IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 5.66 Use of SSL
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators, users
The most commonly used security protocol in relation to use of the WWW is
SSL (Secure Socket Layer). SSL was developed by Netscape, and is supported
by all relatively up-to-date browsers. Connections can be secured with SSL in
various ways:
- By encryption of the connection content
- By checking the completeness and correctness of the transferred data
- By checking the identity of the servers
- Optionally by checking the identity of the client end
With SSL, a connection is set up between a user's browser and a provider's
server, via which first of all the certificates with the public keys are
exchanged. Next a symmetric key is exchanged by secure means, protected by
the asymmetric encryption procedure RSA. A symmetric procedure is then
used for the encryption of the actual data transmission, because these can
encrypt large quantities of data faster. A different symmetric key is negotiated
as the session key for each transaction; this is used to encrypt the connection.
A hash procedure can also be used during data transmission for the purpose of
data compression.
The ways that a user can recognise Web pages which allow SSL-secured data
transmission include for example the fact that an "s" is added to the address
(https://www...), that the key at the lower edge of the screen in Netscape
Navigator, usually shown broken, is now joined together, or that in Internet
Explorer the padlock is shown closed instead of open.
The use of SSL is not restricted to HTTP clients and servers. Applications
such as Telnet or FTP can also use SSL for secure communications. This does
require, however, that the clients and servers concerned have each been
adapted to do this.
SSL consists of two layers. The SSL handshake protocol operates on the upper
layer. This is used by the client and the server to identify and authenticate
themselves to each other, and to negotiate a key and an encryption algorithm
to be used for the subsequent data communication traffic. The lower layer, the
SSL record protocol, which forms the interface to the TCP layer, encrypts and
decrypts the actual data traffic. Because SSL sits on the socket interface for
access to TCP and replaces this interface with an enhanced-security version, it
can also be used for other services. As a result, SSL also runs transparently in
the background of any Internet service. Users only need to have active
involvement when selecting a certificate. In contrast with S-HTTP, therefore,
they do not have the opportunity to configure the security functions and adapt
them to their specific security requirements. On the other hand, SSL may
appear to be more convenient to users who do not want to be held up by the
configuration of security functions every time there is a Web query.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000