In the Information Security secure/protected communication is essential to keep the CIA triangle (confidentiality, integrity and availability). When its come to secure communication encryption and hashing are the main important mechanisms. Hashing is a one way conversion, that means we can’t recover the original information (e.g. Passwords inside the database). Encryption is a 2 way conversion, that means data can locked and it can be retrieve again to its original form. Encryption can be done in 2 ways such as symmetric encryption and asymmetric encryption.
What is Symmetric Encryption?
It is a simple encryption method. Here it is having only ONE key for the encryption and decryption. This means if a sender wants to send an information sender and receiver wants to know the same key.
What is Asymmetric Encryption?
It is an advance method for the encryption and decryption. Here it is managing TWO keys, such as public key and the private key. If a sender wants to send a message to the receiver, sender can get the receiver’s public key freely. Then encrypt the information using the received public key and this cipher/encrypted informations can be decrypt only by using the receivers private key (private keys are confidential and secret for the receivers).
SSL – Secure Socket Layer
This is a layer which is establishing the encrypted information sharing between the server and the client. As we can say a user is typing a web address in a browser and the browser send the address to the web server to find that resources/make communication. Here browser and web servers are communicating. When it comes to Information Security we have need to encrypt that communication to prevent eavesdropping. So SSL proving this facility by providing public and private keys for the web server (like as asymmetric encryption). Browser encrypt its messages by using the web servers public key and the server decrypt it using its own public key.
For this secured/encrypted communication the web servers are need to have SSL certificates.
What is SSL certificate?
It is a small digitally bind date file which is containing the organization’s cryptographic keys (public and private keys). After receiving the SSL certificate and install it into the server then it will run under the Secured Hypertext Protocol [https://]. This certificate can valid only for the limited periods.
How to get SSL certificate?
These certificates are issued by the trusted Certificate Authorities – CA of web browsers, operating systems and mobile devices. Web service providers can purchase their SSL certificate by paying money anally for the certificate providers. You can view the list of SSL certificate providers by clicking this link here. CA Authorities.
How to get Self Signed SSL certificate?
Self Signed Certificate means, the SSL certificate which is can be created by the organization itself. It can be created in many ways. But here is a documentation of “How to configure SSL in Apache Tomecat” by using Java Keytool which is an open source.
SSL – Secure Socket Layer overview.
As we said before this is providing the facilities to make the communication confidentially by enforcing public and private keys as asymmetric encryption. When we are comparing both symmetric and asymmetric encryption asymmetric encryption is more secure but the processing time (each public key encryption and decryption by private key) will take more when comparing with symmetric. The problem in the symmetric encryption is the key transaction. So, this SSL make use of the both encryption mechanism to provide secure and efficient communication between server and client.
By SSL, client sends the symmetric key through the asymmetric encryption (because client is the person communicating with the server) to the server and server get/create the same symmetric key by encrypting the information by using its private key. After that the server and the client will communicate each others through the symmetric encryption.
Here is a picture showing how the handshakes occurring between client and server.
Here is a picture showing how the handshakes occurring between client and server.
©IT Today
Comments
Post a Comment