Anonymous, bureaucrat, administrator
7,528
edits
Changes
Created page with "= Overview = This article goes into some of the detail of what happens when you first connect to bxp at a technical level and provides links to relevant material. This is c..."
= Overview =
This article goes into some of the detail of what happens when you first connect to bxp at a technical level and provides links to relevant material. This is considered a very technical article for those who really want to delve into security of bxp.
= Connection =
The article describes what happens when you open your browser and go to ww3.allnone.ie/demo
== The browser ==
First thing is the browser that you use will need access to the Internet. We're going to assume this is in place. As part of this your operating system will have access to public DNS records. Your system will translate ww3.allnone.ie into 82.195.138.166
== The protocol ==
If you connect to bxp via http on port 80, all of the pages have intelligence to redirect your URL to the https equivalent and swap you seamlessly to port 443. No processing at all is done on a http connection.
== The handshake ==
In order for you to get the web page, a secure https handshake is performed.
[[File:hpbn_0402.png]]
http://orm-chimera-prod.s3.amazonaws.com/1230000000545/images/hpbn_0402.png
=== ClientHello ===
As part of the ClientHello a number of details are sent by your browser to the server.
* ClientVersion 3,1
* ClientRandom[32]
* SessionID: None (new session)
* Suggested Cipher Suites:
* TLS_RSA_WITH_3DES_EDE_CBC_SHA
* TLS_RSA_WITH_DES_CBC_SHA
* Suggested Compression Algorithm: NONE
https://technet.microsoft.com/en-us/library/cc785811%28v=ws.10%29.aspx
Those Cipher Suites are encryption methods. There are many available. See below for the suite currently supported by bxp
=== ServerHello ===
bxp responds with a ServerHello and the selected suite to use
* Version 3,1
* ServerRandom[32]
* SessionID: bd608869f0c629767ea7e3ebf7a63bdcffb0ef58b1b941e6b0c044acb6820a77
* Use Cipher Suite:
* TLS_RSA_WITH_3DES_EDE_CBC_SHA
* Compression Algorithm: NONE
As part of this, the server sends a public key for the client browser to now encrypt all communications with.
=== ClientKeyExchange ===
Using the public server key, the client encrypts and responds, sending the client's public key.
=== ChangeCipherSpec ===
The server sends a complete encryption of the transaction to date, using the client public key and now data can begin to pass.
= Security challenges =
== Browser protocols ==
Different browsers support a number of encryption suites. Imagine it like a language. The options most commonly available are.
* SSL 1.0
* SSL 2.0
* SSL 3.0
* TLS 1.0
* TLS 1.1
* TLS 1.2
For security reasons and the ease of mathematics, all the SSL methods currently are easily unencrypted using brute force hacking.
Even TLS 1.0 is not considered secure as using brute force hacking could still break it in a reasonable amount of time.
TLS 1.2 is the target.
IE6 only supports up to TLS 1.0 and must be turned on explicitly.
== Encryption Algorithms ==
Within the language are encryption methods. This vary in complexity. The are some encryption methods stronger than others. The protocols make use of these algorithms.
Here is an extensive listing of the encryptions (cipher suites) available for each protocol.
https://www.openssl.org/docs/manmaster/apps/ciphers.html
As security improves it is important to check how secure your protocols and suite are. Qualys provide an excellent testing tool. https://www.ssllabs.com/ssltest/
Windows 2000 has none of the algorithms used by TLS 1.2, so even if you install a modern browser which can do TLS 1.2 on a Windows 2000 machine, it doesn't have the maths to do the encryption. Windows XP can do TLS 1.2 with Service Pack 3 or 4 installed.
= Current Ciper Suite on bxp =
[[Category:Topic:Security]]
This article goes into some of the detail of what happens when you first connect to bxp at a technical level and provides links to relevant material. This is considered a very technical article for those who really want to delve into security of bxp.
= Connection =
The article describes what happens when you open your browser and go to ww3.allnone.ie/demo
== The browser ==
First thing is the browser that you use will need access to the Internet. We're going to assume this is in place. As part of this your operating system will have access to public DNS records. Your system will translate ww3.allnone.ie into 82.195.138.166
== The protocol ==
If you connect to bxp via http on port 80, all of the pages have intelligence to redirect your URL to the https equivalent and swap you seamlessly to port 443. No processing at all is done on a http connection.
== The handshake ==
In order for you to get the web page, a secure https handshake is performed.
[[File:hpbn_0402.png]]
http://orm-chimera-prod.s3.amazonaws.com/1230000000545/images/hpbn_0402.png
=== ClientHello ===
As part of the ClientHello a number of details are sent by your browser to the server.
* ClientVersion 3,1
* ClientRandom[32]
* SessionID: None (new session)
* Suggested Cipher Suites:
* TLS_RSA_WITH_3DES_EDE_CBC_SHA
* TLS_RSA_WITH_DES_CBC_SHA
* Suggested Compression Algorithm: NONE
https://technet.microsoft.com/en-us/library/cc785811%28v=ws.10%29.aspx
Those Cipher Suites are encryption methods. There are many available. See below for the suite currently supported by bxp
=== ServerHello ===
bxp responds with a ServerHello and the selected suite to use
* Version 3,1
* ServerRandom[32]
* SessionID: bd608869f0c629767ea7e3ebf7a63bdcffb0ef58b1b941e6b0c044acb6820a77
* Use Cipher Suite:
* TLS_RSA_WITH_3DES_EDE_CBC_SHA
* Compression Algorithm: NONE
As part of this, the server sends a public key for the client browser to now encrypt all communications with.
=== ClientKeyExchange ===
Using the public server key, the client encrypts and responds, sending the client's public key.
=== ChangeCipherSpec ===
The server sends a complete encryption of the transaction to date, using the client public key and now data can begin to pass.
= Security challenges =
== Browser protocols ==
Different browsers support a number of encryption suites. Imagine it like a language. The options most commonly available are.
* SSL 1.0
* SSL 2.0
* SSL 3.0
* TLS 1.0
* TLS 1.1
* TLS 1.2
For security reasons and the ease of mathematics, all the SSL methods currently are easily unencrypted using brute force hacking.
Even TLS 1.0 is not considered secure as using brute force hacking could still break it in a reasonable amount of time.
TLS 1.2 is the target.
IE6 only supports up to TLS 1.0 and must be turned on explicitly.
== Encryption Algorithms ==
Within the language are encryption methods. This vary in complexity. The are some encryption methods stronger than others. The protocols make use of these algorithms.
Here is an extensive listing of the encryptions (cipher suites) available for each protocol.
https://www.openssl.org/docs/manmaster/apps/ciphers.html
As security improves it is important to check how secure your protocols and suite are. Qualys provide an excellent testing tool. https://www.ssllabs.com/ssltest/
Windows 2000 has none of the algorithms used by TLS 1.2, so even if you install a modern browser which can do TLS 1.2 on a Windows 2000 machine, it doesn't have the maths to do the encryption. Windows XP can do TLS 1.2 with Service Pack 3 or 4 installed.
= Current Ciper Suite on bxp =
[[Category:Topic:Security]]