UNIT10 Web Security Prof R K Karangiya rekha
UNIT-10 Web Security Prof. R. K. Karangiya rekha. karangiya@darshan. ac. in Information & Network Security (2170709) Darshan Institute of Engineering & Technology
Outline § Web Security threats and approaches § SSL architecture § SSL Protocol § Transport layer security § HTTPS § SSH INS is very Interesting Subject Unit-10: Web Security 2 Darshan Institute of Engineering & Technology
Web Security Issues § Original Internet protocols do not have built-in security (IP, TCP, HTTP). § Many threats arise for web and other Internet applications. § Issues at: client, server and traffic between client and server. § Cover: SSL/TLS, SSH, IPsec. INS is very Interesting Subject Unit-10: Web Security 3 Darshan Institute of Engineering & Technology
Relative Location of Security Facilities in the TCP/IP Protocol Stack HTTP FTP SMTP HTTP FTP S/MIME SMTP TCP SSL or TLS Kerberos IP/IPSec TCP UCP (a) Network Level IP SMTP HTTP TCP IP (b) Transport Level (c) Application Level § IPsec: • Security for IP datagrams. • General solution for all Internet traffic. • Implemented in OS. § SSL/TLS: • Security for TCP segments. • General solution for all TCP-based applications. • Implemented in libraries/applications (e. g. Open. SSL). § Application-specific: • Security for application messages. • Specific to each applications. INS is very Interesting Subject • Implemented in single application. Unit-10: Web Security 4 Darshan Institute of Engineering & Technology
Secure Socket Layer (SSL) § Secure Socket Layer (SSL) provides security services between TCP and applications that use TCP. The Internet standard version is called Transport Layer Service (TLS). § SSL/TLS provides confidentiality using symmetric encryption and message integrity using a message authentication code. § SSL/TLS includes protocol mechanisms to enable two TCP users to determine the security mechanisms and services they will use. § SSL is designed to make use of TCP to provide a reliable end-toend secure service. INS is very Interesting Subject Unit-10: Web Security 5 Darshan Institute of Engineering & Technology
Secure Socket Layer (SSL) Architecture INS is very Interesting Subject Unit-10: Web Security 6 Darshan Institute of Engineering & Technology
Four SSL Protocols Application layer Handshake Protocol Change. Cipher. Spec Protocol Alert Protocol SSL Record Protocol Transport layer § § Record: Provides confidentiality and message integrity. Handshake: Authenticate entities, negotiate parameter values. Change Cipher: Change cipher for use in connection. Alert: Alert peer entity of status/warning/error. INS is very Interesting Subject Unit-10: Web Security 7 Darshan Institute of Engineering & Technology
SSL Record Protocol § It provides two services for SSL connections. § Confidentiality: The Handshake Protocol defines a shared secret key that is used for conventional encryption of SSL payloads. § Message Integrity: The Handshake Protocol also defines a shared secret key that is used to form a message authentication code (MAC). INS is very Interesting Subject Unit-10: Web Security 8 Darshan Institute of Engineering & Technology
SSL Record Protocol Application Data Fragment Compress Add MAC Encrypt Append SSL Record header Transmits the resulting unit in a TCP § Application SSL MAC: Fragmentation: record HMAC header: Data: applied The Itcompressed on data includes client compressed will sends be Content divided a segment. HTTP data. type, into GET Version smaller request and fragmets. to. Compressed the server Compression: Lossless. Encrypt: Applied to. The fragment and MAC. to length Maximum retrieve in bytes. the fragment webpage/data. size is 16384 Bytes. INS is very Interesting Subject Unit-10: Web Security 9 Darshan Institute of Engineering & Technology
SSL Record Protocol – Cont… § The Record Protocol takes an application message to be transmitted, fragments the data into manageable blocks, optionally compresses the data, applies a MAC, encrypts, adds a header, and transmits the resulting unit in a TCP segment. § Received data are decrypted, verified, decompressed, and reassembled before being delivered to higher-level users. INS is very Interesting Subject Unit-10: Web Security 10 Darshan Institute of Engineering & Technology
