Back when the Internet was new it was realized fairly early on that Web sites in particular were going
to need security.
The original HTP protocol had no security built into it.
So we had to do something.
So back in the early 90s back when Netscape was king they developed a series of security protocols which
are collectively known as SSL or secure sockets layer.
Now this has been around for a long time in fact it's pretty much been usurped at least in terms of
web sites with transport layer security or less.
But whether you're using the term SSL or T.L. as they are protocols that are designed to make secure
connections between two points.
These were originally invented for Web sites under HTP.
However SSL and T.L. s find new life in other protocols that take advantage of this.
So basically on the Internet if you want to make a secure connection between some kind of server and
some kind of client SSL or is Big Brother TS or the way to go.
Now what's important here is that SSL is the older protocol T.L. S is the newer protocol however in
terms of functions they do basically the exact same thing.
It's just that Teall s does it a lot better with a little extra security built in.
So the first thing I want to do is talk about what do I need to do if I want to make a secure connection
between two points.
Well all right.
Number one I'm going to want encryption that's a given.
But I want to use encryption but more importantly I want to use a symmetric encryption symmetric encryption
is really really really fast compared to asymmetric.
So I'm going to have to make sure that each point gets a key.
So I need encryption for sure but I also need to determine how I'm going to go about a key exchange
between these two points.
Number three I'm going to want to do authentication.
I'm not going to be passing out my key to anybody so I want to go through some authentication process
with SSL anti-alias.
We pretty much use RSA certificates.
They could do other stuff but I'm going to keep it simple in this episode.
And then the fourth thing you're going to want to do is some kind of HMX so the cool part about SSL
flashed here less is that they are the protocols which establish the connection and the establishment
of these four really really important aspects that make a secure connection.
So the first thing I want to do to show you T.L. as an action is I'm going to fire up wireshark here.
We're going to go to a secure Web site and grab that TLM conversation taking place.
So if you take a look here what I've got is good old Wireshark.
So I'm just going to go ahead and start my capture and let that go for a minute.
And what I'm going to do is open up a web browser and I've got chrome here to work as good as any.
And what I have is a one of my quick links on my bookmarks to a web mail site and you'll see it says
web mail 7. blue Genesys dot com.
So you'll see that this is HDTV.
And now it's prompting for my username and password.
Now I'm not going to give you my username and password but the cool part is is we have now created a
complete capture in Wireshark.
So the first thing I want to do here is I'm going to have a whole lot of data.
So let's take a look now.
If you look over here the first thing I want to do is I'm going to do a ping
so I'm picking this and I see I've got an IP address right here.
I need that IP address because I have so much data in Wireshark.
I'm going to have to do a little bit of filtering so let's go ahead and filter right now.
So I've got this huge capture and this is always the problem when you're using wireshark I mean it's
capturing everything not just this one connection this web server I've got all kinds of other stuff
from running Windows Tennent's phoning home and DNS.
You take a look on the screen you see I've got a drop box protocol and all this so what I got to do
is I've got to filter this out so I'm going to make this a little bit of a wireshark class and use a
filter here.
Now if you take a look over here what I've done is I did a ping on that particular you r else so webmail
seven Blue Jonas's dot com and you can see I've got an IP address there so I can actually use that as
a filtering tool.
I've already done it once so it should still be there.
Fantastic.
So I'm going to use this as a little filter and now I've got it down to anything with a source or a
destination IP address is going to be to that particular web server so that's fantastic.
But you have to be careful with wireshark because wireshark records everything when ever it sees it
so bad packets or weird stuff would if they one computer doesn't respond back fast enough another computer
might send another request.
So if you're thinking you're going to use wireshark and get this perfect step step step step step thing
you're not going to it can be a little frustrating.
But what is important is we can do a little work here to make it a little bit cleaner.
So I do know it all starts with a client.
Hello.
All of these up here are just the initial TZP connection trying to get to the guy.
And then right here is the client hello that starts everything.
So what I'm going to do is take advantage of another little power of Wireshark and I'm going to click
on follow TZP screen.
Now it basically shows me the connection in clear text and even down here at the bottom it shows all
of the encrypted data.
I don't really need to see that what's more important is that changes the sort order for me.
So it's only looking at that one connection.
So it cleans things up a little bit.
So if we start right at the top you can see here's my computer doing a sin sin ack ack it's a standard
TCAP connection.
And once it has that here it goes here's the client hello right here and this is the first step in making
a TLM handshake.
