Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How HTTPS Handshake Happens

sudhakar.online

Post reply on HN
Print view View original

91–96 of 96 posts

Re: How HTTPS Handshake Happens

#91

Post by bogomipz »

WhiteSource1 wrote: post #89
bogomipz wrote: post #15

Earlier quoted context omitted.

>"There are some really cool "tricks" for avoiding the round trip — round trips are why everyone should be using a global load balancer for SSL. Clients have to send 2 packets across the world and wait for a reply, which can add >100ms before any actual work happens." What is a "global load balancer"? A load balancer doesn't avoid any round trips. The "work" of TLS begins as soon as the client sends a ClientHello whi…

Why a load balancer and not a CDN? A CDN can definitely help. Here's a good guide to an SSL handshake: https://www.incapsula.com/cdn-guide/cdn-and-ssl-tls.html#ssl... The handshake adds 2+ additional round trips, so a CDN can definitely help this.

Agreed, I said the exact same thing in another comment on this thread.

Re: How HTTPS Handshake Happens

#92

Post by novaleaf »

ivanr wrote: post #83
novaleaf wrote: post #81

Earlier quoted context omitted.

curious, do you know where I can find out how proxy servers negotiate/relay SSL without eavesdropping? I'm trying to figure out how secure proxies communicate but can't find details :)

Well, the default is that TLS traffic cannot be decrypted or interfered with without detection, so no eavesdropping. A proxy can relay traffic at the TCP layer, but it won't be able to see any of the information (except for the parts that are not encrypted). If you do want to eavesdrop, you have several options. For one, you can terminate the TLS traffic, access it, then create another entirely separate TLS session t…

thanks, i don't want to eavesdrop, but looking for technical docs on how a https proxy server really works :) .. something i can use to learn how to implement one.

Re: How HTTPS Handshake Happens

#93

Post by valarauca1 »

jopsen wrote: post #48
valarauca1 wrote: post #13

Earlier quoted context omitted.

TLS 1.3 has a 0rtt handshake, which is pretty baller. It's just not widely deployed. And it likely won't be. 0RTT Allows for replay attacks (I capture your packets, and replay them). Without a round trip this will always exist. Also 0RTT is only for re-connections not initial connections. The solution is only like 0RTT be executed once and only once, but this isn't part of TLSv1.3 and is waiting to _globally_ approve…

Wouldn't 0RTT be safe for GET requests that doesn't contain cookies or private data? Granted I suppose such interpretation would have to be done by browsers. And even then it could be used to figure out which site you are visiting.

You are assuming

* The TLS connection is instantly closed after the GET ends

* A new 0RTT ticket isn't created

* No session information is transmitted (most GET's even have session information for ads/metrics).

Re: How HTTPS Handshake Happens

#94

Post by ivanr »

WhiteSource1 wrote: post #90
ivanr wrote: post #47

As others have already pointed out, this explanation focuses on the RSA key exchange, which has been deprecated. It's not recommended for use with the current line of protocols (TLS 1.2 and earlier) and it's been completely removed from TLS 1.3 (work in progress, but close to being finished). The key weakness of the RSA key exchange is that session encryption keys are transported over the network encrypted with the s…

How much lag and delays do SSL handshakes take and what are some ways to remain secure while minimising latency.

Technically, a full handshake adds 2 RTTs, and it's only one RTT on a successful resumption. In practice, I think that most modern browsers currently use something called False Start, where they cheat and send some data early, so even the full handshake takes only one RTT. False Start works only with a well-configured server.

In TLS 1.3, the full handshake is one RTT without any tricks; resumption also. There is also a 0-RTT resumption, but it sacrifices security for speed. Lots of people are unhappy about it.

Re: How HTTPS Handshake Happens

#95

Post by ivanr »

britcruise wrote: post #73
ivanr wrote: post #47

As others have already pointed out, this explanation focuses on the RSA key exchange, which has been deprecated. It's not recommended for use with the current line of protocols (TLS 1.2 and earlier) and it's been completely removed from TLS 1.3 (work in progress, but close to being finished). The key weakness of the RSA key exchange is that session encryption keys are transported over the network encrypted with the s…

Hey Ivan, thanks for sharing my video :)

Hey, thanks for creating it. It's fantastic!
Post reply on HN