1 <?xml version="1.0" encoding="ISO-8859-1"?>
2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
3 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><!--
4 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
5 This file is generated from xml source: DO NOT EDIT
6 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
8 <title>SSL/TLS Strong Encryption: An Introduction - Apache HTTP Server</title>
9 <link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
10 <link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
11 <link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" />
12 <link href="../images/favicon.ico" rel="shortcut icon" /></head>
13 <body id="manual-page"><div id="page-header">
14 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
15 <p class="apache">Apache HTTP Server Version 2.0</p>
16 <img alt="" src="../images/feather.gif" /></div>
17 <div class="up"><a href="./"><img title="<-" alt="<-" src="../images/left.gif" /></a></div>
19 <a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.0</a> > <a href="./">SSL/TLS</a></div><div id="page-content"><div id="preamble"><h1>SSL/TLS Strong Encryption: An Introduction</h1>
21 <p><span>Available Languages: </span><a href="../en/ssl/ssl_intro.html" title="English"> en </a> |
22 <a href="../ja/ssl/ssl_intro.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a></p>
26 <p>The nice thing about standards is that there are so many to choose
27 from. And if you really don't like all the standards you just have to
28 wait another year until the one arises you are looking for.</p>
30 <p class="cite">-- <cite>A. Tanenbaum</cite>, "Introduction to
31 Computer Networks"</p>
34 <p>As an introduction this chapter is aimed at readers who are familiar
35 with the Web, HTTP, and Apache, but are not security experts. It is not
36 intended to be a definitive guide to the SSL protocol, nor does it discuss
37 specific techniques for managing certificates in an organization, or the
38 important legal issues of patents and import and export restrictions.
39 Rather, it is intended to provide a common background to mod_ssl users by
40 pulling together various concepts, definitions, and examples as a starting
41 point for further exploration.</p>
43 <p>The presented content is mainly derived, with permission by the author,
44 from the article <a href="http://home.earthlink.net/~fjhirsch/Papers/wwwj/article.html">Introducing
45 SSL and Certificates using SSLeay</a> from <a href="http://home.earthlink.net/~fjhirsch/">Frederick J. Hirsch</a>, of The
46 Open Group Research Institute, which was published in <a href="http://www.ora.com/catalog/wjsum97/">Web Security: A Matter of
47 Trust</a>, World Wide Web Journal, Volume 2, Issue 3, Summer 1997.
48 Please send any positive feedback to <a href="mailto:hirsch@fjhirsch.com">Frederick Hirsch</a> (the original
49 article author) and all negative feedback to <a href="mailto:rse@engelschall.com">Ralf S. Engelschall</a> (the
50 <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> author).</p>
52 <div id="quickview"><ul id="toc"><li><img alt="" src="../images/down.gif" /> <a href="#cryptographictech">Cryptographic Techniques</a></li>
53 <li><img alt="" src="../images/down.gif" /> <a href="#certificates">Certificates</a></li>
54 <li><img alt="" src="../images/down.gif" /> <a href="#ssl">Secure Sockets Layer (SSL)</a></li>
55 <li><img alt="" src="../images/down.gif" /> <a href="#references">References</a></li>
57 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
59 <h2><a name="cryptographictech" id="cryptographictech">Cryptographic Techniques</a></h2>
61 <p>Understanding SSL requires an understanding of cryptographic
62 algorithms, message digest functions (aka. one-way or hash functions), and
63 digital signatures. These techniques are the subject of entire books (see
64 for instance [<a href="#AC96">AC96</a>]) and provide the basis for privacy,
65 integrity, and authentication.</p>
67 <h3><a name="cryptographicalgo" id="cryptographicalgo">Cryptographic Algorithms</a></h3>
69 <p>Suppose Alice wants to send a message to her bank to transfer some
70 money. Alice would like the message to be private, since it will
71 include information such as her account number and transfer amount. One
72 solution is to use a cryptographic algorithm, a technique that would
73 transform her message into an encrypted form, unreadable except by
74 those it is intended for. Once in this form, the message may only be
75 interpreted through the use of a secret key. Without the key the
76 message is useless: good cryptographic algorithms make it so difficult
77 for intruders to decode the original text that it isn't worth their
80 <p>There are two categories of cryptographic algorithms: conventional
84 <dt>Conventional cryptography</dt>
