slide1 n.
Skip this Video
Loading SlideShow in 5 Seconds..
W E B S E C U R I T Y PowerPoint Presentation
Download Presentation

Loading in 2 Seconds...

play fullscreen
1 / 45

W E B S E C U R I T Y - PowerPoint PPT Presentation

  • Uploaded on

W E B S E C U R I T Y. CONTENTS. Web Security Considerations SSL (Secure Socket Layer) TLS (Transport Layer Security) SET (Secure Electronic Transaction) Ending Words. WEB SECURITY CONSIDERATIONS. MUSARRAT NAZ SANIA HAROON MUHAMMAD HANIF AHMED FARDEEN.

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
Download Presentation

PowerPoint Slideshow about 'W E B S E C U R I T Y' - adem

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
w e b s e c u r i t y


  • Web Security Considerations
  • SSL (Secure Socket Layer)
  • TLS (Transport Layer Security)
  • SET (Secure Electronic Transaction)
  • Ending Words









web security considerations

Web security is fundamentally a client/server application running over the Internet and TCP/IP intranets

  • The WEB is very visible.
  • Complex software hide many security flaws.
  • Web servers are easy to configure and manage.
  • Users are not aware of the risks.
web security threats
Web Security Threats:
  • Security threats faced in using the web
  • One way
  • Active attacks
  • Passive attacks
  • 2. Another way
  • Classify location of the threat
  • e.g Web server, Web browser, and network traffic between browser and server
web traffic security approaches
Web Traffic Security Approaches:
  • Web security provide to use IP security
  • Advantage of using IPSec is that is transparent to end users and applications
  • IPSec includes a filtering capability so that only selected traffic need incur the overhead of IPSec processing

Web Traffic Security Approaches:

  • The foremost example of this approach is Secure Sockets Layer (SSL) and Transport Layer Security (TLS)
  • SSL or TLS could be provided protocol suite
  • SSL can be embedded in specific packages
secure socket layer ssl protocol
Secure Socket Layer (SSL) Protocol:
  • SSL was originated by Netscape
  • TLS working group was formed within IETF (Internet Engineering Task Force).
  • SSL is designed to make use of TCP to provide reliable end-to-end secure service.
  • SSL is not a single layer protocol but rather two layers of protocols.
ssl concept
SSL Concept:

Connection: A connection is a transport that provides a suitable type of service.

Session: An SSL session is an associated between a client and a server.

Web client

Web server

ssl record protocol
SSL Record Protocol:
  • Provides basic security services to various higher-layer protocols.
  • HTTP
  • Handshake Protocol
  • Change Cipher Spec Protocol
  • Alert Protocol
  • Provides 2 services for SSL connections:
  • Confidentiality: Handshake protocol defines a shared secret key used for conventional encryption of SSL payloads.
  • Message Integrity: Handshake protocol also defines a shared secret key used to form a message authentication code (MAC).
higher layer protocols
Higher-Layer Protocols:

1. Handshake Protocol:

  • The most complex part of SSL.
  • Allows the server and client to authenticate each other.
  • Negotiate encryption, MAC algorithm and cryptographic keys.
  • Used before any application data are transmitted.

2. Change Cipher Spec Protocol

    • Use SSL record protocol
    • Update the cipher suite to be used on this connection
  • 3. Alert Protocol
    • Used to convey SSL-related
    • alerts to the peer entity.
transport layer security tls
Transport Layer Security (TLS):
  • The same record format as the SSL record format.
  • Defined in RFC 2246.
  • Similar to SSLv3.
  • IETF (Internet Engineering Task Force) formed a TLS working group
  • First version of TLS can be viewed as an SSLv3.1
  • TLS mandated the use of DSS instead of RSA

Differences in the:

