if an application developer needs tcp to be enhanced with ssl, what does the developer need to do?

Transport Layer Security (TLS)

Networking 101, Chapter iv

Introduction

The SSL protocol was originally developed at Netscape to enable ecommerce transaction security on the Web, which required encryption to protect customers' personal information, too equally hallmark and integrity guarantees to ensure a safe transaction. To achieve this, the SSL protocol was implemented at the awarding layer, direct on top of TCP (Effigy 4-1), enabling protocols in a higher place information technology (HTTP, email, instant messaging, and many others) to operate unchanged while providing communication security when communicating across the network.

When SSL is used correctly, a third-party observer can only infer the connectedness endpoints, blazon of encryption, as well as the frequency and an approximate amount of data sent, but cannot read or modify whatever of the bodily data.

Figure 4-1. Transport Layer Security (TLS)

When the SSL protocol was standardized by the IETF, it was renamed to Send Layer Security (TLS). Many employ the TLS and SSL names interchangeably, but technically, they are unlike, since each describes a unlike version of the protocol.

SSL two.0 was the commencement publicly released version of the protocol, but it was chop-chop replaced by SSL iii.0 due to a number of discovered security flaws. Because the SSL protocol was proprietary to Netscape, the IETF formed an attempt to standardize the protocol, resulting in RFC 2246, which was published in January 1999 and became known as TLS 1.0. Since then, the IETF has continued iterating on the protocol to accost security flaws, every bit well as to extend its capabilities: TLS 1.ane (RFC 4346) was published in April 2006, TLS 1.2 (RFC 5246) in Baronial 2008, and work is now underway to ascertain TLS ane.3.

That said, don't permit the abundance of versions numbers mislead yous: your servers should always prefer and negotiate the latest stable version of the TLS protocol to ensure the best security, capability, and performance guarantees. In fact, some performance-critical features, such equally HTTP/2, explicitly require the use of TLS 1.2 or higher and will arrest the connectedness otherwise. Expert security and performance get manus in manus.

TLS was designed to operate on summit of a reliable transport protocol such as TCP. Notwithstanding, information technology has also been adjusted to run over datagram protocols such as UDP. The Datagram Transport Layer Security (DTLS) protocol, divers in RFC 6347, is based on the TLS protocol and is able to provide similar security guarantees while preserving the datagram delivery model.

§Encryption, Authentication, and Integrity

The TLS protocol is designed to provide iii essential services to all applications running above it: encryption, authentication, and information integrity. Technically, you are not required to use all three in every situation. You may decide to have a certificate without validating its authenticity, but you should exist well aware of the security risks and implications of doing and then. In practice, a secure web application will leverage all 3 services.

Encryption

A mechanism to obfuscate what is sent from one host to another.

Authentication

A machinery to verify the validity of provided identification material.

Integrity

A mechanism to discover message tampering and forgery.

In order to establish a cryptographically secure data aqueduct, the connectedness peers must agree on which ciphersuites volition be used and the keys used to encrypt the data. The TLS protocol specifies a well-defined handshake sequence to perform this exchange, which nosotros will examine in detail in TLS Handshake. The ingenious office of this handshake, and the reason TLS works in practice, is due to its use of public key cryptography (also known as asymmetric key cryptography), which allows the peers to negotiate a shared undercover key without having to establish any prior knowledge of each other, and to do so over an unencrypted aqueduct.

As office of the TLS handshake, the protocol likewise allows both peers to cosign their identity. When used in the browser, this hallmark mechanism allows the client to verify that the server is who it claims to exist (east.g., your bank) and not someone simply pretending to exist the destination by spoofing its name or IP address. This verification is based on the established chain of trust — see Chain of Trust and Certificate Authorities. In addition, the server tin can also optionally verify the identity of the customer — e.one thousand., a company proxy server tin authenticate all employees, each of whom could have their own unique certificate signed past the company.

Finally, with encryption and hallmark in identify, the TLS protocol also provides its own bulletin framing mechanism and signs each bulletin with a message hallmark code (MAC). The MAC algorithm is a ane-manner cryptographic hash function (effectively a checksum), the keys to which are negotiated past both connexion peers. Whenever a TLS record is sent, a MAC value is generated and appended for that message, and the receiver is then able to compute and verify the sent MAC value to ensure message integrity and actuality.

Combined, all iii mechanisms serve every bit a foundation for secure advice on the Spider web. All mod spider web browsers provide support for a variety of ciphersuites, are able to authenticate both the client and server, and transparently perform message integrity checks for every record.

