Preface.
1. Security Concepts.
Introduction. The Internet Threat Model. The Players. The Goals of
Security. Tools of the Trade. Putting It All Together. A Simple
Secure Messaging System. A Simple Secure Channel. The Export
Situation. Real Cryptographic Algorithms. Symmetric Encryption:
Stream Ciphers. Symmetric Encryption: Block Ciphers. Digest
Algorithms. Key Establishment. Digital Signature. MACs. Key Length.
Summary.
2. Introduction to SSL.
Introduction. Standards and Standards Bodies. SSL Over view.
SSL/TLS Design Goals. SSL and the TCP/IP Suite. SSL History. SSL
for the Web. Everything over SSL. Getting SSL. Summary.
3. Basic SSL.
Introduction. SSL Over view. Handshake. SSL Record Protocol.
Putting the Pieces Together. A Real Connection. Some More
Connection Details. SSL Specification Language. Handshake Message
Structure. Handshake Messages. Key Derivation. Record Protocol.
Alerts and Closure. Summary.
4. Advanced SSL.
Introduction. Session Resumption. Client Authentication. Ephemeral
RSA. Rehandshake. Server Gated Cryptography. DSS and DH. Elliptic
Curve Cipher Suites. Kerberos. FORTEZZA. The Story So Far. Session
Resumption Details. Client Authentication Details. Ephemeral RSA
Details. SGC Details. DH/DSS Details. FORTEZZA Details. Error
Alerts. SSLv2 Backward Compatibility. Summary.
5. SSL Security.
Introduction. What SSL Provides. Protect the master_secret. Protect
the Server's Private Key. Use Good Randomness. Check the
Certificate Chain. Algorithm Selection. The Story So Far.
Compromise of the master_secret. Protecting Secrets in Memory.
Securing the Server's Private Key. Random Number Generation.
Certificate Chain Verification. Partial Compromise. Known Attacks.
Timing Cryptanalysis. Million Message Attack. Small-Subgroup
Attack. Downgrade to Export. Summary.
6. SSL Performance.
Introduction. SSL Is Slow. Performance Principles. Cryptography Is
Expensive. Session Resumption. Handshake Algorithm and Key Choice.
Bulk Data Transfer. Basic SSL Performance Rules. The Story So Far.
Handshake Time Allocation. Normal RSA Mode. RSA with Client
Authentication. Ephemeral RSA. DSS/DHE. DSS/DHE with Client
Authentication. Performance Improvements with DH. Record
Processing. Java. SSL Servers under Load. Hardware Acceleration.
Inline Hardware Accelerators. Network Latency. The Nagle Algorithm.
Handshake Buffering. Advanced SSL Performance Rules. Summary.
7. Designing with SSL.
Introduction. Know What You Want to Secure. Client Authentication
Options. Reference Integrity. Inappropriate Tasks. Protocol
Selection. Reducing Handshake Overhead. Design Strategy. The Story
So Far. Separate Ports. Upward Negotiation. Downgrade Attacks.
Reference Integrity. Username/Password Authentication. SSL Client
Authentication. Mutual Username/Password Authentication.
Rehandshake. Secondary Channels. Closure. Summary.
8. Coding with SSL.
Introduction. SSL Implementations. Sample Programs. Context
Initialization. Client Connect. Server Accept. Simple I/O Handling.
Multiplexed I/O Using Threads. Multiplexed I/O with select().
Closure. Session Resumption. What's Missing? Summary.
9. HTTP over SSL.
Introduction. Securing the Web. HTTP. HTML. URLs. HTTP Connection
Behavior. Proxies. Virtual Hosts. Protocol Selection. Client
Authentication. Reference Integrity. HTTPS. HTTPS Overview. URLs
and Reference Integrity. Connection Closure. Proxies. Virtual
Hosts. Client Authentication. Referrer. Substitution Attacks.
Upgrade. Programming Issues. Proxy CONNECT. Handling Multiple
Clients. Summary.
10. SMTP over TLS.
Introduction. Internet Mail Security. Internet Messaging Overview.
SMTP. RFC 822 and MIME. E-Mail Addresses. Mail Relaying. Virtual
Hosts. MX Records. Client Mail Access. Protocol Selection. Client
Authentication. Reference Integrity. Connection Semantics.
STARTTLS. STARTTLS Overview. Connection Closure. Requiring TLS.
Virtual Hosts. Security Indicators. Authenticated Relaying.
Originator Authentication. Reference Integrity Details. Why Not
CONNECT? What's STARTTLS Good For? Programming Issues. Implementing
STARTTLS. Server Startup. Summary.
11. Contrasting Approaches.
Introduction. The End-to-End Argument. The End-to-End Argument and
SMTP. Other Protocols. IPsec. Security Associations. ISAKMP and
IKE. AH and ESP. Putting It All Together: IPsec. IPsec versus SSL.
Secure HTTP. CMS. Message Format. Cryptographic Options. Putting It
All Together: S-HTTP. S-HTTP versus HTTPS. S/MIME. Basic S/MIME
Formatting. Signing Only. Algorithm Choice. Putting It All
Together: S/MIME. Implementation Barriers. S/MIME versus SMTP/TLS.
Choosing the Appropriate Solution. Summary.
Appendix A: Example Code.
Chapter 8. Examples. Java Examples. Chapter 9. HTTPS Examples.
mod_ssl Session Caching.
Appendix B: SSLv2.
Introduction. SSLv2 Overview. Missing Features. Security Problems.
PCT. What about SSLv1?
Bibliography.
Index. 0201615983T04062001
Secure Sockets Layer (SSL) is used in virtually every commercial web browser and server. In this book, one of the world's leading network security experts explains how SSL works -- and gives implementers step-by-step guidance and proven design patterns for building secure systems with SSL. Eric Rescorla also provides the first in-depth introduction to Transport Layer Security (TLS), the highly anticipated, maximum-security successor to SSL. Rescorla starts by introducing SSL's fundamentals: how it works, and the threats it is intended to address. One step at a time, he addresses each key SSL concept and technique, including cryptography, SSL performance optimization, designing and coding, and how to work around SSL's limitations. Rescorla demonstrates TLS at work in SMTP-based Internet security applications. The book includes detailed examples of SSL/TLS implementations, with in-depth insight into the key design choices that informed them. For all network and security designers, enterprise developers, system implementers, and suppliers of Internet security products and services.
Eric Rescorla is an Internet security consultant and
author of several commercial SSL implementations, including the
freely available Java PureTLS toolkit. He is also the author of
HTTP over TLS and Secure HTTP IETF RFCs.
0201615983AB04062001
Ask a Question About this Product More... |