TLS Encryption and Decryption WHAT EVERY IT ENGINEER

  • Slides: 98
Download presentation
TLS Encryption and Decryption WHAT EVERY IT ENGINEER SHOULD KNOW ABOUT TLS Ross Bagurdes

TLS Encryption and Decryption WHAT EVERY IT ENGINEER SHOULD KNOW ABOUT TLS Ross Bagurdes DATA NETWORK ENGINEER @bagurdes #sf 19 us • UC Berkeley • June 8 -13

https: //www. pluralsight. com

https: //www. pluralsight. com

Goals • • • A Brief History Encrypting Data Key Exchange Data Encryption Protocols

Goals • • • A Brief History Encrypting Data Key Exchange Data Encryption Protocols TLS 1. 2 and 1. 3 Handshakes Decrypting TLS in Wireshark #sf 19 us • UC Berkeley • June 8 -13

The public key encrypts the data. The private key decrypts the data. #sf 19

The public key encrypts the data. The private key decrypts the data. #sf 19 us • UC Berkeley • June 8 -13

Web Browser Encryption #sf 19 us • UC Berkeley • June 8 -13

Web Browser Encryption #sf 19 us • UC Berkeley • June 8 -13

Web Browser Encryption Negotiate Encryption Session Encryption Protocols #sf 19 us • UC Berkeley

Web Browser Encryption Negotiate Encryption Session Encryption Protocols #sf 19 us • UC Berkeley • June 8 -13

Web Browser Encryption Negotiate Encryption Session Secure Socket Layer (SSL) Transport Layer Security (TLS)

Web Browser Encryption Negotiate Encryption Session Secure Socket Layer (SSL) Transport Layer Security (TLS) Encryption Protocols #sf 19 us • UC Berkeley • June 8 -13

Web Browser Encryption Negotiate Encryption Session Secure Socket Layer (SSL) Transport Layer Security (TLS)

Web Browser Encryption Negotiate Encryption Session Secure Socket Layer (SSL) Transport Layer Security (TLS) Encryption Protocols RSA Diffie Hellman ECDHE 3 DES AES Cha 20 #sf 19 us • UC Berkeley • June 8 -13

SSL/TLS Version History 1994 1999 SSLv 2 TLSv 1. 0 RFC 2246 Netscape Navigator

SSL/TLS Version History 1994 1999 SSLv 2 TLSv 1. 0 RFC 2246 Netscape Navigator 1995 TLSv 1. 3 TLSv 1. 2 RFC 5246 2006 SSLv 3 resolved serious v 2 issues 2018 2008 TLSv 1. 1 RFC 4346 #sf 19 us • UC Berkeley • June 8 -13 Prop. Standard v 1. 3 2013 Microsoft/Apple TLS Enable support for v 1. 2 TLSv 1. 2

SSL/TLS Versions TLS v 1. 2 TLS v 1. 3 #sf 19 us •

SSL/TLS Versions TLS v 1. 2 TLS v 1. 3 #sf 19 us • UC Berkeley • June 8 -13

Data Encryption Basics #sf 19 us • UC Berkeley • June 8 -13

Data Encryption Basics #sf 19 us • UC Berkeley • June 8 -13

Encrypting Communication HTTPs Client HTTPs Server #sf 19 us • UC Berkeley • June

Encrypting Communication HTTPs Client HTTPs Server #sf 19 us • UC Berkeley • June 8 -13

Encrypting Communication HTTPs Client HTTPs Server + #sf 19 us • UC Berkeley •

Encrypting Communication HTTPs Client HTTPs Server + #sf 19 us • UC Berkeley • June 8 -13

Encrypting Communication HTTPs Client HTTPs Server + #sf 19 us • UC Berkeley •

Encrypting Communication HTTPs Client HTTPs Server + #sf 19 us • UC Berkeley • June 8 -13

Encrypting Communication HTTPs Client HTTPs Server + #sf 19 us • UC Berkeley •

Encrypting Communication HTTPs Client HTTPs Server + #sf 19 us • UC Berkeley • June 8 -13

Encrypting Communication HTTPs Client HTTPs Server #sf 19 us • UC Berkeley • June

Encrypting Communication HTTPs Client HTTPs Server #sf 19 us • UC Berkeley • June 8 -13

Encrypting Communication HTTPs Client HTTPs Server #sf 19 us • UC Berkeley • June