§HTTPS Everywhere

Unencrypted communication—via HTTP and other protocols—creates a large number of privacy, security, and integrity vulnerabilities. Such exchanges are susceptible to interception, manipulation, and impersonation, and can reveal users credentials, history, identity, and other sensitive data. Our applications need to protect themselves, and our users, confronting these threats by delivering data over HTTPS.

HTTPS protects the integrity of the website

Encryption prevents intruders from tampering with exchanged data—e.thousand. rewriting content, injecting unwanted and malicious content, and then on.

HTTPS protects the privacy and security of the user

Encryption prevents intruders from listening in on the exchanged information. Each unprotected request tin can reveal sensitive information about the user, and when such data is aggregated across many sessions, tin be used to de-anonymize their identities and reveal other sensitive information. All browsing action, every bit far as the user is concerned, should be considered private and sensitive.

HTTPS enables powerful features on the web

A growing number of new web platform features, such as accessing users geolocation, taking pictures, recording video, enabling offline app experiences, and more, require explicit user opt-in that, in turn, requires HTTPS. The security and integrity guarantees provided by HTTPS are critical components for delivering a secure user permission workflow and protecting their preferences.

To further the betoken, both the Net Engineering Chore Force (IETF) and the Internet Architecture Board (IAB) have issued guidance to developers and protocol designers that strongly encourages adoption of HTTPS:

• IETF: Pervasive Monitoring Is an Attack

• IAB: Statement on Internet Confidentiality

As our dependency on the Cyberspace has grown, so have the risks and the stakes for anybody that is relying on it. As a upshot, it is our responsibleness, both every bit the application developers and users, to ensure that we protect ourselves by enabling HTTPS everywhere.

The HTTPS-Only Standard published by the White House's Office of Direction and Upkeep is a great resource for additional information on the demand for HTTPS, and hands-on advice for deploying it.

§TLS Handshake

Before the client and the server can begin exchanging application data over TLS, the encrypted tunnel must exist negotiated: the client and the server must agree on the version of the TLS protocol, choose the ciphersuite, and verify certificates if necessary. Unfortunately, each of these steps requires new packet roundtrips (Figure 4-two) between the client and the server, which adds startup latency to all TLS connections.

Figure 4-2. TLS handshake protocol

Figure 4-two assumes the same (optimistic) 28 millisecond one-way "light in fiber" filibuster between New York and London as used in previous TCP connexion establishment examples; come across Table 1-1.

0 ms

TLS runs over a reliable send (TCP), which means that nosotros must first complete the TCP three-way handshake, which takes 1 full roundtrip.

56 ms

With the TCP connexion in place, the client sends a number of specifications in patently text, such as the version of the TLS protocol it is running, the listing of supported ciphersuites, and other TLS options it may want to use.

84 ms

The server picks the TLS protocol version for further communication, decides on a ciphersuite from the list provided by the client, attaches its certificate, and sends the response dorsum to the client. Optionally, the server can besides transport a request for the client'southward certificate and parameters for other TLS extensions.

112 ms

Assuming both sides are able to negotiate a common version and cipher, and the client is happy with the document provided by the server, the customer initiates either the RSA or the Diffie-Hellman primal exchange, which is used to institute the symmetric key for the ensuing session.

140 ms

The server processes the fundamental exchange parameters sent by the customer, checks bulletin integrity by verifying the MAC, and returns an encrypted Finished message back to the customer.

168 ms

The client decrypts the message with the negotiated symmetric fundamental, verifies the MAC, and if all is well, then the tunnel is established and application data can at present be sent.

As the above exchange illustrates, new TLS connections require two roundtrips for a "full handshake"—that'southward the bad news. Withal, in practice, optimized deployments can do much better and deliver a consequent i-RTT TLS handshake:

• False Start is a TLS protocol extension that allows the client and server to start transmitting encrypted application information when the handshake is only partially complete—i.e., once ChangeCipherSpec and Finished letters are sent, but without waiting for the other side to exercise the same. This optimization reduces handshake overhead for new TLS connections to one roundtrip; encounter Enable TLS False Start.

• If the client has previously communicated with the server, an "abbreviated handshake" tin be used, which requires i roundtrip and also allows the client and server to reduce the CPU overhead by reusing the previously negotiated parameters for the secure session; see TLS Session Resumption.

The combination of both of the above optimizations allows us to deliver a consistent one-RTT TLS handshake for new and returning visitors, plus computational savings for sessions that can be resumed based on previously negotiated session parameters. Make certain to have reward of these optimizations in your deployments.

