Re: followup to SSL+LTC
From: Paul Rubin (//phr.cx_at_NOSPAM.invalid)
Date: 10/09/03
- Next message: Paul Rubin: "Re: followup to SSL+LTC"
- Previous message: David A. Scott: "David Wagner where are you?"
- In reply to: Tom St Denis: "followup to SSL+LTC"
- Next in thread: Lassi Hippeläinen : "Re: followup to SSL+LTC"
- Reply: Lassi Hippeläinen : "Re: followup to SSL+LTC"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: 09 Oct 2003 11:23:02 -0700
Tom St Denis <tomstdenis@iahu.ca> writes:
> Could someone please explain the scope of SSL and TLS. E.g. What problems
> do they each address. For example, one of the problems [I think] SSL
> addresses is a standard format for symmetric encryption, it also address
> key negotiation, server/client negotiations, etc...
SSL stands for Secure Socket Layer. It gives an authenticated,
encrypted channel given an underlying reliable channel (i.e. you run
it over TCP). TLS (Tranport Layer Security) is a newer version of
SSL.
> What else do they touch on? How much is required to just initiate a
> client/server negotiation [I'll assume things like certificate generation
> could be done with openssl].
There are two ways to use SSL/TLS:
1) The server sends a certificate containing a public key. The cert
authenticates the server to the client. The client verifies the
cert against a known CA cert and uses the server cert's public
key to encrypt symmetric keys that then encrypt and authenticate
the channel. The client doesn't send a cert, so it is
unauthenticated. This is how most SSL web sites work. You get
an encrypted channel to send your credit card number to Amazon
and Amazon authenticates itself to you through its cert, but you
don't authenticate yourself.
2) Both the client and the server send and verify certificates, so
they are authenticated to each other. This is more typically
used for extranets and VPN's.
> What is the relationship of TLS and SSL. I was told that TLS was
> based off the latest SSL [a branch?]. Are they compatible? Can a
> TLS protocol work with SSL?
TLS is basically the new name for SSL after SSL version 3. There are
some minor incompatibilities. A TLS implementation needs a little bit
of extra code to also support SSL but it's not a big deal. Adapting
an SSL implementation to support TLS is somewhat more work.
> Essentially two different LTC users said they want to use LTC to
> connect to HTTPS. This is the motiviation here. So I'm not looking
> to encompass all of the protocol. Just enough to connect,
> negotitate keys [possibly read certificates] and then encrypt+mac
> [or hmac].
By far the most complicated part of the protocol is parsing the
certificates and verifying them. They are in a messy format
containing many layers of crap designed by committees. If your
application doesn't require accepting arbitrary certificates and
understanding them (e.g. you only want to connect to a single HTTPS
site with no client cert and you can preconfigure the info from the
server cert into your client), what's left is fairly simple. Or it
might be feasible to have a rudimentary parser that pulls keys out of
certs and checks for a few specific tags (OID's) to validate them.
Anyway, you really shouldn't have much trouble reading the TLS RFC
(RFC 2246) and understanding it.
- Next message: Paul Rubin: "Re: followup to SSL+LTC"
- Previous message: David A. Scott: "David Wagner where are you?"
- In reply to: Tom St Denis: "followup to SSL+LTC"
- Next in thread: Lassi Hippeläinen : "Re: followup to SSL+LTC"
- Reply: Lassi Hippeläinen : "Re: followup to SSL+LTC"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