85 <dd>also known as symmetric cryptography, requires the sender and
86 receiver to share a key: a secret piece of information that may be
87 used to encrypt or decrypt a message. If this key is secret, then
88 nobody other than the sender or receiver may read the message. If
89 Alice and the bank know a secret key, then they may send each other
90 private messages. The task of privately choosing a key before
91 communicating, however, can be problematic.</dd>
93 <dt>Public key cryptography</dt>
94 <dd>also known as asymmetric cryptography, solves the key exchange
95 problem by defining an algorithm which uses two keys, each of which
96 may be used to encrypt a message. If one key is used to encrypt a
97 message then the other must be used to decrypt it. This makes it
98 possible to receive secure messages by simply publishing one key
99 (the public key) and keeping the other secret (the private key).</dd>
102 <p>Anyone may encrypt a message using the public key, but only the
103 owner of the private key will be able to read it. In this way, Alice
104 may send private messages to the owner of a key-pair (the bank), by
105 encrypting it using their public key. Only the bank will be able to
109 <h3><a name="messagedigests" id="messagedigests">Message Digests</a></h3>
111 <p>Although Alice may encrypt her message to make it private, there
112 is still a concern that someone might modify her original message or
113 substitute it with a different one, in order to transfer the money
114 to themselves, for instance. One way of guaranteeing the integrity
115 of Alice's message is to create a concise summary of her message and
116 send this to the bank as well. Upon receipt of the message, the bank
117 creates its own summary and compares it with the one Alice sent. If
118 they agree then the message was received intact.</p>
120 <p>A summary such as this is called a <dfn>message digest</dfn>, <em>one-way
121 function</em> or <em>hash function</em>. Message digests are used to create
122 short, fixed-length representations of longer, variable-length messages.
123 Digest algorithms are designed to produce unique digests for different
124 messages. Message digests are designed to make it too difficult to determine
125 the message from the digest, and also impossible to find two different
126 messages which create the same digest -- thus eliminating the possibility of
127 substituting one message for another while maintaining the same digest.</p>
128 <p>Another challenge that Alice faces is finding a way to send the digest to the
129 bank securely; when this is achieved, the integrity of the associated message
130 is assured. One way to do this is to include the digest in a digital
134 <h3><a name="digitalsignatures" id="digitalsignatures">Digital Signatures</a></h3>
135 <p>When Alice sends a message to the bank, the bank needs to ensure that the
136 message is really from her, so an intruder does not request a transaction
137 involving her account. A <em>digital signature</em>, created by Alice and
138 included with the message, serves this purpose.</p>
140 <p>Digital signatures are created by encrypting a digest of the message,
141 and other information (such as a sequence number) with the sender's
142 private key. Though anyone may <em>decrypt</em> the signature using the public
143 key, only the signer knows the private key. This means that only they may
144 have signed it. Including the digest in the signature means the signature is
145 only good for that message; it also ensures the integrity of the message since
146 no one can change the digest and still sign it.</p>
147 <p>To guard against interception and reuse of the signature by an intruder at a
148 later date, the signature contains a unique sequence number. This protects
149 the bank from a fraudulent claim from Alice that she did not send the message
150 -- only she could have signed it (non-repudiation).</p>
152 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
153 <div class="section">
154 <h2><a name="certificates" id="certificates">Certificates</a></h2>
156 <p>Although Alice could have sent a private message to the bank, signed
157 it, and ensured the integrity of the message, she still needs to be sure
158 that she is really communicating with the bank. This means that she needs
159 to be sure that the public key she is using corresponds to the bank's
160 private key. Similarly, the bank also needs to verify that the message
161 signature really corresponds to Alice's signature.</p>
163 <p>If each party has a certificate which validates the other's identity,
164 confirms the public key, and is signed by a trusted agency, then they both
165 will be assured that they are communicating with whom they think they are.
