Secure Socket Layer

The SSL performs two functions it authenticates the web sites and ensures secure data transmission between the web server and the client. It achieves this either by using symmetric encryption or asymmetric encryption. In symmetric encryption, a key called the private key is used both for encrypting and decrypting data. The key used for encrypting is called the public key and the one used to decrypt is called the private key. For symmetric encryption to work, the sender and receiver should share the secret key. This is possible only when the sender and receiver know each other. Another problem with symmetric encryption is that it cannot cater to a large number of participants.

In asymmetric encryption, two separate keys are used to encrypt and decrypt data. The public key is shared with the other person and the private key is known only to the person who decrypts the data. So, the private key will remain a secret while the public key will be known to both the parties. Asymmetric encryption authenticates the client/server by providing a secure private key to be shared between strangers and giving secure digital signatures. For example, when a customer wants to buy a book from an online book store, the customer will like the transaction to be secure and confidential. A secure connection is initiated by the client by sending a "hello client" message by the client's browser. It consists of a suite of secure protocols that the browser supports and the browser generates a random challenge string. This random challenge string is used at the closing of the initialization and check whether a secure connection is established. The set of protocols contains the key exchange algorithm that is used for agreeing to a private session key, private key encryption protocol that is used to ensure the confidentiality of the transaction and hashing algorithms for maintaining data integrity.

Prior to establishing a secure connection, the SSL authenticates the server. The server will respond with a "server hello" message to the client hello message that it received earlier. This is an indication that the server supports the protocol requested by the client and generates a random connection identifier. This random connection identifier will be used to find out if a secure connection has been established or not.

It is essential that the merchant's digital certificate is endorsed by a CA whom the client trusts. Subsequently, the client compares the digital signature on the server's certificate with the public key of the CA which is stored in the browser of the CA. The endorsed merchants' certificates are signed using the CAs private key. The endorsement is verified by the browser which compares the digital signatures with the CA's public key.

After the completion of the authentication process, the browser generates a secret key that will be shared by the client and the server. This secret key shall be used for generating key for symmetric encryption and data integrity. From here on, there is no need for asymmetric encryption. RC2, RC4 and other symmetric encryption algorithms are sufficient for the messages sent. Two sets of symmetric key pairs are generated by the client and the server for securing incoming and outgoing messages.

Domain Name Search