So what I'm going to do is I've got this clicked what I want to do is we look actually in that request
what you're going to see is right here it's called Sipher suites.
Remember we have four things that we have to get set up.
The symmetric encryption the key exchange the authentication methodology and then some type of hashing
for a Mac.
And this is how it starts all this in the client.
Hello.
So what you're looking at right here is a list of all the different ways that this web browser is able
to go ahead and do these four things.
So it submits to the server this big long list.
Here's all the different ways I can do it in preferential order so the stuff it wants to do first is
at the top and the stuff it wants to do the least is at the bottom.
Now no one's going to test you on what exactly all this means.
But I would like to give you an example so let's pick the second one right here.
So as we look at this it says they all start with Teall s.
The first thing is the key exchange.
So what we're seeing here is elliptic curve Diffie Hellman.
So it says I'd like to do a elliptic curve Diffie Hellman next is the authentication and what's do good
ole RSA certificates pretty common.
Third is the symmetric encryption.
It wants to do.
A-S 128 GCM.
And then fourth it wants to shop 256 for all the max so it gives this big list.
It actually gives a lot of other stuff to let me show you something else that might be interesting we
know it does.
It wants to do elliptic curve.
So it's also going to have to provide elliptic curves in your so you look way down here at the bottom.
So you'll see that this guy has three built in types of elliptic curves so it's going to say if you
do a elliptic curve it has to be one of these three.
Cool.
All right so when we get all this close back up.
So that's the client Hello.
So the server now gets all this information and the server is going to pick from that list whatever
from the top whatever he can do and he's going to respond back and that's what the server hello is all
about.
So let's take a look at the server.
Hello.
And the server load provides certain things like for example here's a session id which defines this
individual connection.
It says here's the cipher suite that it wants to use.
So it's going to use a click elliptic curve if you home an RSA alias 256 GCM and Shaw three eighty four
so it's pretty much ready to rock and roll on this and the server says Great that's how we're going
to do it.
So the next step is then we have what's called the key exchange.
Now I want you to be very careful when you look at this.
You'll see right up here in Wireshark it says certificat server key exchange Comus server.
Hello done.
One of the powers of T.L. less is that it can combine a lot of commands into individual packets.
So what we're actually seeing here is two very separate commands that look like just one line and wireshark
But there's actually two.
So the certificate key exchange comes along and he's basically going to go.
OK here we go.
Now there's going to be some important information in here for example in the key exchange one of the
things you're going to get is Well the certificate.
So if you take a look right here this is actually the certificate for my web mail.
And it also provides either the root certificate or an intermediate certificate as well.
Now you'd save yourself then wait a minute.
The whole idea of the server providing me a certificate is that as a web browser I have all the certificates
built into me.
So what I can do is I can check that certificate against whoever his root certificate is and it should
be confirmed right.
So why is he sending me another route certificate in immediate.
Well it's actually just another layer of check yes.
Blue Genesys knows that I have a copy of their root certificate.
However they just send another copy.
And any good web browser just adds another layer of check is going to compare the two.
And make sure that they're the same ones so it's just an extra layer check.
All right.
So we get our certificates in here.
Now the key exchange takes place and they're pretty much ready to go once a key exchange takes place.
We've got the encryption set we've got the key exchange set.
We've got the authentication.
Well pretty much done.
And the Mac will be ready to go when it needs it.
So then we come down oh and then the service says his halo is done.
So basically the server now says you got what you need.
Let's get started and do this right.
So that's where you see right here.
Now there's a quiet key exchange.
Tell us is actually capable of having client certificates.
But usually we don't have that.
So the client key exchange is really an optional feature.
What's more interesting is right here.
So here it says change Cyperus spec change cipher spec is the statement that says you're ready.
Let's do this.
Once the change cipher spec has been sent by both parties it automatically starts going into application
data.
So you can see here here's the change cipher spec coming from my client.
Here's the change cipher spec coming from the server right here.
And there's a messed up packet but from there on in you see it says application data.
We are encrypted.
So we have to have all of these steps combined to make SSL slash T.L. s work.
It's a magical tool.
It's actually a lot more complicated in this.
But this will get you through the exam.
The other thing I want you to remember about SSL NTFS is all.
Even though this was originally invented for Web sites you see this all over the place you can see it
in email servers you can see it in VPN you can see SSL and TLM.
Originally invented for Web sites used all over the Internet.