166 Such a trusted agency is called a <em>Certificate Authority</em>, and
167 certificates are used for authentication.</p>
169 <h3><a name="certificatecontents" id="certificatecontents">Certificate Contents</a></h3>
171 <p>A certificate associates a public key with the real identity of
172 an individual, server, or other entity, known as the subject. As
173 shown in <a href="#table1">Table 1</a>, information about the subject
174 includes identifying information (the distinguished name), and the
175 public key. It also includes the identification and signature of the
176 Certificate Authority that issued the certificate, and the period of
177 time during which the certificate is valid. It may have additional
178 information (or extensions) as well as administrative information
179 for the Certificate Authority's use, such as a serial number.</p>
181 <h4><a name="table1" id="table1">Table 1: Certificate Information</a></h4>
186 <td>Distinguished Name, Public Key</td></tr>
188 <td>Distinguished Name, Signature</td></tr>
189 <tr><th>Period of Validity</th>
190 <td>Not Before Date, Not After Date</td></tr>
191 <tr><th>Administrative Information</th>
192 <td>Version, Serial Number</td></tr>
193 <tr><th>Extended Information</th>
194 <td>Basic Constraints, Netscape Flags, etc.</td></tr>
198 <p>A distinguished name is used to provide an identity in a specific
199 context -- for instance, an individual might have a personal
200 certificate as well as one for their identity as an employee.
201 Distinguished names are defined by the X.509 standard [<a href="#X509">X509</a>], which defines the fields, field names, and
202 abbreviations used to refer to the fields (see <a href="#table2">Table
205 <h4><a name="table2" id="table2">Table 2: Distinguished Name Information</a></h4>
207 <table class="bordered">
209 <tr><th>DN Field</th>
212 <th>Example</th></tr>
213 <tr><td>Common Name</td>
215 <td>Name being certified</td>
216 <td>CN=Joe Average</td></tr>
217 <tr><td>Organization or Company</td>
219 <td>Name is associated with this<br />organization</td>
220 <td>O=Snake Oil, Ltd.</td></tr>
221 <tr><td>Organizational Unit</td>
223 <td>Name is associated with this <br />organization unit, such
225 <td>OU=Research Institute</td></tr>
226 <tr><td>City/Locality</td>
228 <td>Name is located in this City</td>
229 <td>L=Snake City</td></tr>
230 <tr><td>State/Province</td>
232 <td>Name is located in this State/Province</td>
233 <td>ST=Desert</td></tr>
236 <td>Name is located in this Country (ISO code)</td>
241 <p>A Certificate Authority may define a policy specifying which
242 distinguished field names are optional, and which are required. It
243 may also place requirements upon the field contents, as may users of
244 certificates. As an example, a Netscape browser requires that the
245 Common Name for a certificate representing a server has a name which
246 matches a wildcard pattern for the domain name of that server, such
247 as <code>*.snakeoil.com</code>.</p>
249 <p>The binary format of a certificate is defined using the ASN.1
250 notation [<a href="#X208">X208</a>] [<a href="#PKCS">PKCS</a>]. This
251 notation defines how to specify the contents, and encoding rules
252 define how this information is translated into binary form. The binary
253 encoding of the certificate is defined using Distinguished Encoding
254 Rules (DER), which are based on the more general Basic Encoding Rules
255 (BER). For those transmissions which cannot handle binary, the binary
256 form may be translated into an ASCII form by using Base64 encoding
257 [<a href="#MIME">MIME</a>]. This encoded version is called PEM encoded
