchange
Finished (sent by client)
5/1/2018
Gene Itkis: CS558 Network Security