SSL anti-aliased use all the cryptographic technology we have gone through already including the symmetric
and asymmetric algorithms hashes digital signatures Message Authentication codes to make a working security
protocol SSL and tier class or cryptographic protocols designed to provide communications security over
a network or the Internet.
Now SSL is the old encryption protocol.
NTFS is a new form but people still call them both SSL which is a little bit annoying and misleading.
Many sites still use the older SSL for compatibility reasons even their security issues.
An example of Tellez use is when you see Haseeb CPS in the RL of a Web site.
Such is here.
But till as can be used with any other protocol like FGP or virtual private networks it isn't just use
with haste ETP and the web browsing Tellez is very important for Internet security and privacy because
it is the most used method of encrypting data on the internet.
Provides privacy because encrypts data and data integrity because it uses Message Authentication codes
on Macs and communicating between two applications.
So for example when your Web browser the application when you communicate with your online bang their
application communication is encrypted from end to end from your application their application using
tty LS tailless supports the security services of confidentiality or privacy authentication and integrity.
The connection is private because a symmetric algorithm such as a s which you've discussed is used to
encrypt the data transmitted the keys for this symmetric encryption are generated uniquely for each
connection and all based on a secret negotiation at the start of the session.
The server and client negotiate the details of which encryption algorithm in cryptographic keys to use
before the first part of data is transmitted.
The negotiation of a shared secret cannot be read by eavesdroppers even by an attack who placed himself
in the middle of the connection.
The connection is all so reliable that no attacker can modify the communication during the negotiation
without being detected.
The identity of the communicating parties can be authenticated using public key cryptography certificates
and digital signatures.
This authentication can be made optional but it is generally required for at least one of the parties.
Usually the server so the web sites you visit and I'll show more on this when we talk about certificates.
The connection is reliable because each message transmitted includes a message integrity check using
a message authentication code Omak to prevent undetected loss alteration of the data during transmission.
Still I suppose many different methods for exchanging keys encrypting data authenticating message integrity.
Many of the algorithms and technologies which we've already discussed as a result though secure configuration
of Tellez involves many configurable parameters and not all choices provide the security services or
privacy authentication and integrity.
Now if we look on the Wikipedia site for Transport Security which is actually a really insight or describing
T.L. as we can see the various different supported methods for exchanging keys encrypting data and authenticating
message integrity and the first one here is shrinkers authentication and exchanging of keys and the
various different algorithms that are supported.
Now I remember back to the asymmetric algorithms that we discussed these so we can see RSA we can see
Diffie Hellman RSA elliptical curve etc..
Now the best ones to use are this one this one and this one with the problem is you don't always get
a choice.
A server will support certain authentication and key agreement methods.
And if you want to speak to them then you'll have to use those.
Now the reason that these are the preferred option is because they're using Diffie Hellman for key exchange
which can ensure a property of privacy called Forward Secrecy which you can see here.
Now this property gives assurance your session keys will not be compromised even if the private key
of the server is compromised by generating a unique session key for every session a user initiate.
Even the compromise of a single session key will not affect any data other than the exchange in that
specific session protected by that particular key.
Perfect Forward Secrecy represents a big step forward in protecting data on the transport there and
has become to see more important since vulnerabilities such as Heartbleed.
Pervert for secrecy really means that if the server you're communicating with is compromised and their
private key is compromised it means that all of your previous conversations cannot be decrypted because
you are using Diffie Helman to negotiate sesshin keys that are only used for a very short time.
If you move further down here we can then see the symmetric algorithms used.
So when we're talking about sesshin keys these are the keys are actually used to encrypt the data because
the symmetric keys are quicker.
And remember we talked about a less than out a was a good option.
And here we can see a yes and various other types of symmetric encryption algorithms and this interestingly
shows which ones are secure and which ones are in secure because there's some sort of ability or weakness
against them which is another reason why I recommended a yes you'll notice here that there are some
other things at the end of this A shouldn't really worry too much about that that is called a mode of
operation.