1 of the design goals for TLS 1.iii is to reduce the latency overhead for setting up the secure connectedness: ane-RTT for new, and 0-RTT for resumed sessions!

§RSA, Diffie-Hellman and Forward Secrecy

Due to a variety of historical and commercial reasons the RSA handshake has been the dominant fundamental substitution mechanism in well-nigh TLS deployments: the client generates a symmetric central, encrypts it with the server's public fundamental, and sends it to the server to apply every bit the symmetric key for the established session. In plough, the server uses its private cardinal to decrypt the sent symmetric key and the key-commutation is complete. From this point frontwards the client and server utilise the negotiated symmetric key to encrypt their session.

The RSA handshake works, only has a disquisitional weakness: the aforementioned public-individual key pair is used both to authenticate the server and to encrypt the symmetric session primal sent to the server. As a result, if an aggressor gains access to the server's private key and listens in on the substitution, and then they can decrypt the the entire session. Worse, even if an assailant does not currently have access to the private key, they can still record the encrypted session and decrypt it at a after time once they obtain the private key.

Past contrast, the Diffie-Hellman fundamental substitution allows the client and server to negotiate a shared hush-hush without explicitly communicating it in the handshake: the server's private key is used to sign and verify the handshake, merely the established symmetric key never leaves the customer or server and cannot be intercepted past a passive attacker even if they accept access to the individual fundamental.

For the curious, the Wikipedia commodity on Diffie-Hellman cardinal exchange is a peachy place to learn about the algorithm and its properties.

Best of all, Diffie-Hellman cardinal exchange can be used to reduce the hazard of compromise of past advice sessions: we can generate a new "ephemeral" symmetric key as part of each and every primal exchange and discard the previous keys. As a result, because the ephemeral keys are never communicated and are actively renegotiated for each the new session, the worst-case scenario is that an attacker could compromise the client or server and access the session keys of the current and future sessions. However, knowing the private cardinal, or the current ephemeral key, does not help the aggressor decrypt any of the previous sessions!

Combined, the use of Diffie-Hellman key exchange and ephemeral sessions keys enables "perfect forward secrecy" (PFS): the compromise of long-term keys (due east.g. server'south individual primal) does not compromise by session keys and does non allow the attacker to decrypt previously recorded sessions. A highly desirable belongings, to say the to the lowest degree!

Equally a result, and this should non come as a surprise, the RSA handshake is now being actively phased out: all the popular browsers prefer ciphers that enable forward secrecy (i.e., rely on Diffie-Hellman key commutation), and equally an boosted incentive, may enable certain protocol optimizations only when forward secrecy is bachelor—e.one thousand. i-RTT handshakes via TLS False Starting time.

Which is to say, consult your server documentation on how to enable and deploy forward secrecy! One time again, good security and operation go mitt in hand.

§Application Layer Protocol Negotiation (ALPN)

Two network peers may want to apply a custom application protocol to communicate with each other. One mode to resolve this is to make up one's mind the protocol upfront, assign a well-known port to information technology (e.g., port lxxx for HTTP, port 443 for TLS), and configure all clients and servers to apply it. Notwithstanding, in practice, this is a boring and impractical process: each port consignment must be approved and, worse, firewalls and other intermediaries oft permit traffic only on ports 80 and 443.

As a issue, to enable piece of cake deployment of custom protocols, we must reuse ports 80 or 443 and use an boosted machinery to negotiate the awarding protocol. Port 80 is reserved for HTTP, and the HTTP specification provides a special Upgrade flow for this very purpose. However, the use of Upgrade can add an extra network roundtrip of latency, and in exercise is ofttimes unreliable in the presence of many intermediaries; see Proxies, Intermediaries, TLS, and New Protocols on the Web.

For a hands-on example of HTTP Upgrade workflow, flip ahead to Upgrading to HTTP/2.

The solution is, you guessed it, to use port 443, which is reserved for secure HTTPS sessions running over TLS. The utilise of an cease-to-cease encrypted tunnel obfuscates the information from intermediate proxies and enables a quick and reliable way to deploy new application protocols. However, we even so demand another machinery to negotiate the protocol that will be used within the TLS session.

Application Layer Protocol Negotiation (ALPN), as the proper name implies, is a TLS extension that addresses this need. It extends the TLS handshake (Figure 4-ii) and allows the peers to negotiate protocols without additional roundtrips. Specifically, the procedure is as follows:

• The customer appends a new ProtocolNameList field, containing the listing of supported application protocols, into the ClientHello message.

• The server inspects the ProtocolNameList field and returns a ProtocolName field indicating the selected protocol as office of the ServerHello message.

