Transport Layer Security
From Wikipedia, the free encyclopedia
The five layer TCP/IP model |
5. Application layer |
DHCP • DNS • FTP • HTTP • IMAP4 • IRC • NNTP • XMPP • MIME • POP3 • SIP • SMTP • SNMP • SSH • TELNET • BGP • RPC • RTP • RTCP • TLS/SSL • SDP • SOAP • L2TP • PPTP • … |
4. Transport layer |
3. Network layer |
2. Data link layer |
ATM • DTM • Ethernet • FDDI • Frame Relay • GPRS • PPP • ARP • RARP • … |
1. Physical layer |
Ethernet physical layer • ISDN • Modems • PLC • SONET/SDH • G.709 • Wi-Fi • … |
Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are cryptographic protocols which provide secure communications on the Internet for such things as web browsing, e-mail, Internet faxing, instant messaging and other data transfers. There are slight differences between SSL 3.0 and TLS 1.0, but the protocol remains substantially the same. The term "TLS" as used here applies to both protocols unless clarified by context.
Contents |
[edit] Description
The TLS protocol(s) allow applications to communicate across a network in a way designed to prevent eavesdropping, tampering, and message forgery. TLS provides endpoint authentication and communications privacy over the Internet using cryptography. Typically, only the server is authenticated (i.e., its identity is ensured) while the client remains unauthenticated; this means that the end user (be that a person, or an application such as a web browser), can be sure with whom they are "talking". The next level of security—in which both ends of the "conversation" are sure with whom they are "talking"—is known as mutual authentication. Mutual authentication requires public key infrastructure (PKI) deployment to clients.
TLS involves three basic phases:
- Peer negotiation for algorithm support
- Public key encryption -based key exchange and certificate-based authentication
- Symmetric cipher -based traffic encryption
During the first phase, the client and server negotiation uses cryptographic algorithms. Current implementations support the following choices:
- for public-key cryptography: RSA, Diffie-Hellman, DSA ;
- for symmetric ciphers: RC2, RC4, IDEA, DES, Triple DES, AES or Camellia;
- for one-way hash functions: MD2, MD4, MD5 or SHA.
[edit] How it works
The TLS protocol exchanges records; each record can be optionally compressed, encrypted and packed with a message authentication code (MAC). Each record has a content_type field that specifies which upper level protocol is being used.
When the connection starts, the record level encapsulates another protocol, the handshake protocol, which has content_type 22.
The client sends and receives several handshake structures:
- It sends a ClientHello message specifying the list of cipher suites, compression methods and the highest protocol version it supports. It also sends random bytes which will be used later.
- Then it receives a ServerHello, in which the server chooses the connection parameters from the choices offered by the client earlier.
- When the connection parameters are known, the client and server exchange certificates (depending on the selected public key cipher). These certificates are currently X.509, but there is also a draft specifying the use of OpenPGP based certificates.
- The server can request a certificate from the client, so that the connection can be mutually authenticated.
- The client and server negotiate a common secret called the "master secret", possibly using the result of a Diffie-Hellman exchange, or simply encrypting a secret with a public key that is decrypted with the peer's private key. All other key data is derived from this "master secret" (and the client- and server-generated random values), which is passed through a carefully designed "pseudorandom function".
Given the above recount of a TLS/SSL connection process, one may have trouble envisioning a typical browser session. To elaborate upon this and to give ordinary insight to a typical TLS/SSL connection we can use what is commonly referred to as the SSL six step process. SSL establishes a stateful connection negotiated by a handshaking procedure between client and server as previously mentioned. During this handshake, the client and server exchange specifications for the cipher that will be used for that session.
- The handshake begins when a browser connects to a TLS/SSL-enabled server and requests that the server send back its identification.
- The server sends back its identification in the secured form of a digital certificate. The certificate will contain (usually all of these variables, but dependent on the X.509 standard used) the server name, the trusted certifying authority (CA), and the server public encryption key.
The browser can/will contact the server of the trusted CA and confirm that the certificate is authentic before proceeding. The browser then presents a list of encryption algorithms and hashing functions (used to generate a number from another).
- From this list the server picks the strongest encryption that it also supports and notifies the client of the decision.
In order to generate the session keys used for the secure connection, the browser uses the server public key from the certificate to encrypt a random number and send it to the server.
- The client can encrypt this data, but only the server can decrypt it (with its private key): this is the one fact that makes the keys hidden from third parties, since only the server and the client have access to this data.
- The server replies with more random data (which doesn't have to be encrypted), and following this:
- Both parties use the selected hash functions on the random data to generate the session keys.
This concludes the handshake and begins the secured connection, which is encrypted and decrypted with the session keys for the remainder.
If any one of the steps in previous mention fails, the TLS/SSL handshake fails, and the connection is not created.
