Security and HTTPS

Question 1

Man-In-The-Middle-Attack (MITM attack)

Answer 1

• An attack where the attacker intercepts a line of communication that is thought to be private by its two communicating parties
• MITM attacks are the primary threat that encryption and HTTPS aim to defend against

Question 2

Symmetric Encryption

Answer 2

• It relies on a single key to encrypt/decrypt data
• The key must be known to all communication parties and therefore be shared between them
• The symmetric-key algorithm tends to be faster than the asymmetric ones. The most widely used are part of the Advanced Encryption Standard (AES)
• AES:
  - It’s a widely used standard that has three symmetric-key algorithms: AES-128, AES-192, and AES-256
  - It’s considered the “gold standard” in encryption and is even used by the NSA to encrypt top-secret information

Question 3

Asymmetric Encryption

Answer 3

• Also known as public-key encryption. It relies on two keys (a public key and a private key) to encrypt/decrypt data
• The keys are generated using cryptographic algorithms and are mathematically connected such that data encrypted with the public key can only be decrypted with the private key
• The public key can be openly shared. The private key must be kept secure
• Asymmetric-key algorithms tend to be slower than their symmetric ones

Question 4

HTTPS (Hypertext Transfer Protocol Secure)

Answer 4

• An extension of HTTP used for secure communication online
• Requires servers to have trusted certificates (usually SSL certificates)
• Uses TLS (Transport Layer Security), a security protocol built on top of TCP, to encrypt data transferred between a client and a server
• HTTP over TLS is also known as HTTPS

Question 5

SSL Certificate

Answer 5

• A digital certificate granted to a server by a certificate authority
• Contains the servers’ public key, to be used in the TLS handshake process in an HTTPS connection
• Effectively confirms that a public key belongs to the server that claims so
• Certificate Authority:
  - It’s a trusted entity that signs digital certificates
  - Browsers usually have all public keys of all certificate authorities

Question 6

TLS Handshake

Answer 6

• The process through which a client and a server using HTTPS communication exchange encryption-related information and establish a secure communication
• Typical steps:
  - The client sends a “client hello” (a string of random bytes) to the server
  - The server responds with a “server hello” (another string of random bytes) as well as its SSL certificate, which contains its public key
  - The client verifies that the certificate was issued by a CA and sends a premaster secret to the server. This key is another string of random bytes encrypted with the server’s public key
  - The client and the server use the “client hello”, the “server hello”, and the “premaster secret” to generate the same symmetric-encryption session keys, to be used to encrypt/decrypt all data transferred during the remainder of the connection