Dong Yan is the front engineer of Wedoctor Cloud Service team. Aspiring to become a full stack development engineer or even architect, I have a long way to go. Exercise in your life to release stress and think about problems.

See this title, many old iron will firmly say, this problem I will! HTTPS is used for secure transmission.

Yeah, that’s great. Do you know how HTTPS underlies data security? Here comes today’s topic: HOW to achieve secure data transmission through HTTPS.

HTTPS cognitive

HTTPS is a security protocol consisting of HTTP and SSL.

As we know, the process from our input URL to page presentation is based on HTTP protocol, which guarantees the basis of data transmission on the network, but security cannot be guaranteed, while SSL protocol can solve the security problem by acting on HTTP protocol.

HTTPS guarantees the following three points:

  • Data content encryption
  • Data integrity protection (digital digest, digital signature)
  • The identity authentication

HTTPS ensures security.

  • Handshake phase: useAsymmetric encryption 对 The public keyencrypted
  • Transfer phase: useSymmetric encryption 对 messageencrypted

HTTPS takes longer to establish a connection than HTTP because it has an additional layer of encryption that uses an asymmetric encryption algorithm to encrypt a public key.

In the handshake phase, the connection is secure, and subsequent data transmission can be secure. Therefore, the time-consuming symmetric encryption algorithm can be used to encrypt packets.

HTTPS deconstruction

In the figure above, we see the SSL protocol in action. Before we look at THE SSL protocol to ensure data security, let’s look at some of the concepts involved in data security.

Encryption and decryption related concepts

Symmetric encryption

Alias: private key encryption, single key algorithm, traditional password algorithm.

Concept: The same key is used for encryption and decryption. Therefore, the decryption key can be calculated from the encryption key or the encryption key.

Common symmetric Encryption algorithms include Data Encryption Standard (DES), Advanced Encryption Standard (AES), RC4, and IDEA

Asymmetric encryption

Alias: public key encryption

Concept: The public key is public, and the private key is stored at both ends of the communication. The client forms a key pair with the encrypted public key, and the server forms another key pair with the encrypted public key. The encryption and decryption keys are paired

Restriction: The length of the encrypted content cannot exceed the length of the public key

Numbers in this paper,

Alias: digital fingerprint

Concept: plain a string of fixed length (128 bits) ciphertext generated using a single Hash function.

A digital signature

Concept: a hybrid application of asymmetric key encryption and digital summarization

Digital signature process

1. The sender uses the Hash function (H) to generate A digital digest of the original text

2. The sender uses its own private key to encrypt the digital abstract A and generate the ciphertext CypherA

3. Send the ciphertext CypherA along with the original text to the recipient

Digital signature verification (integrity of information) process

1. The receiver uses the Hash function (H) to generate A numerical digest of the received text B (B === A, H is the same function)

2. The recipient uses the public key to decrypt the received CypherA and obtain the digital digest B’.

3. Compare whether B’ and B are equal. If they are equal, it indicates that the received information is complete and the message is indeed signed and sent by the sender (because the private key is only known by the sender) and has not been modified in the transmission process; Otherwise, the information is modified


Finally, compare digital digest A and digital digest A’ are equal, or reverse Hash() function can be used to restore the digest A’ to get plaintext, compare the changed plaintext and the original text is consistent (both pig).

Digital signature is a process of encryption, and digital signature verification is a process of decryption. A digital signature involves a hash function, the receiver’s public key, and the sender’s private key.