Encrypting Communication HTTPs Client HTTPs Server #sf 19 us • UC Berkeley • June 8 -13

Encrypting Communication HTTPs Client HTTPs Server + #sf 19 us • UC Berkeley •

Encrypting Communication HTTPs Client HTTPs Server + #sf 19 us • UC Berkeley • June 8 -13

Encrypting Communication HTTPs Client HTTPs Server + #sf 19 us • UC Berkeley •

Encrypting Communication HTTPs Client HTTPs Server + #sf 19 us • UC Berkeley • June 8 -13

Encrypting Communication HTTPs Client HTTPs Server + #sf 19 us • UC Berkeley •

Encrypting Communication HTTPs Client HTTPs Server + #sf 19 us • UC Berkeley • June 8 -13

Encrypting Communication HTTPs Client HTTPs Server #sf 19 us • UC Berkeley • June

Encrypting Communication HTTPs Client HTTPs Server #sf 19 us • UC Berkeley • June 8 -13

Encrypting Communication HTTPs Client HTTPs Server #sf 19 us • UC Berkeley • June

Encrypting Communication HTTPs Client HTTPs Server #sf 19 us • UC Berkeley • June 8 -13

TLS Encryption Data Encryption #sf 19 us • UC Berkeley • June 8 -13

TLS Encryption Data Encryption #sf 19 us • UC Berkeley • June 8 -13

TLS Encryption Key Exchange Data Encryption #sf 19 us • UC Berkeley • June

TLS Encryption Key Exchange Data Encryption #sf 19 us • UC Berkeley • June 8 -13

Diffie-Hellman Key Exchange HTTPs Client HTTPs Server

Diffie-Hellman Key Exchange HTTPs Client HTTPs Server

Diffie-Hellman Key Exchange HTTPs Client HTTPs Server

Diffie-Hellman Key Exchange HTTPs Client HTTPs Server

Diffie-Hellman Key Exchange HTTPs Client HTTPs Server p = 149 g = 17

Diffie-Hellman Key Exchange HTTPs Client HTTPs Server p = 149 g = 17

Diffie-Hellman Key Exchange HTTPs Client p = 149 g = 17 HTTPs Server

Diffie-Hellman Key Exchange HTTPs Client p = 149 g = 17 HTTPs Server

Diffie-Hellman Key Exchange HTTPs Client p = 149 g = 17 Public Key HTTPs

Diffie-Hellman Key Exchange HTTPs Client p = 149 g = 17 Public Key HTTPs Server

Diffie-Hellman Key Exchange HTTPs Client a=8 Private Key p = 149 g = 17

Diffie-Hellman Key Exchange HTTPs Client a=8 Private Key p = 149 g = 17 HTTPs Server

Diffie-Hellman Key Exchange HTTPs Client a=8 Private Key p = 149 g = 17

Diffie-Hellman Key Exchange HTTPs Client a=8 Private Key p = 149 g = 17 HTTPs Server ga MOD p = encrypted key