It is a different way for a GPS to scramble or encrypt the data which doesn't really matter too much
in this case and for this cause just knowing that using a GPS is enough and the bit lenth which we've
already explained.
You can also see here illustrates the different versions of SSL.
So actually this is very confusing for a lot of people.
This is the first version or earliest version sharing here of SSL.
And this is the next one.
And then this is the next warm so it goes to one after it was three for SSL so T.L. s 1.3 is the latest
and most secure version but is at least compatible with browsers.
So when using tailless you really want to be on tailless Warne or a ball.
And as you can see here you can see which one of these is secure or not secure.
You can see even with a yes you've got depends on mitigations if you are using s one that's come down
a little bit further.
And you can see the caches and Max that are used you know to maintain data integrity M.D 5 shouldn't
be used.
One is definitely getting very old.
And when we should be starting to use in later versions of Shaw which is 2 5 6 and 3 8 4 but for compatibility
reasons these aren't necessarily the used terms have been made to compromise and subvert aspects of
the security that TLR us and the protocol has been revised several times to address these evolving security
threats and identified weaknesses and vulnerabilities.
Examples of these include beast crime Pulo logjam with interesting names.
You can google those and find out more details if you're interested.
But the result has been that browsers and the implementations of SSL have to be upgraded by the developers
in order to keep up with the attacks and to defend against these vulnerabilities.
Now if we go here here you can see listed the versions of Firefox this is Firefox 2:33 and you can see
the beast when Roberti crime poodle freak logjam and you can see if you've got version 36 or 38 then
then that is vulnerable to logjam.
And if you get older and older versions you'll see that they become more and more susceptible to various
weaknesses and abilities.
Which is why you should be on the latest version of your browser where possible and the servers or signs
that you connect to also need to be on the latest versions.
The thing is you can't necessarily control that.
The thing is if you need privacy you need extreme privacy and you know that your server is not supporting
or is vulnerable to some of these things because maybe using just SSL warn then you know that you can't
communicate with that.
No energy secure and private way.
The combination of algorithms used is known as a cipher suite.
It is useful to know what all both the strongest and most compatible ciphers suites.
So instead of giving you a list I'm going to point you at resources that you can use instead.
This way you can find the latest ciphered list to be considered the most secure compatible when you
need it.
This is because if I give you a list now tomorrow a new vulnerability could come out which would invalidate
the order.
Probably one of the best places to go for a good Scifres Swee with compatibility.
Well actually the best place I know of anyway is Mozilla.
All the people behind Firefox.
Now what you can see here is the Sipher Swee list in order of preference so here is the most desirable.
And here is the least desirable but still strong.
Plus you have all of the best options as well such as your T.L. S version your certificate type your
certificate signature etc..
And if you go up here you can see what these ciphers are compatible with.
So these are the oldest compatible clients that will work with the Scifres.
So that's a really great list of the strong deciphers the ones that you want to use in preference.
And also if we go further down here we have a list designed for increased compatibility.
So if you're looking for a list or work with a wide a number of clients then this is a good option here.
If we go further down there you know they see all the Scifres if we go further down we can see that
the ultimate compatibility list here which will work with the really old clients if you need to configure
a server then check this out is a really cool tool.
So if we select the type of server that we want and then we can set the server here.
So maybe it's Apache when the old version the intermediate version the modem version and then it produces
the configuration for us so we can see here it's set it all up for is we don't want SSL v 3 v 2 and
or V 1.1.
So it's going to work for 1.2 and there's all the safest suites which create that conflict for.
So this is really brilliant.
Another site to look at for a good cipher suite list is weak D.H. to OLG as one here and the one I recommend
from Steve Gibson This is his list and it's in the format suitable for Windows servers.
And this is also another good list of preferred order for your cipher suites.
And the next section is I'm going to show you how you can tell what it is that the server is offering
in terms of its encryption algorithms and hashes and digital signatures et cetera.