HTTPS

This presentation is a basic insight into the Application Layer Protocols i.e. Http & Https. I was asked to do this as a part of an interview round in one of the networking company. -Kudos Harshad Taware Bangalore ,India

Brief explanation about TLS and SSL protocol handshake and message exchange process and its describe certificate validation.

The document discusses Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols for securing communications over a network. It explains that SSL uses certificates and keys to encrypt data between a client and server so only they can access it. It then describes the different versions of SSL, how SSL establishes encrypted connections, and provides diagrams of SSL and mutual authentication processes.

SSL and TLS provide end-to-end security for applications using TCP. They operate at the transport layer and provide services like data encryption, message integrity, and client/server authentication. The key components are the handshake protocol for negotiating encryption parameters and exchanging keys, the record protocol for fragmenting and encrypting application data, and alert and change cipher spec protocols for signaling errors and key changes. Common algorithms include RSA and Diffie-Hellman for key exchange, RC4, 3DES and AES for encryption, and MD5 or SHA for hashing. Sessions define a connection's cryptographic settings while connections are the actual data streams.

The document defines HTTP and HTTPS. HTTP is the Hypertext Transfer Protocol that provides communication between web browsers and servers. It is unsecured and transmits data in plain text. HTTPS is HTTP secured with SSL/TLS encryption to provide security. Key differences are that HTTPS uses port 443 instead of HTTP's port 80, establishes an encrypted channel, and verifies servers with certificates to protect against attacks.

Transport Layer Security (TLS) is a protocol that ensures privacy between communicating applications and their users on the Internet. When a server and client communicate, TLS ensures that no third party may eavesdrop or tamper with any message. TLS is the successor to the Secure Sockets Layer (SSL).

HTTP is the protocol that powers the web. It uses a request-response model where clients make requests that servers respond to. Common request methods include GET, POST, HEAD, PUT, DELETE, and OPTIONS. Responses include status codes like 200 for OK and content types. HTTP 1.1 added features like persistent connections and chunked encoding. Cookies are used to maintain statelessness. HTTPS uses SSL/TLS to secure HTTP connections with encryption, server authentication, and integrity.

TLS (Transport Layer Security) is a protocol that provides secure communication over the Internet by addressing issues of privacy, integrity, and authentication. It uses encryption to ensure privacy, message authentication codes to ensure integrity, and X.509 certificates to perform authentication between clients and servers. TLS is commonly used with HTTPS to secure web browsing and can also be used by other applications like email, voice over IP, and file transfer.

HTTP is a protocol for sending and receiving data between a web server and client like web browsers. It allows web pages and other files to be transferred but the data is not encrypted, so it can be viewed or intercepted by others. HTTPS encrypts this data transfer using SSL certificates to provide a secure connection and prevent sensitive information from being stolen. The main advantages of HTTPS are that it helps build trust, provides security, and qualifies websites for features like AMP pages.

TLS (Transport Layer Security) is a cryptographic protocol that provides encryption and security for data sent over the internet. It is used by HTTPS to encrypt communication between web browsers and servers. TLS 1.2, the previous standard, had security flaws in how it exchanged encryption keys. TLS 1.3 improves security by using Diffie-Hellman key exchange so keys are not sent directly over the network. To upgrade a website from HTTP to HTTPS, an SSL certificate must be purchased and installed, all links on the site must be changed to HTTPS, and HTTP traffic should be redirected to HTTPS.

FTP is a protocol that allows users to transfer files between computers over a TCP network using an FTP client and server. It uses ports 20 and 21, with port 20 for sending data and port 21 for control commands. FTP supports authentication but sends all data, including usernames and passwords, in clear text. TFTP is a simpler version of FTP that uses UDP port 69 and only supports sending and receiving files. It lacks many of FTP's advanced features but requires fewer resources. TFTP does not support authentication and sends all data in clear text.

The document presents an overview of Secure Socket Layer (SSL) technology. It discusses how SSL establishes encrypted connections to provide security and integrity. It describes SSL architecture including certificates, hashing, asymmetric and symmetric data transfer, and the SSL handshake process. It also covers encryption algorithms like RC4, AES, Triple DES, and RSA that are used. Finally, it discusses asymmetric key cryptography algorithms like Diffie-Hellman and RSA, as well as symmetric key cryptography and the future scope of encryption standards.