258 (the name comes from "Privacy Enhanced Mail"), when placed between
259 begin and end delimiter lines as illustrated in the following
262 <div class="example"><h3>Example of a PEM-encoded certificate (snakeoil.crt)</h3><pre>-----BEGIN CERTIFICATE-----
263 MIIC7jCCAlegAwIBAgIBATANBgkqhkiG9w0BAQQFADCBqTELMAkGA1UEBhMCWFkx
264 FTATBgNVBAgTDFNuYWtlIERlc2VydDETMBEGA1UEBxMKU25ha2UgVG93bjEXMBUG
265 A1UEChMOU25ha2UgT2lsLCBMdGQxHjAcBgNVBAsTFUNlcnRpZmljYXRlIEF1dGhv
266 cml0eTEVMBMGA1UEAxMMU25ha2UgT2lsIENBMR4wHAYJKoZIhvcNAQkBFg9jYUBz
267 bmFrZW9pbC5kb20wHhcNOTgxMDIxMDg1ODM2WhcNOTkxMDIxMDg1ODM2WjCBpzEL
268 MAkGA1UEBhMCWFkxFTATBgNVBAgTDFNuYWtlIERlc2VydDETMBEGA1UEBxMKU25h
269 a2UgVG93bjEXMBUGA1UEChMOU25ha2UgT2lsLCBMdGQxFzAVBgNVBAsTDldlYnNl
270 cnZlciBUZWFtMRkwFwYDVQQDExB3d3cuc25ha2VvaWwuZG9tMR8wHQYJKoZIhvcN
271 AQkBFhB3d3dAc25ha2VvaWwuZG9tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
272 gQDH9Ge/s2zcH+da+rPTx/DPRp3xGjHZ4GG6pCmvADIEtBtKBFAcZ64n+Dy7Np8b
273 vKR+yy5DGQiijsH1D/j8HlGE+q4TZ8OFk7BNBFazHxFbYI4OKMiCxdKzdif1yfaa
274 lWoANFlAzlSdbxeGVHoT0K+gT5w3UxwZKv2DLbCTzLZyPwIDAQABoyYwJDAPBgNV
275 HRMECDAGAQH/AgEAMBEGCWCGSAGG+EIBAQQEAwIAQDANBgkqhkiG9w0BAQQFAAOB
276 gQAZUIHAL4D09oE6Lv2k56Gp38OBDuILvwLg1v1KL8mQR+KFjghCrtpqaztZqcDt
277 2q2QoyulCgSzHbEGmi0EsdkPfg6mp0penssIFePYNI+/8u9HT4LuKMJX15hxBam7
278 dUHzICxBVC1lnHyYGjDuAMhe396lYAn8bCld1/L4NMGBCQ==
279 -----END CERTIFICATE-----</pre></div>
282 <h3><a name="certificateauthorities" id="certificateauthorities">Certificate Authorities</a></h3>
284 <p>By first verifying the information in a certificate request
285 before granting the certificate, the Certificate Authority assures
286 the identity of the private key owner of a key-pair. For instance,
287 if Alice requests a personal certificate, the Certificate Authority
288 must first make sure that Alice really is the person the certificate
291 <h4><a name="certificatechains" id="certificatechains">Certificate Chains</a></h4>
293 <p>A Certificate Authority may also issue a certificate for
294 another Certificate Authority. When examining a certificate,
295 Alice may need to examine the certificate of the issuer, for each
296 parent Certificate Authority, until reaching one which she has
297 confidence in. She may decide to trust only certificates with a
298 limited chain of issuers, to reduce her risk of a "bad" certificate
302 <h4><a name="rootlevelca" id="rootlevelca">Creating a Root-Level CA</a></h4>
304 <p>As noted earlier, each certificate requires an issuer to assert
305 the validity of the identity of the certificate subject, up to
306 the top-level Certificate Authority (CA). This presents a problem:
307 Since this is who vouches for the certificate of the top-level
308 authority, which has no issuer? In this unique case, the
309 certificate is "self-signed", so the issuer of the certificate is
310 the same as the subject. As a result, one must exercise extra care
311 in trusting a self-signed certificate. The wide publication of a
312 public key by the root authority reduces the risk in trusting this
313 key -- it would be obvious if someone else publicized a key
314 claiming to be the authority. Browsers are preconfigured to trust
315 well-known certificate authorities.</p>
317 <p>A number of companies, such as <a href="http://www.thawte.com/">Thawte</a> and <a href="http://www.verisign.com/">VeriSign</a>
318 have established themselves as Certificate Authorities. These
319 companies provide the following services:</p>
322 <li>Verifying certificate requests</li>
323 <li>Processing certificate requests</li>
324 <li>Issuing and managing certificates</li>
327 <p>It is also possible to create your own Certificate Authority.
