Transport and App Layers Security

Does TCP controls the security ?

TCP controls the reliability of the connection but not the security.

What are the services that are mostly attacked on the Web ?

Integrity, Confidentiality and Authentication

What what commercial protocol TLS has evolved ?

Secure Socket Layer (SSL) which is now deprecated but still associated with TLS

What are the two main layers within the TLS protocol stack and what role does each serve?

TLS Record protocol : provides basic security services such as data integrity and confidentiality but also message fragmentation and re-assembly
TLS Other protocols : provide specific security-related services for the management of TLS connections

What are TLS sessions ?

TLS sessions are association between a TLS client and a TLS server created through the TLS Handshake Protocol where the objective is to define a set of cryptographic parameters shared accross multiple TLS connections. It is used to avoid negotiations every time client and server need to connect securely

What are TLS connections ?

TLS connections are a transport channel used to transmit data and are associated with one session

(TLS) How can one session have multiple connections?

By using Session IDs, a client can open multiple connections and attach them to the same pre-established session without performing a full handshake

What are the steps of TLS Record Protocol ?

At the beginning we have oour application data, we fragment it then we compress each fragment, then we add MAC at the end of the fragment and encrypt the whole and append TLS Record Header at the beginning of each fragment

What are the TLS Protocol Headers of :
(a) Change Cipher Spec Protocol
(b) Alert Protocol
(c) Handshake Protocol

(a) there is 1 byte that contains 1 only

(b) there is 1 byte for the Level and 1 byte for the Alert.

(c) there is 1 byte for the Type, 3 bytes for the Length and the rest is the Content

What about TLS Handshake Protocol ?

It is executed before transmitting any data. It is run at the establishment of a TLS session to authenticate the parties, establish the Cipher Specifications and establish keys

Describe the key steps in the TLS Handshake that occur before secure communication can begin.

Phase 1: Establish Security Capabilities
Phase 2: Server Authentication and Key Exchange
Phase 3: Client Authentication and Key Exchange but there are several modes : Ephemeral DH (different key pair for every session, perfect forward secrecy) ; Anonymous DH (no authentication, vulnerable to MITM) and Fixed DH (same key pair across sessions, no forward secrecy)
Phase 4: Finish (verification of successful authentication and key exchange)

What is the Master Secret in TLS, and how is it derived?

The Master Secret is a 48-byte value used by both sides to dervie the actual encryption and MAC keys for the session. It is generated after the DH key agreement and is created by hashing the Pre-Master Secret along with the other exchanged values

What are some changes introduced by TLSv1.3 ?

Removed Compression Option
Removed ChangeCipherSpec protocol (in TLS Handshake)
No RSA for Key Exchange (only for signature)
No MD and SHA-224 for hashing, use of SHA-384
Use of AES-GCM for confidentiality and integrity

What is HTTPS ?

It is a secure version of HTTP which we run over SSL/TLS. It secures communication between client and server and provides Authentication, Confidentiality and Integrity.

During an HTTPS connection, which protocol layer handles the encryption of HTTP messages?

The TLS Record protocol layer handles the encryption. It sits directly between HTTP and TCP encrypting HTTP text before it reaches TCP

What are the three main components of the SSH protocol stack and the main purpose of each?

SSH Transport-Layer Protocol : provides authentication, confidentiality and integrity and authenticates only the server to the client
SSH User Authentication Protocol : authenticates the client to the server
SSH Connection Protocol : combining multiple logical connections into a single encrypted tunnel

What is SSH used for ?

It is a protocol used to connect securely to another host to execute commands remotely or transfer files

What are the steps of SSH TLP Flow ? (very similar to the one of TLS between the client and the server)

Identification String Exchange : string in a precise format, used later for key exchange
Algorithm Negotiation : agreement of algorithms to be used
Key exchange based on DH
End of Key exchange: from this point, packets are secured via the agreed key
Service Request: request to use either the User Authentication or the Connection Protocol.

SSH TLP turns higher level payload into an SSH Packet that will be the payload for the underlying TCP layer. What are the steps ?

Payload can be optionally compressed
MAC value is computed over whole packet and sequence number excluding MAC field
Entire packet excluding MAC field is encrypted

What is the difference between TLS and SSH for the processing of packets ?

For SSH we encrypt then we compute MAC while for TLS we compute MAC then we encrypt

Explain the concepts of local forwarding in SSH. Provide one real-world scenario where each would be useful.

Client and Server redirect traffic to/from SSH ports.
Real-world : connecting to a service on an internal network from the outside

Explain the concepts of remote forwarding in SSH. Provide one real-world scenario where each would be useful.

Packets are directly delivered to SSH port on the server.
Real-world : could be used to give someone on the outside access to an internal web server.

Compare the authentication mechanisms of HTTPS and SSH. In what way is server authentication typically handled in each?

HTTPS relies on a centralized trust model where servers present an X.509 digital certificate signed by a CA. Then the client’s browser verifies the CA’s signature
SSH relies on a decentralized, peer-to-peer model. The first time a client connects, the server presents its public host key and the user manually accept it and saves the key to verify in the future

What cryptographic techniques are used by the TLS Record Protocol to ensure confidentiality and integrity?

AES CBC mode is used to ensure Confidentiality and HMAC is used to ensure Integrity

True or False: TLS 1.3 still supports the use of RSA for key exchange. (Explain why.)

False : RSA key exchange deos not provide Forward Secrecy. If an attacker steal the server’s private RSA key, he can decrypt all historical traffix