    • version number
    • message authentication code
    • pseudorandom function
    • alert codes
    • cipher suites
    • client certificate types
    • certificate_verify and finished message
    • cryptographic computations
    • padding
version number
Version number:
  • The TLS record format is the same as that of the SSL Record Format, and the fields in the header have the same meanings
  • The one difference is in version values
  • For the current version of TLS, the Major Version is 3 and Minor Version is 1
message authentication code
Message Authentication Code:
  • Two difference between SSLv3 and TLS MAC schemes:
  • -actual algorithm
  • -scope of the MAC calculation
  • TLS makes HMAC algorithm
  • HMAC is defined in RFC 2104
pseudorandom function
Pseudorandom Function:
  • TLS makes use of pseudorandom function referred to as PRF to expand secrets into block of data for purpose of key generation or validation
  • The objective is to make use of relatively small shared secret value but to generate longer blocks of data that is secure from the kinds of attacks made on hash function and MACs
  • The PRF is based on following data expansion function:
  • p_hash(secret, seed)=HMAC_hash (secret, A(1)||seed) ||
  • HMAC_hash (secret, A(2)||seed) ||
  • HMAC_hash (secret, A(3)||seed) ||
alert codes
Alert Codes:
  • TLS support all of alert codes defined in SSLv3 with the exception of no_certificate
  • A number of additional codes defined in TLS; the following:

8. Insufficient_security

9. Internal_error

  • Decryption _failed
  • Record_overflow
  • Unknown_ca
  • Access_denied
  • Decode_error
  • Export_restriction
  • Protocol_version
cipher suites
Cipher Suites:
  • There are several small difference between Cipher Suites available under SSLv3 and under TLS:
  • Key Exchange
  • Symmetric Encryption Algorithm
client certificate types
Client Certificate Types:
  • TLS defines following certificate types to be requested in a certificate_request message:
  • rsa_sign
  • dss_sign
  • rsa_fixed_dh
  • dss_fixed_dh
  • SSlv3 includes rsa_ephemeral, dss_ephemeral_dh and fortezza_kea
  • TLS does not include fortezza scheme
certificate verify and finished message
Certificate_Verify and Finished Message:
  • TLS certificate_verify message, the MD5 and SHA-1 hashes are calculated only over handshake_messages
  • Hash calculation also include master secret and pads
  • TLS finished message is a hash based on shared master_secret, the previous handshake message, and label that identifies client or server
cryptographic computations
Cryptographic computations:
  • The pre_master_secret for TLS is calculated in the same way as in SSLv3
  • In SSLv3, the master secret in TLS is calculated as a hash function of pre_master_secret and two hello random numbers
  • TLS calculation is different from that of SSLv3 and is defined:
  • master_secret=PRF(pre_master_secret. “master secret”,
  • ClientHello.random || ServerHello.random)
  • In TLS, the padding can be any amount that result in a total that is a multiple of the cipher’s block length, up to maximum of 255 bytes
  • In SSL, the padding added prior to encryption of user data is the minimum amount required so that total size of the data to be encrypted is a multiple of the cipher’s block length
secure electronic transactions set
Secure Electronic Transactions (SET):
  • An open encryption and security specification.
  • Protect credit card transaction on the Internet.
  • Companies involved:
    • MasterCard, Visa, IBM, Microsoft, Netscape, RSA, Terisa and Verisign
  • Not a payment system.
  • Set of security protocols and formats.
set services
SET Services:
  • Provides a secure communication channel in a transaction.
  • Provides tust by the use of X.509v3 digital certificates.
  • Ensures privacy.
set overview
SET Overview:

A good way to begin of SET is to look at the business requirement for SET, its key features, and participants in SET transaction

  • Key Features of SET:
    • Confidentiality of information
    • Integrity of data
    • Cardholder account authentication
    • Merchant authentication
sequence of events for transactions
Sequence of events for transactions:
  • The customer opens an account.
  • The customer receives a certificate.
  • Merchants have their own certificates.
  • The customer places an order.
  • The merchant is verified.
  • The order and payment are sent.
  • The merchant request payment authorization.
  • The merchant confirm the order.
  • The merchant provides the goods or service.
  • The merchant requests payments.
payment processing
Payment processing:

Cardholder sends Purchase Request

payment processing1
Payment processing:

Merchant Verifies Customer Purchase Request

payment processing2
Payment processing:
  • Payment Authorization:
    • Authorization Request
    • Authorization Response
  • Payment Capture:
    • Capture Request
    • Capture Response
ending words
Ending Words…
  • Describes considerations of Web Security
  • Presented Web security threats and approaches for web traffic security.
  • Then focus on two standardized schemes that are becoming increasingly important as part of Web Commerce: SSL/TLS and SET.