Download Secure Sockets and Certificates in Java: SSL Encryption, Certificates, and Protocols and more Lab Reports Operating Systems in PDF only on Docsity!
CS 5523 Lecture 21:
Secure Sockets and Certificates in Java
] Discuss Laboratory 3 ] Finish Needham-Shroeder ] Secure Socket Layer ] SSL Classes and Examples in Java
Secure socket layer (SSL)
] Developed by Netscape, 1994
] Standardized by IETF January 1999 as TLS 1.0 (SSL 3.0)
] Is supported by most browsers for electronic transactions
] Has negotiable encryption and authentication algorithms
] Bootstraps by establishing a secure channel based on public-key encryption
] Channel is fully configurable so not everything has to be encrypted
Secure socket layer (SSL) encryption
] uses public key cryptography (RSA) to provide authentication
] uses secret key cryptography to provide privacy: \ Data Encryption Standard (DES) \ Triple-strength DES (3DES) \ Rivest Cipher 2 (RC2) \ Rivest Cipher 4 (RC4).
] uses digital signatures to provide data integrity.
Secure socket layer (SSL) certificates contain:
] Issuer – if a user trusts the CA that issues a certificate, and if the certificate is valid, the user can trust the certificate. ] Period of validity - an expiration date that should be checked when verifying the validity of a certificate. ] Subject - includes information about the entity that the certificate represents. ] Subject's public key – the primary piece of information that the certificate provides. All other fields provide validity of this key. ] Signature - signed by the CA that issued the certificate to ensure the validity of the certificate. Because only the certificate is signed, not the data sent in the SSL transaction, SSL does not provide for non-repudiation.
Instructor’s Guide for Coulouris, Dollimore and Kindberg© Addison-Wesley Publishers 2000 Distributed Systems: Concepts and Design Edn. 3
Figure 7. SSL protocol stack
SSL Handshake protocol
SSL Change Cipher Spec
SSL Alert Protocol
Transport layer (usually TCP)
Network layer (usually IP)
SSL Record Protocol
HTTP Telnet
SSL protocols: Other protocols:
Instructor’s Guide for Coulouris, Dollimore and Kindberg© Addison-Wesley Publishers 2000 Distributed Systems: Concepts and Design Edn. 3
Figure 7. SSL handshake protocol
Client Server
ClientHello ServerHello Certificate Certificate Request ServerHelloDone Certificate Certificate Verify Change Cipher Spec Finished Change Cipher Spec Finished
Establish protocol version, session ID, cipher suite, compression method, exchange random values
Optionally send server certificate and request client certificate
Send client certificate response if requested
Change cipher suite and finish handshake
Instructor’s Guide for Coulouris, Dollimore and Kindberg© Addison-Wesley Publishers 2000 Distributed Systems: Concepts and Design Edn. 3
Figure 7. SSL handshake configuration options
Component Description Example Key exchange method
the method to be used for exchange of a session key
RSA with public-key certificates Cipher for data transfer
the block or stream cipher to be used for data
IDEA
Message digest function
for creating message authentication codes (MACs)
SHA
Instructor’s Guide for Coulouris, Dollimore and Kindberg© Addison-Wesley Publishers 2000 Distributed Systems: Concepts and Design Edn. 3
Figure 7. SSL record protocol
Application data abcdefghi
Record protocol units abc^ def^ ghi
Compressed units
MAC
Encrypted
TCP packet
Fragment/combine
Compress
Hash
Encrypt
Transmit
Secure client using default
import java.io.; import javax.net.ssl. ;
... int port = availablePortNumber; String host = "hostname"; try { SSLSocketFactory sslFact = (SSLSocketFactory)SSLSocketFactory.getDefault(); SSLSocket s = (SSLSocket)sslFact.createSocket(host, port); OutputStream out = s.getOutputStream(); InputStream in = s.getInputStream(); // Send and receive messages } catch (IOException e) { }
Java security class relationships
KeyManager TrustManager
SSLContext
SSLSocket
SSLServerSocket
SSLSocket
SSLSession
SSLSession in Java
] Security context negotiated by the peers
] Contains the cipher suite used for communication
] Has management information such as creation time
] Contains a shared master secret for creating keys
For next time:
] Finish reading Chapter 7