328 Although risky in the Internet environment, it may be useful
329 within an Intranet where the organization can easily verify the
330 identities of individuals and servers.</p>
333 <h4><a name="certificatemanagement" id="certificatemanagement">Certificate Management</a></h4>
335 <p>Establishing a Certificate Authority is a responsibility which
336 requires a solid administrative, technical, and management
337 framework. Certificate Authorities not only issue certificates,
338 they also manage them -- that is, they determine how long
339 certificates are valid, they renew them, and they keep lists of
340 certificates that have already been issued but are no longer valid
341 (Certificate Revocation Lists, or CRLs). Say Alice is entitled to
342 a certificate as an employee of a company. Say too, that the
343 certificate needs to be revoked when Alice leaves the company. Since
344 certificates are objects that get passed around, it is impossible
345 to tell from the certificate alone that it has been revoked. When
346 examining certificates for validity, therefore, it is necessary to
347 contact the issuing Certificate Authority to check CRLs -- this
348 is not usually an automated part of the process.</p>
350 <div class="note"><h3>Note</h3>
351 <p>If you use a Certificate Authority that is not configured into
352 browsers by default, it is necessary to load the Certificate
353 Authority certificate into the browser, enabling the browser to
354 validate server certificates signed by that Certificate Authority.
355 Doing so may be dangerous, since once loaded, the browser will
356 accept all certificates signed by that Certificate Authority.</p>
361 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
362 <div class="section">
363 <h2><a name="ssl" id="ssl">Secure Sockets Layer (SSL)</a></h2>
365 <p>The Secure Sockets Layer protocol is a protocol layer which may be
366 placed between a reliable connection-oriented network layer protocol
367 (e.g. TCP/IP) and the application protocol layer (e.g. HTTP). SSL provides
368 for secure communication between client and server by allowing mutual
369 authentication, the use of digital signatures for integrity, and encryption
372 <p>The protocol is designed to support a range of choices for specific
373 algorithms used for cryptography, digests, and signatures. This allows
374 algorithm selection for specific servers to be made based on legal, export
375 or other concerns, and also enables the protocol to take advantage of new
376 algorithms. Choices are negotiated between client and server at the start
377 of establishing a protocol session.</p>
379 <h3><a name="table4" id="table4">Table 4: Versions of the SSL protocol</a></h3>
381 <table class="bordered">
386 <th>Browser Support</th></tr>
387 <tr><td>SSL v2.0</td>
388 <td>Vendor Standard (from Netscape Corp.) [<a href="#SSL2">SSL2</a>]</td>
389 <td>First SSL protocol for which implementations exists</td>
390 <td>- NS Navigator 1.x/2.x<br />
392 - Lynx/2.8+OpenSSL</td></tr>
393 <tr><td>SSL v3.0</td>
394 <td>Expired Internet Draft (from Netscape Corp.) [<a href="#SSL3">SSL3</a>]</td>
395 <td>Revisions to prevent specific security attacks, add non-RSA
396 ciphers, and support for certificate chains</td>
397 <td>- NS Navigator 2.x/3.x/4.x<br />
398 - MS IE 3.x/4.x<br />
399 - Lynx/2.8+OpenSSL</td></tr>
400 <tr><td>TLS v1.0</td>
401 <td>Proposed Internet Standard (from IETF) [<a href="#TLS1">TLS1</a>]</td>
402 <td>Revision of SSL 3.0 to update the MAC layer to HMAC, add block
403 padding for block ciphers, message order standardization and more
405 <td>- Lynx/2.8+OpenSSL</td></tr>
409 <p>There are a number of versions of the SSL protocol, as shown in
410 <a href="#table4">Table 4</a>. As noted there, one of the benefits in