Pseudo code
// Single Hash function
fucntion Hash (plainText) { // Pass in the plaintext argument
  // Plaintext encryption process
  const encryptedAbstract = encrypt(plainText)
  // Returns a fixed-length (128-bit) numeric digest
 return encryptedAbstract }  // The sender uses its own private key to encrypt the digital digest generated in plaintext to generate the ciphertext CypherA function doEncrypt (senderPrivateKey, encryptedAbstract) {  const CypherA = encrypt(senderPrivateKey, encryptedAbstract)  return CypherA }  // Send a packet function sendMessage (plainText) {  const encryptedAbstract = Hash(plainText)  const CypherA = doEncrypt(senderPrivateKey, encryptedAbstract) / / encryption  return {  CypherText: CypherA,  originText: plainText  } }  // The receiver decrypts with a public key function doDecrypt (publicKey, encryptedAbstract) {  const decryptedAbstract = decrypt(publicKey, encryptedAbstract)  return decryptedAbstract }  // Receive the packet function receiveMessage (CypherA, plainText) {  const encryptedAbstract = Hash(plainText)  const decryptedAbstract = doDecrypt(publicKey, encryptedAbstract) / / decryption  if (decryptedAbstract === encryptedAbstract) {  console.log('1, The sender is true') // Message sender's confirmation  console.log('2, The message is complete') // Verify message integrity  } }  const message = sendMessage(plainText) // Digital signature process receiveMessage (message.CypherText, message.originText) // Digital signature authentication process Copy the code

The digital certificate

How can we ensure that the public key is trusted during the above digital signature process? This is why digital certificates exist.

Digital certificates are used for encryption, signature, and identity authentication.

Digital certificates are issued by a certificate Authority (CA), which authenticates the identity of the holder before the certificate is issued and when the certificate is used. It gives the client the ability to identify whether the public key is from a legitimate server.

A certificate authority (CA) issues a digital certificate that contains a public key and the identity of the owner. The matching private key is not public, but is kept secret by the end user who generated the key pair. A certificate is also the CA’s confirmation or verification. The public key contained in the certificate belongs to the individual, organization, server, or other entity named in the certificate. The OBLIGATION of a CA in such a scheme is to verify the applicant’s credentials so that users and trusted parties can trust the information in the CA certificate.

When you visit a site that uses HTTPS (secure connection), the site’s server uses a certificate to prove the site’s identity to a browser, such as Chrome. The public key information contained in the certificate is trusted. If the certificate does not exist, is tampered with, or is invalid, the browser will prompt you in the upper left corner that the website is not secure.

Signature verification chain: client <- server < -CA

Contents of a digital certificate
  • The name of the certificate authority
  • Digital signature of the certificate itself
  • Certificate Holder public Key
  • Hash algorithm used to sign the certificate
  • . , etc.

Public keys and digital signatures

With these basic concepts in mind, we move on to today’s topic: How does SSL secure data transmission

SSL/TLS

Secure Socket Layer (SSL)

Encryption technology is used to ensure that data will not be stolen during network transmission.

TLS (Transport Layer Security)

Used to provide confidentiality and data integrity between two applications.

This protocol is based on THE SSL3.0 protocol, which can be understood as SSL3.1 version. SSL3.0, however, uses some more secure policies to make data more secure, and other protocol layers and functions are consistent with SSL. Those who are interested can learn about the differences and advantages of SSL.

SSL/TLS protocol functions:
  • Data is encrypted to prevent theft
  • Protect data integrity and ensure that data cannot be changed
  • Authentication to ensure that data is sent to the correct client and server

As you can see, this is where the HTTPS protocol comes in.

So, how does SSL protocol encrypt our data so that it can be transmitted safely?

Handshake process of SSL and TLS


1. The client informs the server of its supported security protocol version (such as TLS1.0), encryption algorithm, compression method, and random number CRandom1;

2. The server responds to the client for the first time with the version of the security protocol, encryption algorithm, compression method, random number SRandom, and a digital certificate (server certificate);

3. The client verifies the certificate sent by the server. After the certificate is authenticated, perform the following operations:

  • The client again generates a random number CRandom2
  • The public key in the server certificate is used to encrypt data and generate random number CRandom3
  • sendChangeCipherSpec message notification (telling the server THAT I'm ready to encrypt and transmit data with the encryption suite we agreed on)In front of,Hash value for all messagesAs well asEncrypt data CRandom3Perform server authentication
  • Encrypt the three random numbers CRandom1, CRandom2 and CRandom3 with the encryption algorithm confirmed with the server, and generate Session Secret (this is the symmetric encryption key used for data transmission using the symmetric encryption algorithm behind, and can also be used toSession restoreTo save SSL handshake time.