TLS/SSL have a variety of security measures:
- The client uses the CA's public key to validate the CA's digital signature on the server certificate. If the digital signature can be verified, the client accepts the server certificate as a valid certificate issued by a trusted CA.
- The client verifies that the issuing Certificate Authority (CA) is on its list of trusted CAs.
- The client checks the server's certificate validity period. The authentication process stops if the current date and time fall outside of the validity period.
- To protect against Man-in-the-Middle attacks, the client compares the actual DNS name of the server to the DNS name on the certificate.
- Protection against several known attacks (including man in the middle attacks), like those involving a downgrade of the protocol to a previous (less secure) version or a weaker cipher suite.
- Numbering all the records and using the sequence number in the MACs.
- Using a message digest enhanced with a key (so only a key-holder can check the MAC). This is specified in RFC 2104.
- The message that ends the handshake ("Finished") sends a hash of all the exchanged data seen by both parties.
- The pseudorandom function splits the input data in half and processes each one with a different hashing algorithm (MD5 and SHA), then XORs them together. This provides protection if one of these algorithms is found to be vulnerable.
- SSL v3 uses the SHA-1 hashing algorithm and supports certificates for authentication. SHA-1 is considered much safer than the previous MD5 used in SSL v2. Additional improvements in SSL v3 include better handshake protocol flow and increased resistance to man-in-the-middle attacks.
[edit] Applications
TLS runs on layers beneath application protocols such as HTTP, FTP, SMTP, NNTP, and XMPP and above the TCP or UDP transport protocol, which form part of the TCP/IP protocol suite. While it can add security to any protocol that uses reliable connections (such as TCP), it is most commonly used with HTTP to form HTTPS. HTTPS is used to secure World Wide Web pages for applications such as electronic commerce & asset management. SMTP is also an area in which TLS has been growing and is specified in RFC 3207. These applications use public key certificates to verify the identity of endpoints.
An increasing number of client and server products support TLS natively, but many still lack support. As an alternative, users may wish to use standalone TLS products like Stunnel. Wrappers such as Stunnel rely on being able to obtain a TLS connection immediately, by simply connecting to a separate port reserved for the purpose. For example, by default the TCP port for HTTPS is 443, to distinguish it from HTTP on port 80. However, in 1997 the Internet Engineering Task Force recommended that application protocols always start unsecured and instead offer a way to upgrade to TLS - which a pure wrapper like Stunnel cannot cope with.
TLS can also be used to tunnel an entire network stack to create a VPN, as is the case with OpenVPN. Many vendors now marry TLS's encryption and authentication capabilities with authorization. There has also been substantial development since the late 1990s in creating client technology outside of the browser to enable support for client/server applications. When compared against traditional IPSec VPN technologies, TLS has some inherent advantages in firewall and NAT traversal that make it easier to administer for large remote access populations. Vendors like Arkoon, Aventail, F5 Networks, Juniper, and others have been developing in this space for some time.
TLS is also being used increasingly as the standard method for protecting SIP application signaling. TLS can be used to provide authentication and encryption of the SIP signalling associated with VOIP (Voice over IP) and other SIP-based applications. Vendors like Covergence, Linksys, and Microsoft are examples of vendors that provide TLS capabilities for SIP applications .
[edit] History and development
Developed by Netscape, SSL version 3.0 was released in 1996, which later served as the basis for TLS version 1.0, an IETF standard protocol first defined in RFC 2246 in January 1999. Visa, MasterCard, American Express and many leading financial institutions have endorsed SSL for commerce over the Internet.
SSL operates in modular fashion. It is extensible by design, with support for forward and backward compatibility and negotiation between peers.
[edit] Early short keys
Some early implementations of SSL used 40-bit symmetric keys because of US government restrictions on the export of cryptographic technology. The US government explicitly imposed a 40-bit keyspace small enough to be broken by brute-force search by law enforcement agencies wishing to read the encrypted traffic, while still presenting obstacles to less-well-funded attackers. A similar limitation applied to Lotus Notes in export versions. After several years of public controversy, a series of lawsuits, and eventual US government recognition of changes in the market availability of 'better' cryptographic products produced outside the US, the authorities relaxed some aspects of the export restrictions. The 40-bit key size limitation has mostly gone away. Modern implementations use 128-bit (or longer) keys for symmetric key ciphers.
[edit] Incorrect uses
Some websites have been criticized for incorrectly using TLS and therefore negating its security benefits [1]. Such incorrect uses include:
- Only securing the form submission page, while failing to secure the login page [2]
- Displaying a secure page mixed with non-secure media [3]
Both practices have been found present in many commercial websites such as those of Bank of America, Washington Mutual, JPMorgan Chase & Co. [4], and PayPal.