Change Cipher Spec Protocol § The Change Cipher Spec Protocol is one of the three SSL-specific protocols that use the SSL Record Protocol, and it is the simplest one. § This protocol consists of a single message which consists of a single byte with the value 1. § The sole purpose of this message is to cause the pending state to be copied into the current state, which updates the cipher suite to be used on this connection. 1 byte 1 Change Cipher Spec Protocol INS is very Interesting Subject Unit-10: Web Security 11 Darshan Institute of Engineering & Technology
Change Cipher Spec Protocol – Cont… INS is very Interesting Subject Unit-10: Web Security 12 Darshan Institute of Engineering & Technology
Alert Protocol § The Alert Protocol is used to convey SSL-related alerts to the peer entity. As with other applications that use SSL, alert messages are compressed and encrypted, as specified by the current state. INS is very Interesting Subject Unit-10: Web Security 13 Darshan Institute of Engineering & Technology
SSL Handshake Protocol § Allow client and server to authenticate each other. § Negotiate encryption and MAC algorithms, exchange keys. • Key Exchange: RSA, Diffie-Hellman • MAC: HMAC using SHA or MD 5 • Encryption: RC 4, RC 2, DES, 3 DES, IDEA, AES § Multiple phases: 1. Establish security capabilities 2. Server authentication and key exchange 3. Client authentication and key exchange 4. Finish setting up connection INS is very Interesting Subject Unit-10: Web Security 14 Darshan Institute of Engineering & Technology
Handshake Protocol INS is very Interesting Subject Unit-10: Web Security 15 Darshan Institute of Engineering & Technology
Handshake Protocol – Phase I INS is very Interesting Subject Unit-10: Web Security 16 Darshan Institute of Engineering & Technology
Handshake Protocol – Phase I After Phase I, the client and server knows the following: § The version of SSL. § The algorithms for key exchange, message authentication, and encryption. § The compression method. § The two random numbers for key generation. INS is very Interesting Subject Unit-10: Web Security 17 Darshan Institute of Engineering & Technology
Handshake Protocol – Phase II INS is very Interesting Subject Unit-10: Web Security 18 Darshan Institute of Engineering & Technology
Handshake Protocol – Phase II After Phase II § The server is authenticated to the client. § The client knows the public key of the server if required. INS is very Interesting Subject Unit-10: Web Security 19 Darshan Institute of Engineering & Technology
Handshake Protocol – Phase III INS is very Interesting Subject Unit-10: Web Security 20 Darshan Institute of Engineering & Technology
Handshake Protocol – Phase IV INS is very Interesting Subject Unit-10: Web Security 21 Darshan Institute of Engineering & Technology
SSL Handshake Protocol Phases
HTTPS (HTTP over SSL) § HTTPS (HTTP over SSL) refers to the combination of HTTP and SSL to implement secure communication between a Web browser and a Web server. § When HTTPS is used, the following elements of the communication are encrypted: 1. URL of the requested document. 2. Contents of the document. 3. Contents of browser forms (filled in by browser user). 4. Cookies sent from browser to server and from server to browser. 5. Contents of HTTP header. INS is very Interesting Subject Unit-10: Web Security 23 Darshan Institute of Engineering & Technology
SSH (Secure Shell) § Secure Shell (SSH) is a protocol for secure network communications designed to be relatively simple and inexpensive to implement. § The initial version, SSH 1 was focused on providing a secure remote logon facility to replace TELNET and other remote logon schemes that provided no security. INS is very Interesting Subject Unit-10: Web Security 24 Darshan Institute of Engineering & Technology
SSH (Secure Shell) – Cont… INS is very Interesting Subject Unit-10: Web Security 25 Darshan Institute of Engineering & Technology
- Slides: 26