411 SSL 3.0 is that it adds support of certificate chain loading. This feature
412 allows a server to pass a server certificate along with issuer certificates
413 to the browser. Chain loading also permits the browser to validate the
414 server certificate, even if Certificate Authority certificates are not
415 installed for the intermediate issuers, since they are included in the
416 certificate chain. SSL 3.0 is the basis for the Transport Layer Security
417 [<a href="#TLS1">TLS</a>] protocol standard, currently in development by
418 the Internet Engineering Task Force (IETF).</p>
420 <h3><a name="session" id="session">Session Establishment</a></h3>
422 <p>The SSL session is established by following a handshake sequence
423 between client and server, as shown in <a href="#figure1">Figure 1</a>. This sequence may vary, depending on whether the server
424 is configured to provide a server certificate or request a client
425 certificate. Though cases exist where additional handshake steps
426 are required for management of cipher information, this article
427 summarizes one common scenario: see the SSL specification for the full
428 range of possibilities.</p>
430 <div class="note"><h3>Note</h3>
431 <p>Once an SSL session has been established it may be reused, thus
432 avoiding the performance penalty of repeating the many steps needed
433 to start a session. For this the server assigns each SSL session a
434 unique session identifier which is cached in the server and which the
435 client can use on forthcoming connections to reduce the handshake
436 (until the session identifer expires in the cache of the server).</p>
440 <img src="../images/ssl_intro_fig1.gif" alt="" width="423" height="327" /><br />
441 <a id="figure1" name="figure1"><dfn>Figure 1</dfn></a>: Simplified SSL
442 Handshake Sequence</p>
444 <p>The elements of the handshake sequence, as used by the client and
445 server, are listed below:</p>
448 <li>Negotiate the Cipher Suite to be used during data transfer</li>
449 <li>Establish and share a session key between client and server</li>
450 <li>Optionally authenticate the server to the client</li>
451 <li>Optionally authenticate the client to the server</li>
454 <p>The first step, Cipher Suite Negotiation, allows the client and
455 server to choose a Cipher Suite supportable by both of them. The SSL3.0
456 protocol specification defines 31 Cipher Suites. A Cipher Suite is
457 defined by the following components:</p>
460 <li>Key Exchange Method</li>
461 <li>Cipher for Data Transfer</li>
462 <li>Message Digest for creating the Message Authentication Code (MAC)</li>
465 <p>These three elements are described in the sections that follow.</p>
468 <h3><a name="keyexchange" id="keyexchange">Key Exchange Method</a></h3>
470 <p>The key exchange method defines how the shared secret symmetric
471 cryptography key used for application data transfer will be agreed
472 upon by client and server. SSL 2.0 uses RSA key exchange only, while
473 SSL 3.0 supports a choice of key exchange algorithms including the
474 RSA key exchange when certificates are used, and Diffie-Hellman key
475 exchange for exchanging keys without certificates and without prior
476 communication between client and server.</p>
478 <p>One variable in the choice of key exchange methods is digital
479 signatures -- whether or not to use them, and if so, what kind of
480 signatures to use. Signing with a private key provides assurance
481 against a man-in-the-middle-attack during the information exchange
482 used in generating the shared key [<a href="#AC96">AC96</a>, p516].</p>
485 <h3><a name="ciphertransfer" id="ciphertransfer">Cipher for Data Transfer</a></h3>
487 <p>SSL uses the conventional cryptography algorithm (symmetric
488 cryptography) described earlier for encrypting messages in a session.
