Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How HTTPS Handshake Happens

sudhakar.online

Post reply on HN
Print view View original

21–30 of 96 posts

Re: How HTTPS Handshake Happens

#21

Post by bogomipz »

TheSwordsman wrote: post #16
bogomipz wrote: post #15

Earlier quoted context omitted.

>"There are some really cool "tricks" for avoiding the round trip — round trips are why everyone should be using a global load balancer for SSL. Clients have to send 2 packets across the world and wait for a reply, which can add >100ms before any actual work happens." What is a "global load balancer"? A load balancer doesn't avoid any round trips. The "work" of TLS begins as soon as the client sends a ClientHello whi…

I assume a load balancing / caching solution that is available on an anycast IP address. The TLS termination happens at the (ideally) closest point of presence (PoP). The idea is to reduce the RTT from client to its termination point. Think CloudFlare CDN or the Google Cloud Load Balancer. Edit Mistyped RTT as TTL.

Sure, you can reduce the RTT by moving the edge closer to the eyeballs but that's not the same as avoiding an RTT as the OP stated. That's what all I was commenting on. There are mechanisms however to do that such as sessions tickets/resumption but that's not something specific to load balancers.

Re: How HTTPS Handshake Happens

#22

Post by detaro »

nodesocket wrote: post #4
mrkurt wrote: post #2

There are some really cool "tricks" for avoiding the round trip — round trips are why everyone should be using a global load balancer for SSL. Clients have to send 2 packets across the world and wait for a reply, which can add >100ms before any actual work happens. http2 helps because you can multiplex a bunch of requests into a single connection, less waiting on new connections to be established. TLS 1.2 with sessio…

Any idea when TLS 1.3 will be supported in NGINX? What browsers support it as well?

It already is, if you build 1.13 with the right OpenSSL.

https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_...

https://github.com/tlswg/tls13-spec/wiki/Implementations

Re: How HTTPS Handshake Happens

#24

Post by schoen »

usmannk wrote: post #8
cabaalis wrote: post #5

Genuinely curious, as HTTPS is something I do not fully understand even with this simplification: If the browser's symmetric key is encrypted with icicibank's public key, why can't a sniffer unlock it by also requesting icicibank's public key and decrypting the key sharing message?

The payload is encrypted with the bank's public key but it can only be decrypted with their private key. This is the basis of public key cryptography [1]. [1] https://en.wikipedia.org/wiki/Public-key_cryptography

It's quite counterintuitive that this is possible at all. We didn't even know a way to make it work until the 1970s!

Re: How HTTPS Handshake Happens

#25

Post by usaphp »

had2makeanacct wrote: post #23

http://sudhakar.online/visualization/2011/10/11/wedding-invi... Found this on this site, parallax.js wedding invitation. This is cool, how hard is it to learn how to do this?

Pretty simple actually, you have 3 images stacked on top of each other, then you track mouse movement and change absolute position of those images in relation to each other depending on mouse movement.

p.s. In this example they are changing margins and top/bottom/left/right positions, which is not really a good way to do it, a better way to it is using transform: translate(), it's less resource intensive and especially when you use translate3d. You can read more about the performance difference between using top/left/bottom/right and translate() : https://www.paulirish.com/2012/why-moving-elements-with-tran...

Re: How HTTPS Handshake Happens

#26

Post by lowleveldesign »

If you are interested in details of the TLS protocol, check out these two books:

- Implementing SSL / TLS Using Cryptography and PKI [1]

- Bulletproof SSL and TLS: Understanding and Deploying SSL/TLS and PKI to Secure Servers and Web Applications [2]

In the first one the author implements the protocol (RSA/DH) from scratch (without even using any crypto library). The second one is a classic and contains a lot of interesting scripts (the chapter on using OpenSSL and creating your own PKI is available for free: https://www.feistyduck.com/books/openssl-cookbook/).

I spent some time studying TLS and wrote two blog posts [3][4], in which I decrypt the network traces of the TLS sessions. Maybe someone will find them interesting too.

