SSL and TLS Protocols - Revision history

Liamsemeniuk at 16:23, 27 June 2017

2017-06-27T16:23:03Z

2017-06-27T16:20:16Z

Cipher Suites

2017-06-27T16:17:36Z

Cipher Suites

2017-06-27T16:17:20Z

Renegotiation

2017-06-27T16:16:45Z

Server Authentication

2017-06-27T16:15:50Z

Client Authentication

2014-11-04T21:11:53Z

No Authentication Aka Anonymous

2014-11-04T21:10:39Z

No Authentication Aka Anonymous

2014-11-04T21:09:51Z

Server Certificate

2014-11-04T20:58:21Z

Cipher Suites

@@ Line 1: / Line 1: @@
-SSL stands for Secure Sockets Layer and was originally created by Netscape. SSLv2 and SSLv3 are the 2 versions of this protocol (SSLv1 was never publicly release). After SSLv3, SSL was renamed to TLS.
+SSL stands for Secure Sockets Layer and was originally created by Netscape. SSLv2 and SSLv3 are the 2 versions of this protocol (SSLv1 was never publicly released). After SSLv3, SSL was renamed to TLS.
 TLS stands for Transport Layer Security and started with TLSv1.0 which is an upgraded version of SSLv3.
@@ Line 11: / Line 11: @@
 SSL/TLS is used in every browser worldwide to provide https ( http secure ) functionality.
-The latest standard version is TLSv1.2 http://tools.ietf.org/html/rfc5246, while the upcoming TLS v1.3 is still draft.
+The latest standard version is TLSv1.2 http://tools.ietf.org/html/rfc5246, while the upcoming TLS v1.3 is still in the draft stage.
-Connectionless support is provided via DTLS.
+Connection-less support is provided via DTLS.
 Those protocols are configurable and can use various ciphers depending on their version.

@@ Line 58: / Line 58: @@
 == Cipher Suites ==
-* How cipher suites are negotiated ?
+* How are cipher suites negotiated?
 What TLS 1.2 rfc says :
@@ Line 71: / Line 71: @@
 What are best ciphersuites to choose ?
-some interesting hint there : http://zombe.es/post/4078724716/openssl-cipher-selection
+An interesting hint here: http://zombe.es/post/4078724716/openssl-cipher-selection
 * Is there a normalized cipher suite ordering ?
-not much more than what is told for 'How cipher suites are negotiated ?'
+Not much more than what is told for 'How cipher suites are negotiated?'
 So it is implementation dependent. In openssl there are two modes:

@@ Line 67: / Line 67: @@
 </pre>
-So basicaly server has the decision choice and does not provide a list of its own ciphersuites but just the selected one
+So basically server has the decision choice and does not provide a list of its own ciphersuites but just the selected one
 What are best ciphersuites to choose ?

@@ Line 114: / Line 114: @@
 a Server will send a '''HelloRequest''' and expects Client to renegotiate with a ClientHello in very short time.
-server renegotiation ( without resumption )
+Server renegotiation ( without resumption ):
 <pre>
 # Given a SSL Connection con :

@@ Line 148: / Line 148: @@
 === Server Certificate ===
-This is '''Public Key''' Certified by a Certificate with Trust from client. Trust from client can be done automatically with Certificate Authority trust.
+This is '''Public Key''' Certified by a Certificate with Trust from the client. Trust from the client can be done automatically with Certificate Authority trust.
 It is crucial that clients check the Server Certificate against the expected hostname [[Hostname_validation]]

@@ Line 162: / Line 162: @@
 == Client Authentication ==
-Client authentication is optional. in many cases client does not authenticaiton at ssl layer, but with usage of protocols above ssl by exemple with HTTP authenticate methods.
+Client authentication is optional. In many cases the client does not authenticate at the ssl layer, but rather with the usage of protocols above ssl, for example with HTTP authentication methods.
 === Client Certificates ===

@@ Line 158: / Line 158: @@
 Selecting string cipher '''aNULL''' [[Manual:ciphers(1)]] allows to select such cipher suite. Remark this is not same a '''eNULL''' that provides no confidentiality at all.
-Anonymous Diffie_Hellman exchange and Anonymous Elliptic Curves Diffie Hellman Exchange methods provide this anonymous authentication.
+Anonymous Diffie_Hellman exchange ('''DH''') and Anonymous Elliptic Curves Diffie Hellman Exchange ('''ECDH''') methods provide this anonymous authentication.
 == Client Authentication ==

@@ Line 156: / Line 156: @@
 Even if it look like is a strange idea, it is possible to select cipher suite that does not provide any server authentication but still provide confidentiality.
-Selecting string cipher 'aNULL' [[Manual:ciphers(1)]] allows to select such cipher suite. Remark this is not same a 'eNULL' that provides no confidentiality at all.
+Selecting string cipher '''aNULL''' [[Manual:ciphers(1)]] allows to select such cipher suite. Remark this is not same a '''eNULL''' that provides no confidentiality at all.
 Anonymous Diffie_Hellman exchange and Anonymous Elliptic Curves Diffie Hellman Exchange methods provide this anonymous authentication.

← Older revision		Revision as of 21:09, 4 November 2014
Line 151:		Line 151:

	It is crucial that clients check the Server Certificate against the expected hostname [[Hostname_validation]]		It is crucial that clients check the Server Certificate against the expected hostname [[Hostname_validation]]
		+
		+	=== No Authentication Aka Anonymous ===
		+
		+	Even if it look like is a strange idea, it is possible to select cipher suite that does not provide any server authentication but still provide confidentiality.
		+
		+	Selecting string cipher 'aNULL' [[Manual:ciphers(1)]] allows to select such cipher suite. Remark this is not same a 'eNULL' that provides no confidentiality at all.
		+
		+	Anonymous Diffie_Hellman exchange and Anonymous Elliptic Curves Diffie Hellman Exchange methods provide this anonymous authentication.

	== Client Authentication ==		== Client Authentication ==

@@ Line 78: / Line 78: @@
 So it is implementation dependent. In openssl there are two modes:
-* default is to choose the first compatible cipher suite from client hello.
+** default is to choose the first compatible cipher suite from client hello.
-* SSL_OP_CIPHER_SERVER_PREFERENCE to SSL_CTX_set_option to choose from server cipher list order.
+** SSL_OP_CIPHER_SERVER_PREFERENCE to SSL_CTX_set_option to choose from server cipher list order.
 * How to setup ciphersuites in openssl ?