489 There are nine choices, including the choice to perform no
493 <li>No encryption</li>
496 <li>RC4 with 40-bit keys</li>
497 <li>RC4 with 128-bit keys</li>
499 <li>CBC Block Ciphers
500 <ul><li>RC2 with 40 bit key</li>
501 <li>DES with 40 bit key</li>
502 <li>DES with 56 bit key</li>
503 <li>Triple-DES with 168 bit key</li>
504 <li>Idea (128 bit key)</li>
505 <li>Fortezza (96 bit key)</li>
509 <p>Here "CBC" refers to Cipher Block Chaining, which means that a
510 portion of the previously encrypted cipher text is used in the
511 encryption of the current block. "DES" refers to the Data Encryption
512 Standard [<a href="#AC96">AC96</a>, ch12], which has a number of
513 variants (including DES40 and 3DES_EDE). "Idea" is one of the best
514 and cryptographically strongest available algorithms, and "RC2" is
515 a proprietary algorithm from RSA DSI [<a href="#AC96">AC96</a>,
519 <h3><a name="digestfuntion" id="digestfuntion">Digest Function</a></h3>
521 <p>The choice of digest function determines how a digest is created
522 from a record unit. SSL supports the following:</p>
525 <li>No digest (Null choice)</li>
526 <li>MD5, a 128-bit hash</li>
527 <li>Secure Hash Algorithm (SHA-1), a 160-bit hash</li>
530 <p>The message digest is used to create a Message Authentication Code
531 (MAC) which is encrypted with the message to provide integrity and to
532 prevent against replay attacks.</p>
535 <h3><a name="handshake" id="handshake">Handshake Sequence Protocol</a></h3>
537 <p>The handshake sequence uses three protocols:</p>
540 <li>The <dfn>SSL Handshake Protocol</dfn>
541 for performing the client and server SSL session establishment.</li>
542 <li>The <dfn>SSL Change Cipher Spec Protocol</dfn> for actually
543 establishing agreement on the Cipher Suite for the session.</li>
544 <li>The <dfn>SSL Alert Protocol</dfn> for conveying SSL error
545 messages between client and server.</li>
548 <p>These protocols, as well as application protocol data, are
549 encapsulated in the <dfn>SSL Record Protocol</dfn>, as shown in
550 <a href="#figure2">Figure 2</a>. An encapsulated protocol is
551 transferred as data by the lower layer protocol, which does not
552 examine the data. The encapsulated protocol has no knowledge of the
553 underlying protocol.</p>
556 <img src="../images/ssl_intro_fig2.gif" alt="" width="428" height="217" /><br />
557 <a id="figure2" name="figure2"><dfn>Figure 2</dfn></a>: SSL Protocol Stack
560 <p>The encapsulation of SSL control protocols by the record protocol
561 means that if an active session is renegotiated the control protocols
562 will be transmitted securely. If there were no session before, then
563 the Null cipher suite is used, which means there is no encryption and
564 messages have no integrity digests until the session has been
568 <h3><a name="datatransfer" id="datatransfer">Data Transfer</a></h3>
570 <p>The SSL Record Protocol, shown in <a href="#figure3">Figure 3</a>,
571 is used to transfer application and SSL Control data between the
572 client and server, possibly fragmenting this data into smaller units,
573 or combining multiple higher level protocol data messages into single
574 units. It may compress, attach digest signatures, and encrypt these
575 units before transmitting them using the underlying reliable transport
576 protocol (Note: currently all major SSL implementations lack support
577 for compression).</p>
580 <img src="../images/ssl_intro_fig3.gif" alt="" width="423" height="323" /><br />