[1] https://www.amazon.com/Implementing-SSL-TLS-Using-Cryptograp...

[2] https://www.amazon.com/gp/product/1907117040

[3] https://lowleveldesign.org/2016/03/09/manually-decrypting-ht...

[4] https://lowleveldesign.org/2016/05/10/tls-1-2-aes-gcm-and-ne...

Re: How HTTPS Handshake Happens

#27

Post by dotancohen »

lowleveldesign wrote: post #26

If you are interested in details of the TLS protocol, check out these two books: - Implementing SSL / TLS Using Cryptography and PKI [1] - Bulletproof SSL and TLS: Understanding and Deploying SSL/TLS and PKI to Secure Servers and Web Applications [2] In the first one the author implements the protocol (RSA/DH) from scratch (without even using any crypto library). The second one is a classic and contains a lot of inte…

I haven't read the books, and I'm sure that they are fascinating, but I am wary of any attempt to home-brew crypto. I'm specifically worried that some corner-cutters might use the Implementing SSL book's code or ideas in production.

Re: How HTTPS Handshake Happens

#28

Post by mattlondon »

cabaalis wrote: post #5

Genuinely curious, as HTTPS is something I do not fully understand even with this simplification: If the browser's symmetric key is encrypted with icicibank's public key, why can't a sniffer unlock it by also requesting icicibank's public key and decrypting the key sharing message?

Just to clarify other people's responses to make this ultra clear for people learning:

- stuff encrypted with the private key can only be decrypted using the public key.

- stuff encrypted with the public key can only be decrypted using the private key.

This is why the public key can be distributed around freely and anyone can use it to encrypt, because only the person with the private key can decrypt it (and this is why you really need to keep your private key secure!)

The flip side is anyone can decrypt something encrypted with the private key (since the public key is widely known). But this is how we can verify that the other server really is who they say they are - remember that the public key can only decrypt stuff encrypted with the private key, so if we can decrypt something from the server then we know that they encrypted it using the private key and are therefore probably legit (...or the private key got leaked or CIA/Snowdon etc)

Enjoy learning! :)

Re: How HTTPS Handshake Happens

#29

Post by lowleveldesign »

dotancohen wrote: post #27
lowleveldesign wrote: post #26

If you are interested in details of the TLS protocol, check out these two books: - Implementing SSL / TLS Using Cryptography and PKI [1] - Bulletproof SSL and TLS: Understanding and Deploying SSL/TLS and PKI to Secure Servers and Web Applications [2] In the first one the author implements the protocol (RSA/DH) from scratch (without even using any crypto library). The second one is a classic and contains a lot of inte…

I haven't read the books, and I'm sure that they are fascinating, but I am wary of any attempt to home-brew crypto. I'm specifically worried that some corner-cutters might use the Implementing SSL book's code or ideas in production.

I'm also against home-brew crypto, but the author clearly states that what he presents has only educational purpose. It's a bit like cryptopals - you also implement your own crypto in order to learn something.

Re: How HTTPS Handshake Happens

#30

Post by farax91 »

dotancohen wrote: post #27
lowleveldesign wrote: post #26

If you are interested in details of the TLS protocol, check out these two books: - Implementing SSL / TLS Using Cryptography and PKI [1] - Bulletproof SSL and TLS: Understanding and Deploying SSL/TLS and PKI to Secure Servers and Web Applications [2] In the first one the author implements the protocol (RSA/DH) from scratch (without even using any crypto library). The second one is a classic and contains a lot of inte…

I haven't read the books, and I'm sure that they are fascinating, but I am wary of any attempt to home-brew crypto. I'm specifically worried that some corner-cutters might use the Implementing SSL book's code or ideas in production.

I don't think that's the point of the book. There is enormous benefit that can be gleaned from building a "workable" implementation from first principles, even if it's not actually production "workable". These types of books are rare and very challenging to write, will definitely be taking a look.
Post reply on HN