Quick Math Lesson #sf 19 us • UC Berkeley • June 8 -13

Quick Math Lesson #sf 19 us • UC Berkeley • June 8 -13

95/8 #sf 19 us • UC Berkeley • June 8 -13

95/8 #sf 19 us • UC Berkeley • June 8 -13

95/8 “ 95 divided by 8” #sf 19 us • UC Berkeley • June

95/8 “ 95 divided by 8” #sf 19 us • UC Berkeley • June 8 -13

95/8 “ 95 divided by 8” 8 95 #sf 19 us • UC Berkeley

95/8 “ 95 divided by 8” 8 95 #sf 19 us • UC Berkeley • June 8 -13

8 95 #sf 19 us • UC Berkeley • June 8 -13

8 95 #sf 19 us • UC Berkeley • June 8 -13

1 8 95 #sf 19 us • UC Berkeley • June 8 -13

1 8 95 #sf 19 us • UC Berkeley • June 8 -13

1 8 95 8 #sf 19 us • UC Berkeley • June 8 -13

1 8 95 8 #sf 19 us • UC Berkeley • June 8 -13

1 8 95 8 15 #sf 19 us • UC Berkeley • June 8

1 8 95 8 15 #sf 19 us • UC Berkeley • June 8 -13

11 8 95 8 15 #sf 19 us • UC Berkeley • June 8

11 8 95 8 15 #sf 19 us • UC Berkeley • June 8 -13

11 8 95 8 15 8 #sf 19 us • UC Berkeley • June

11 8 95 8 15 8 #sf 19 us • UC Berkeley • June 8 -13

11 8 95 8 15 8 7 #sf 19 us • UC Berkeley •

11 8 95 8 15 8 7 #sf 19 us • UC Berkeley • June 8 -13

1 1. #### 8 95 8 15 8 7 #sf 19 us • UC

1 1. #### 8 95 8 15 8 7 #sf 19 us • UC Berkeley • June 8 -13

11 R 7 8 95 8 15 8 7 #sf 19 us • UC

11 R 7 8 95 8 15 8 7 #sf 19 us • UC Berkeley • June 8 -13

Modulus R 7 #sf 19 us • UC Berkeley • June 8 -13

Modulus R 7 #sf 19 us • UC Berkeley • June 8 -13

Modulus 7 #sf 19 us • UC Berkeley • June 8 -13

Modulus 7 #sf 19 us • UC Berkeley • June 8 -13

Diffie-Hellman Key Exchange HTTPs Client a=8 Private Key p = 149 g = 17

Diffie-Hellman Key Exchange HTTPs Client a=8 Private Key p = 149 g = 17 HTTPs Server ga MOD p = encrypted key

Diffie-Hellman Key Exchange HTTPs Client a=8 Private Key p = 149 g = 17

Diffie-Hellman Key Exchange HTTPs Client a=8 Private Key p = 149 g = 17 HTTPs Server ga MOD p = encrypted key 178 MOD 149 = 5

Diffie-Hellman Key Exchange p = 149 g = 17 HTTPs Client a=8 Private Key

Diffie-Hellman Key Exchange p = 149 g = 17 HTTPs Client a=8 Private Key 5 HTTPs Server

Diffie-Hellman Key Exchange HTTPs Client a=8 Private Key p = 149 g = 17

Diffie-Hellman Key Exchange HTTPs Client a=8 Private Key p = 149 g = 17 HTTPs Server 5

Diffie-Hellman Key Exchange a=8 Private Key HTTPs Client p = 149 g = 17

Diffie-Hellman Key Exchange a=8 Private Key HTTPs Client p = 149 g = 17 HTTPs Server 5

Diffie-Hellman Key Exchange a=8 5 Private Key Encrypted Key HTTPs Client p = 149

Diffie-Hellman Key Exchange a=8 5 Private Key Encrypted Key HTTPs Client p = 149 g = 17 HTTPs Server b=6 Private Key

Diffie-Hellman Key Exchange a=8 5 Private Key Encrypted Key HTTPs Client p = 149

Diffie-Hellman Key Exchange a=8 5 Private Key Encrypted Key HTTPs Client p = 149 g = 17 gb MOD p = encrypted key HTTPs Server b=6 Private Key

Diffie-Hellman Key Exchange a=8 5 Private Key Encrypted Key HTTPs Client p = 149

Diffie-Hellman Key Exchange a=8 5 Private Key Encrypted Key HTTPs Client p = 149 g = 17 gb MOD p = encrypted key 176 MOD 149 = 16 HTTPs Server b=6 Private Key

Diffie-Hellman Key Exchange a=8 5 Private Key Encrypted Key HTTPs Client p = 149

Diffie-Hellman Key Exchange a=8 5 Private Key Encrypted Key HTTPs Client p = 149 g = 17 HTTPs Server 16 b=6 Private Key

Diffie-Hellman Key Exchange a=8 5 Private Key Encrypted Key HTTPs Client p = 149

Diffie-Hellman Key Exchange a=8 5 Private Key Encrypted Key HTTPs Client p = 149 g = 17 HTTPs Server 16 b=6 Encrypted Key Private Key

Diffie-Hellman Key Exchange HTTPs Client p = 149 g = 17 HTTPs Server a=8

Diffie-Hellman Key Exchange HTTPs Client p = 149 g = 17 HTTPs Server a=8 16 5 b=6 Private Key Encrypted Key Private Key

HTTPs Client p = 149 g = 17 HTTPs Server a=8 16 5 b=6

HTTPs Client p = 149 g = 17 HTTPs Server a=8 16 5 b=6 Private Key Encrypted Key Private Key (enc key)a MOD p = key (enc key)b MOD p = key