581 <a id="figure3" name="figure3"><dfn>Figure 3</dfn></a>: SSL Record Protocol
585 <h3><a name="securehttp" id="securehttp">Securing HTTP Communication</a></h3>
587 <p>One common use of SSL is to secure Web HTTP communication between
588 a browser and a webserver. This case does not preclude the use of
589 non-secured HTTP. The secure version is mainly plain HTTP over SSL
590 (named HTTPS), but with one major difference: it uses the URL scheme
591 <code>https</code> rather than <code>http</code> and a different
592 server port (by default 443). This mainly is what <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> provides to you for the Apache webserver...</p>
594 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
595 <div class="section">
596 <h2><a name="references" id="references">References</a></h2>
599 <dt><a id="AC96" name="AC96">[AC96]</a></dt>
600 <dd>Bruce Schneier, <q>Applied Cryptography</q>, 2nd Edition, Wiley,
601 1996. See <a href="http://www.counterpane.com/">http://www.counterpane.com/</a> for various other materials by Bruce
604 <dt><a id="X208" name="X208">[X208]</a></dt>
605 <dd>ITU-T Recommendation X.208, <q>Specification of Abstract Syntax Notation
606 One (ASN.1)</q>, 1988. See for instance <a href="http://www.itu.int/rec/recommendation.asp?type=items&lang=e&parent=T-REC-X.208-198811-I">http://www.itu.int/rec/recommendation.asp?type=items&lang=e&parent=T-REC-X.208-198811-I</a>.
609 <dt><a id="X509" name="X509">[X509]</a></dt>
610 <dd>ITU-T Recommendation X.509, <q>The Directory - Authentication
611 Framework</q>. See for instance <a href="http://www.itu.int/rec/recommendation.asp?type=folders&lang=e&parent=T-REC-X.509">http://www.itu.int/rec/recommendation.asp?type=folders&lang=e&parent=T-REC-X.509</a>.
614 <dt><a id="PKCS" name="PKCS">[PKCS]</a></dt>
615 <dd><q>Public Key Cryptography Standards (PKCS)</q>,
616 RSA Laboratories Technical Notes, See <a href="http://www.rsasecurity.com/rsalabs/pkcs/">http://www.rsasecurity.com/rsalabs/pkcs/</a>.</dd>
618 <dt><a id="MIME" name="MIME">[MIME]</a></dt>
619 <dd>N. Freed, N. Borenstein, <q>Multipurpose Internet Mail Extensions
620 (MIME) Part One: Format of Internet Message Bodies</q>, RFC2045.
621 See for instance <a href="http://ietf.org/rfc/rfc2045.txt">http://ietf.org/rfc/rfc2045.txt</a>.</dd>
623 <dt><a id="SSL2" name="SSL2">[SSL2]</a></dt>
624 <dd>Kipp E.B. Hickman, <q>The SSL Protocol</q>, 1995. See <a href="http://www.netscape.com/eng/security/SSL_2.html">http://www.netscape.com/eng/security/SSL_2.html</a>.</dd>
626 <dt><a id="SSL3" name="SSL3">[SSL3]</a></dt>
627 <dd>Alan O. Freier, Philip Karlton, Paul C. Kocher, <q>The SSL Protocol
628 Version 3.0</q>, 1996. See <a href="http://www.netscape.com/eng/ssl3/draft302.txt">http://www.netscape.com/eng/ssl3/draft302.txt</a>.</dd>
630 <dt><a id="TLS1" name="TLS1">[TLS1]</a></dt>
631 <dd>Tim Dierks, Christopher Allen, <q>The TLS Protocol Version 1.0</q>,
632 1999. See <a href="http://ietf.org/rfc/rfc2246.txt">http://ietf.org/rfc/rfc2246.txt</a>.</dd>
635 <div class="bottomlang">
636 <p><span>Available Languages: </span><a href="../en/ssl/ssl_intro.html" title="English"> en </a> |
637 <a href="../ja/ssl/ssl_intro.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a></p>
638 </div><div id="footer">
639 <p class="apache">Copyright 2009 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
640 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div>
Code Review / bottlenecks.git / blob