1.1. SSL

SSL (Secure Sockets Layer) is a method of providing secure "client to server" communications over the internet. Its most common use is in web pages using HTTPS but it is also used for applications like FTP, Email & VOIP.
The term TLS (Transport Layer Security) can be used instead of SSL, as it is effectivly SSLv4+ if we're looking at version releases, however as the standard changed, I will use TLS only to describe the current protocol ie TLSv1.2 rather than as the used to describe SSL but I consider it an alternative name, so to be precise, I will refer to TLS by the protocol ie TLSv1.2.

Wiki have some excellent resources in crypto & SSL, so have a look here for a start. This is an excellent free resource.

There are many components of SSL which we will go into such as PKI (Public Key Infrastructure), Ciphers, Protocols, Keys, Hashs (MACs - message authentication header).

1.2. vs IPSEC

IPSEC is a more robust protocol, however IPSEC is used to establish semi-permanent tunnels between networks that allow seamless routing between networks over the internet or private links. SSL is better for individual client to server security, although we will go into SSL as a network VPN later.

1.3. Why Encrypt

Today there is a resonable push to use HTTPS everywhere and I fully agree, not just in a post Snowden apocolpytic error, but in best practises and for your own protection. Even where websites are public and offer no private or sensitive information, an encrypted connection buildes a virtual tunnel to the destination which is resistant against various forms of attacks like MITM (Man in the center) attacks. It also provide confidence that you are connected to the intended destination.

In IP communications, SSL provides a level of security including integrity, privacy & authenticity. Integrity means the data has not been modified in transit, privacy means sniffed traffic hasnt been observed by others for example users and passwords, bank account details, personal information. Authenticity gives you confidence that you are communicating with the intended destination. In SSL Certficate authorities fill this gap, however the true way would be to acquire a SHA or copy of the certificate in a foolproof manner

Benefits:

• Security (all these things working together create personal safety)
• Privacy (protection from copy to read later)
• Assurance (helps confirm you are talking to the person you think you are)
• Integrity (protects data in transit from MITM)
• Trust (business benefit)

Disadvantages:

• Performance (slower data setup & transfer)
• Anti Spying (establishments are less able to track you - also a benefit)
• Integration (many new standards havnt been adopted by software)

1.4. Components

Components of SSL include PKI (Public Key Infrastructure), CA (Certificate Authority), Protocols (tlsv1.2), Keys (RSA), Ciphers (AES), Hashs (SHA). Within each component, many sub components exist which we will look at shortly. They in essence determine the quality of the SSL, and determine if the component is secure by todays analysis, and the likelyhood of them being secure tomorrow. A good example is to think about protecting a password. If you have to change your password every 6 months, and if a super computer could crack SSL in 7 months, then they will never get your password before you change it. The same concept can be applied to data and how long you want it to remain confidential.

1.5. Strength

In this article I refer to two main types of configuration, the first is general best practise where performance & integration is valued, we want SSL because its a good thing to do. The other is paranoid mode where only well proven technolgies are used and the value is real long term security. This website is built in paranoid mode to make a point that SSL should be robust, and its a priviledge to use it, therefore one must update their software to remain priviledged.

In the case of visiting public sites, a low grade fast cipher is sufficient as it provides short-medium term privacy & real time security of the data stream from injection. In banking, one may offset

1.6. Terms

• PKI (Public Key Infrastructure) - allows setting up a secure key with anyone
• CA (Certificate Authority) - the independant body who validate the website belongs to the owner, this gives the green HTTPS in web browsing
• Protocols (SSLv2, SSLv3, TLSv1.0, TLSv1.1, TLSv1.2)
• Ciphers (AES, RC4, ChaCha20, 3DES, Camellia) - the method for creating cyphertext
• Hashes (MD5, SHA, SHA256) - the checksum for every packet