[edit] Standards
The first definition of TLS appeared in RFC 2246: "The TLS Protocol Version 1.0". The current approved version is 1.1, which is specified in RFC 4346: "The Transport Layer Security (TLS) Protocol Version 1.1".
Other RFCs subsequently extended TLS, including:
- RFC 2712: "Addition of Kerberos Cipher Suites to Transport Layer Security (TLS)". The 40-bit ciphersuites defined in this memo appear only for the purpose of documenting the fact that those ciphersuite codes have already been assigned.
- RFC 2817: "Upgrading to TLS Within HTTP/1.1", explains how to use the Upgrade mechanism in HTTP/1.1 to initiate Transport Layer Security (TLS) over an existing TCP connection. This allows unsecured and secured HTTP traffic to share the same well known port (in this case, http: at 80 rather than https: at 443).
- RFC 2818: "HTTP Over TLS", distinguishes secured traffic from insecure traffic by the use of a different 'server port'.
- RFC 3207: "SMTP Service Extension for Secure SMTP over Transport Layer Security". Specifies an extension to the SMTP service that allows an SMTP server and client to use transport-layer security to provide private, authenticated communication over the Internet.
- RFC 3268: "AES Ciphersuites for TLS". Adds Advanced Encryption Standard (AES) ciphersuites to the previously existing symmetric ciphers.
- RFC 3546: "Transport Layer Security (TLS) Extensions", adds a mechanism for negotiating protocol extensions during session initialisation and defines some extensions.
- RFC 4132: "Addition of Camellia Cipher Suites to Transport Layer Security (TLS)".
- RFC 4162: "Addition of SEED Cipher Suites to Transport Layer Security (TLS)".
- RFC 4279: "Pre-Shared Key Ciphersuites for Transport Layer Security (TLS)", adds three sets of new ciphersuites for the TLS protocol to support authentication based on pre-shared keys.
- RFC 4347: "Datagram Transport Layer Security" specifies a TLS variant that works over datagram protocols (such as UDP).
- RFC 4366: "Transport Layer Security (TLS) Extensions" describes both a set of specific extensions, and a generic extension mechanism.
- RFC 4492: "Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS)".
[edit] Implementation
Programmers may use the OpenSSL, NSS, or GnuTLS libraries for SSL/TLS functionality. Microsoft Windows includes an implementation of SSL and TLS as part of its Secure Channel package. Delphi programmers may use a library called Indy, which has ways of connecting components to a TLS intercept using the OpenSSL libraries. This enables the development of secure Web browsers and Web servers using Delphi/Indy/OpenSSL. The protocols supported are SSLv2, SSLv3, and TLS v1.
[edit] TLS 1.1
As noted above, TLS 1.1 is the current approved version of the TLS protocol. TLS 1.1 clarifies some ambiguities and adds a number of recommendations. TLS 1.1 is very similar to TLS 1.0. A full list of differences between TLS 1.0 and TLS 1.1 is provided in RFC 4346 (Section 1.1).
TLS 1.1 is currently supported by Opera and GnuTLS.
[edit] Certificate providers
A 2005 Netcraft survey determined that VeriSign and its acquisitions such as Thawte have a 53% share of the certificate authority market, followed by GeoTrust (25%), Comodo (12%), Go Daddy (4%) and Entrust (2%).[1] (GeoTrust has since been acquired by VeriSign.)
[edit] See also
- Extended Validation Certificate
- SSL acceleration
- Certificate authority
- Datagram Transport Layer Security
- Multiplexed Transport Layer Security
- X.509
- VPN
- SEED
[edit] Software
- OpenSSL: a free (and very popular) implementation (BSD license)
- GnuTLS: a free implementation
- JSSE: a Java implementation included in the Java Runtime Environment
- Network Security Services (NSS): FIPS 140 validated open source library
- Crypt::OpenSSL: Perl wrapper modules for OpenSSL
- System.Net.Security: a Microsoft implementation for the .NET Common Language Runtime
- Mono.Securty a free software implementation for the Common Language Runtime
[edit] References
- Wagner, David; Schneier, Bruce (November 1996). "Analysis of the SSL 3.0 Protocol". The Second USENIX Workshop on Electronic Commerce Proceedings, USENIX Press.
[edit] External links
- RFC 2246 - The TLS Protocol, Version 1.0 (published 1999)
- RFC 4346 - The TLS Protocol, Version 1.1 (published 2006)
- SSL 3.0 specification (published 1996)
- SSL 2.0 specification (published 1994)
- The IETF TLS Workgroup
- SSL tutorial
- SSL.com article - How Can I Tell If A Web Page Is Secure?
- Introduction to SSL/TLS and related Apache configuration
- Early forum discussions about the SSL protocol and development
This article was originally based on material from the Free On-line Dictionary of Computing, which is licensed under the GFDL.