Seminar Topics & Project Ideas On Computer Science Electronics Electrical Mechanical Engineering Civil MBA Medicine Nursing Science Physics Mathematics Chemistry ppt pdf doc presentation downloads and Abstract

Secure Sockets Layer (SSL)

[attachment=22480]

The Secure Sockets Layer (SSL) is a commonly-used protocol for managing the security of a message transmission on the Internet. SSL has recently been succeeded by Transport Layer Security (TLS), which is based on SSL. SSL uses a program layer located between the Internet's Hypertext Transfer Protocol (HTTP) and Transport Control Protocol (TCP) layers. SSL is included as part of both the Microsoft and Netscape browsers and most Web server products. Developed by Netscape, SSL also gained the support of Microsoft and other Internet client/server developers as well and became the de facto standard until evolving into Transport Layer Security. The "sockets" part of the term refers to the sockets method of passing data back and forth between a client and a server program in a network or between program layers in the same computer. SSL uses the public-and-private key encryption system from RSA, which also includes the use of a digital certificate.
TLS and SSL are an integral part of most Web browsers (clients) and Web servers. If a Web site is on a server that supports SSL, SSL can be enabled and specific Web pages can be identified as requiring SSL access. Any Web server can be enabled by using Netscape's SSLRef program library which can be downloaded for noncommercial use or licensed for commercial use.
TLS and SSL are not interoperable. However, a message sent with TLS can be handled by a client that handles SSL but not TLS.

SSL Protocol

The Transmission Control Protocol/Internet Protocol (TCP/IP) governs the transport and routing of data over the Internet. Other protocols, such as the HyperText Transport Protocol (HTTP), Lightweight Directory Access Protocol (LDAP), or Internet Messaging Access Protocol (IMAP), run "on top of" TCP/IP in the sense that they all use TCP/IP to support typical application tasks such as displaying web pages or running email servers.

SSL runs above TCP/IP and below high-level application protocols.
The SSL protocol runs above TCP/IP and below higher-level protocols such as HTTP or IMAP. It uses TCP/IP on behalf of the higher-level protocols, and in the process allows an SSL-enabled server to authenticate itself to an SSL-enabled client, allows the client to authenticate itself to the server, and allows both machines to establish an encrypted connection.
These capabilities address fundamental concerns about communication over the Internet and other TCP/IP networks:
• SSL server authentication allows a user to confirm a server's identity. SSL-enabled client software can use standard techniques of public-key cryptography to check that a server's certificate and public ID are valid and have been issued by a certificate authority (CA) listed in the client's list of trusted CAs. This confirmation might be important if the user, for example, is sending a credit card number over the network and wants to check the receiving server's identity.
• SSL client authentication allows a server to confirm a user's identity. Using the same techniques as those used for server authentication, SSL-enabled server software can check that a client's certificate and public ID are valid and have been issued by a certificate authority (CA) listed in the server's list of trusted CAs. This confirmation might be important if the server, for example, is a bank sending confidential financial information to a customer and wants to check the recipient's identity.
• An encrypted SSL connection requires all information sent between a client and a server to be encrypted by the sending software and decrypted by the receiving software, thus providing a high degree of confidentiality. Confidentiality is important for both parties to any private transaction. In addition, all data sent over an encrypted SSL connection is protected with a mechanism for detecting tampering--that is, for automatically determining whether the data has been altered in transit.

SSL PROTOCOL


[attachment=32330]

SSL – Secure Socket Layer

it provides a secure transport connection between applications
(e.g., a web server and a browser)
SSL was developed by Netscape
SSL version 3.0 has been implemented in many web browsers
(e.g., Netscape Navigator and MS Internet Explorer) and web
servers and widely used on the Internet
SSL v3.0 was specified in an Internet Draft (1996)
it evolved into RFC 2246 and was renamed to TLS (Transport
Layer Security)
TLS can be viewed as SSL v3.1
TLS is an standardization initiative whose goal is to come out with an internet standard version of SSL.

If you've purchased an item over the Internet with a site address or URL that starts with "https" instead of "http," you've used Secure Sockets Layer, or SSL. SSL is a protocol that encrypts information on a Web page, like personal details or credit card numbers, so unauthorized users cannot see your data. SSL also authentic the site receiving your data

SSL components

1 SSL Handshake Protocol
– negotiation of security algorithms and parameters
– key exchange
– server authentication and optionally client authentication
2 SSL Record Protocol
– fragmentation
– compression
– message authentication and integrity protection
– encryption
3 SSL Alert Protocol
– error messages (fatal alerts and warnings)
4 SSL Change Cipher Spec Protocol
– a single message that indicates the end of the SSL handshake

client hello message

Version- this field identifies the highest version of ssl client can support. It can be 2,3 or 3.1
Random- this field use for later . It contain two sub field-

Client key authentication

The client initiate the third phase and is the sole sender of all the messages. This phase consist three steps-
Certificate – this is optional and performed only if server had requested .if the server has requested for certificate and client does not have one then client send no certificate message.

SSL 3 Protocol

The third version of the SSL, or Secure Sockets Layer, protocol is widely abbreviated SSL 3. Designed in 1995, SSL 3 is a major enhancement of the preceding SSL version, called SSL 2.
The SSL 3 protocol provides greater security than SSL 2, partly by protecting the handshake procedure more effectively and incorporating stronger encryption features. The SSL 3 protocol is also backwards compatible with SSL 2, which means SSL 3 works with clients and servers using SSL 2.