HTTPs Client p = 149 g = 17 HTTPs Server a=8 16 5 b=6

HTTPs Client p = 149 g = 17 HTTPs Server a=8 16 5 b=6 Private Key Encrypted Key Private Key (enc key)a MOD p = key 168 MOD 149 = 129 (enc key)b MOD p = key

HTTPs Client p = 149 g = 17 HTTPs Server a=8 16 5 b=6

HTTPs Client p = 149 g = 17 HTTPs Server a=8 16 5 b=6 Private Key Encrypted Key Private Key (enc key)a MOD p = key 168 MOD 149 = 129 (enc key)b MOD p = key 56 MOD 149 = 129

HTTPs Client p = 149 g = 17 HTTPs Server a=8 16 5 b=6

HTTPs Client p = 149 g = 17 HTTPs Server a=8 16 5 b=6 Private Key Encrypted Key Private Key 129 Key

Diffie-Hellman Key Exchange HTTPs Client 129 HTTPs Server 129

Diffie-Hellman Key Exchange HTTPs Client 129 HTTPs Server 129

TLS Encryption Key Exchange Data Encryption #sf 19 us • UC Berkeley • June

TLS Encryption Key Exchange Data Encryption #sf 19 us • UC Berkeley • June 8 -13

TLS Encryption Key Exchange #sf 19 us • UC Berkeley • June 8 -13

TLS Encryption Key Exchange #sf 19 us • UC Berkeley • June 8 -13

TLS Encryption TLS v 1. 3 TLS v 1. 2 Key Exchange #sf 19

TLS Encryption TLS v 1. 3 TLS v 1. 2 Key Exchange #sf 19 us • UC Berkeley • June 8 -13

TLS Encryption TLS v 1. 3 TLS v 1. 2 RSA Key Exchange Diffie

TLS Encryption TLS v 1. 3 TLS v 1. 2 RSA Key Exchange Diffie Hellman Elliptical Curve Diffie Hellman #sf 19 us • UC Berkeley • June 8 -13

TLS Encryption TLS v 1. 3 TLS v 1. 2 RSA Key Exchange Diffie

TLS Encryption TLS v 1. 3 TLS v 1. 2 RSA Key Exchange Diffie Hellman Elliptical Curve Diffie Hellman #sf 19 us • UC Berkeley • June 8 -13

TLS Encryption TLS v 1. 3 TLS v 1. 2 RSA Key Exchange Diffie

TLS Encryption TLS v 1. 3 TLS v 1. 2 RSA Key Exchange Diffie Hellman Elliptical Curve Diffie Hellman #sf 19 us • UC Berkeley • June 8 -13

Elliptical Curve Diffie-Hellman Ephemeral #sf 19 us • UC Berkeley • June 8 -13

Elliptical Curve Diffie-Hellman Ephemeral #sf 19 us • UC Berkeley • June 8 -13

Elliptical Curve

Elliptical Curve

Elliptical Curve Types x 25519 secp 256 r 1 secp 284 r 1 fecp

Elliptical Curve Types x 25519 secp 256 r 1 secp 284 r 1 fecp 521 r 1 ffdhe 2048 ffdhe 3073

Elliptical Curve

Elliptical Curve

TLS 1. 3 DHECE Key Exchange HTTPs Client HTTPs Server

TLS 1. 3 DHECE Key Exchange HTTPs Client HTTPs Server

TLS 1. 3 DHECE Key Exchange Enc. Key HTTPs Client HTTPs Server

TLS 1. 3 DHECE Key Exchange Enc. Key HTTPs Client HTTPs Server

TLS 1. 3 DHECE Key Exchange Private Key + Enc. Key HTTPs Client HTTPs

TLS 1. 3 DHECE Key Exchange Private Key + Enc. Key HTTPs Client HTTPs Server

TLS 1. 3 DHECE Key Exchange Private Key + Enc. Key HTTPs Client Enc.

TLS 1. 3 DHECE Key Exchange Private Key + Enc. Key HTTPs Client Enc. Key HTTPs Server

TLS 1. 3 DHECE Key Exchange Private Key Enc. Key HTTPs Client Enc. Key

TLS 1. 3 DHECE Key Exchange Private Key Enc. Key HTTPs Client Enc. Key HTTPs Server

TLS 1. 3 DHECE Key Exchange Private Key Enc. Key HTTPs Client HTTPs Server

TLS 1. 3 DHECE Key Exchange Private Key Enc. Key HTTPs Client HTTPs Server Enc. Key

TLS 1. 3 DHECE Key Exchange Enc. Key Private Key Enc. Key HTTPs Client

TLS 1. 3 DHECE Key Exchange Enc. Key Private Key Enc. Key HTTPs Client HTTPs Server

TLS 1. 3 DHECE Key Exchange Enc. Key Private Key + Private Key Enc.