4. The server responds again:

  • Decrypt CRandom3 with your own private key and verify the decrypted data
  • sendChangeCipherSpec message notification (telling the client that I am also ready to encrypt data using the encryption suite and Session Secret we discussed earlier)
  • A Finish message is sent to the client using Session Secret to verify that the encryption and decryption channel established by the handshake was successful

In the four steps above, the client and server have determined the key and can encrypt the message for transmission.

At this point, the handshake is over.

The security of the whole handshake phase depends on whether the third random number CRandom3 can be cracked, because this random number is encrypted with the public key of the server and decrypted with the private key of the server. The private key is stored only on the server itself.

After all the handshake phases are complete, the application data can be transferred using symmetric encryption techniques.

QA

1. How does the client verify the received certificate?

The certificate itself tells the client how to verify the certificate. That is, the certificate says how to generate the certificate number according to the content of the certificate. After obtaining the certificate, the client generates a certificate number according to the method on the certificate. If the generated certificate number is the same as the certificate number on the certificate, the certificate is genuine.

2. The security of a public key is verified by a certificate, but the certificate is issued by the issuer. How can we verify that the issuer is trusted?

Through the certificate chain.

  • Root: the digital Certificate issued by the CA (Certificate Authority). That is, the Certificate Authority authenticates itself. In the figure above, the DigiCert Global Root CA issues the Root certificate to itself.

  • Intermediates: intermediates: intermediate certificates. The root CA generates a pair of public and private keys, and uses the private key to encrypt the information of the intermediate CA and the public key to generate signatures and encapsulate the intermediate certificate. Note that there may be more than one CA in the middle. The upper-level CA also issues certificates to the lower-level CA according to the same logic. In this case, the intermediate CA is RapidSSL RSA CA 2018, which issues certificates to end users.

  • End-user: indicates the end user (certificate). The end certificate in the figure is the digital certificate used by *.juejin. Im.

You can see that the certificate chain consists of multiple certificates layer by layer. The public key of the end certificate is used to encrypt the packet for the user, and the public key of other certificates is used to decrypt the fingerprint signature of the certificate at the next layer. The root certificate at the highest level is self-signed, that is, issued to itself, so it must be trusted (can’t you trust yourself? ^ ^)

conclusion

The secure network transmission relies on SSL, and the network transmission protocol is HTTP, thus constituting the HTTPS protocol. Symmetric encryption algorithms must be used in HTTPS to ensure efficient communication between the client and the server. However, asymmetric encryption algorithms need to be used in the negotiation process of symmetric encryption algorithms to ensure security. However, asymmetric encryption itself is not secure, and there may be the possibility of middleman tampering with the public key. Therefore, clients and servers do not directly use public keys, but certificates issued by digital certificate issuing authorities to ensure the security of asymmetric encryption. In this way, a symmetric encryption algorithm is negotiated through these mechanisms, and both parties use this algorithm to encrypt and decrypt data transmission, thus solving the communication security problem between the client and the server.

The author simply took you to understand the key points of data security transmission, in fact, there are a lot of points worth in-depth on the topic of security, welcome to give me a message ~ learn together, common progress. Writing is not easy, if this article helps you a little bit, click a like and send me to hot search (#^.^#), so that I have more motivation to continue writing ~

The resources

SSL/TLS protocol: HTTP: / / https://cshihong.github.io/2019/05/09/SSL%E5%8D%8F%E8%AE%AE%E8%AF%A6%E8%A7%A3/