TLS 1. 3 DHECE Key Exchange Enc. Key Private Key + Private Key Enc. Key HTTPs Client HTTPs Server

TLS 1. 3 DHECE Key Exchange Enc. Key Private Key + Private Key HTTPs

TLS 1. 3 DHECE Key Exchange Enc. Key Private Key + Private Key HTTPs Client HTTPs Server Enc. Key

TLS 1. 3 DHECE Key Exchange Enc. Key Private Key HTTPs Client HTTPs Server

TLS 1. 3 DHECE Key Exchange Enc. Key Private Key HTTPs Client HTTPs Server Enc. Key

TLS 1. 3 DHECE Key Exchange Enc. Key Private Key HTTPs Client Enc. Key

TLS 1. 3 DHECE Key Exchange Enc. Key Private Key HTTPs Client Enc. Key HTTPs Server

TLS 1. 3 DHECE Key Exchange Private Key + + Enc. Key HTTPs Client

TLS 1. 3 DHECE Key Exchange Private Key + + Enc. Key HTTPs Client HTTPs Server

TLS 1. 3 DHECE Key Exchange Private Key + + Enc. Key HTTPs Client

TLS 1. 3 DHECE Key Exchange Private Key + + Enc. Key HTTPs Client HTTPs Server

TLS 1. 3 DHECE Key Exchange Private Key + + Enc. Key HTTPs Client

TLS 1. 3 DHECE Key Exchange Private Key + + Enc. Key HTTPs Client HTTPs Server

TLS Encryption Key Exchange Data Encryption #sf 19 us • UC Berkeley • June

TLS Encryption Key Exchange Data Encryption #sf 19 us • UC Berkeley • June 8 -13

Data Encryption Protocols Ciphers • 3 DES (168 bits) • AES (128 or 256

Data Encryption Protocols Ciphers • 3 DES (168 bits) • AES (128 or 256 bits) • GCM • CBC • Chacha 20 • Poly 1305 #sf 19 us • UC Berkeley • June 8 -13

TLS Encryption Key Exchange Data Encryption #sf 19 us • UC Berkeley • June

TLS Encryption Key Exchange Data Encryption #sf 19 us • UC Berkeley • June 8 -13

TLS Encryption Key Exchange Data Encryption Handshake Integrity #sf 19 us • UC Berkeley

TLS Encryption Key Exchange Data Encryption Handshake Integrity #sf 19 us • UC Berkeley • June 8 -13

Handshake Integrity • SHA-256 • SHA-384 #sf 19 us • UC Berkeley • June

Handshake Integrity • SHA-256 • SHA-384 #sf 19 us • UC Berkeley • June 8 -13

TLS Encryption Key Exchange Data Encryption Handshake Integrity #sf 19 us • UC Berkeley

TLS Encryption Key Exchange Data Encryption Handshake Integrity #sf 19 us • UC Berkeley • June 8 -13

TLS Encryption Key Exchange Data Handshake Server Authenticity Integrity Encryption #sf 19 us •

TLS Encryption Key Exchange Data Handshake Server Authenticity Integrity Encryption #sf 19 us • UC Berkeley • June 8 -13

Certificates #sf 19 us • UC Berkeley • June 8 -13

Certificates #sf 19 us • UC Berkeley • June 8 -13

Server Certificates • RSA Encryption • Public Key (DH) • p and g •

Server Certificates • RSA Encryption • Public Key (DH) • p and g • Verification information • Certificate Chain • ”Signed” certificates #sf 19 us • UC Berkeley • June 8 -13

TLS Handshake #sf 19 us • UC Berkeley • June 8 -13

TLS Handshake #sf 19 us • UC Berkeley • June 8 -13

#sf 19 us • UC Berkeley • June 8 -13

#sf 19 us • UC Berkeley • June 8 -13

Goals • • • A Brief History Encrypting Data Key Exchange Data Encryption Protocols

Goals • • • A Brief History Encrypting Data Key Exchange Data Encryption Protocols TLS 1. 2 and 1. 3 Handshakes Decrypting TLS in Wireshark #sf 19 us • UC Berkeley • June 8 -13