The server may respond with only a single protocol proper noun, and if it does not support any that the client requests, and then it may choose to abort the connection. As a result, once the TLS handshake is finished, both the secure tunnel is established, and the customer and server are in agreement as to which awarding protocol will be used; the client and server tin immediately begin exchanging letters via the negotiated protocol.

§Server Name Indication (SNI)

An encrypted TLS tunnel can be established between any two TCP peers: the client only needs to know the IP address of the other peer to make the connection and perform the TLS handshake. However, what if the server wants to host multiple contained sites, each with its own TLS document, on the same IP address — how does that work? Trick question; it doesn't.

To address the preceding problem, the Server Proper name Indication (SNI) extension was introduced to the TLS protocol, which allows the client to indicate the hostname the client is attempting to connect to equally part of the TLS handshake. In turn, the server is able to inspect the SNI hostname sent in the ClientHello message, select the appropriate certificate, and consummate the TLS handshake for the desired host.

§TLS Session Resumption

The extra latency and computational costs of the full TLS handshake impose a serious performance punishment on all applications that require secure advice. To help mitigate some of the costs, TLS provides a mechanism to resume or share the aforementioned negotiated secret primal information between multiple connections.

§Session Identifiers

The first Session Identifiers (RFC 5246) resumption mechanism was introduced in SSL 2.0, which immune the server to create and send a 32-byte session identifier every bit function of its ServerHello message during the full TLS negotiation nosotros saw earlier. With the session ID in place, both the customer and server can store the previously negotiated session parameters—keyed by session ID—and reuse them for a subsequent session.

Specifically, the client can include the session ID in the ClientHello message to bespeak to the server that it still remembers the negotiated nada suite and keys from previous handshake and is able to reuse them. In turn, if the server is able to find the session parameters associated with the advertised ID in its cache, so an abbreviated handshake (Figure iv-3) tin can take place. Otherwise, a full new session negotiation is required, which will generate a new session ID.

Figure 4-3. Abbreviated TLS handshake protocol

Leveraging session identifiers allows united states to remove a total roundtrip, as well every bit the overhead of public key cryptography, which is used to negotiate the shared secret cardinal. This allows a secure connectedness to exist established quickly and with no loss of security, since we are reusing the previously negotiated session data.

Session resumption is an important optimization both for HTTP/one.x and HTTP/ii deployments. The abbreviated handshake eliminates a total roundtrip of latency and significantly reduces computational costs for both sides.

In fact, if the browser requires multiple connections to the same host (e.g. when HTTP/1.x is in use), it will oft intentionally expect for the starting time TLS negotiation to consummate before opening additional connections to the same server, such that they can be "resumed" and reuse the aforementioned session parameters. If y'all've ever looked at a network trace and wondered why you lot rarely see multiple same-host TLS negotiations in flight, that'due south why!

However, one of the practical limitations of the Session Identifiers mechanism is the requirement for the server to create and maintain a session enshroud for every client. This results in several problems on the server, which may see tens of thousands or even millions of unique connections every day: consumed retentiveness for every open TLS connexion, a requirement for a session ID enshroud and eviction policies, and nontrivial deployment challenges for popular sites with many servers, which should, ideally, utilize a shared TLS session cache for all-time functioning.

None of the preceding problems are incommunicable to solve, and many high-traffic sites are using session identifiers successfully today. But for whatsoever multi-server deployment, session identifiers volition require some conscientious thinking and systems architecture to ensure a well operating session enshroud.

§Session Tickets

To address this business organization for server-side deployment of TLS session caches, the "Session Ticket" (RFC 5077) replacement mechanism was introduced, which removes the requirement for the server to keep per-client session country. Instead, if the client indicates that it supports session tickets, the server tin include a New Session Ticket record, which includes all of the negotiated session information encrypted with a surreptitious key known only past the server.

This session ticket is so stored by the client and tin can be included in the SessionTicket extension within the ClientHello message of a subsequent session. Thus, all session information is stored only on the client, but the ticket is yet safe because it is encrypted with a key known just by the server.

The session identifiers and session ticket mechanisms are respectively unremarkably referred to as session caching and stateless resumption mechanisms. The main comeback of stateless resumption is the removal of the server-side session enshroud, which simplifies deployment by requiring that the client provide the session ticket on every new connection to the server—that is, until the ticket has expired.

In practice, deploying session tickets across a prepare of load-balanced servers too requires some conscientious thinking and systems compages: all servers must be initialized with the aforementioned session central, and an additional mechanism is required to periodically and securely rotate the shared key across all servers.

Hallmark is an integral part of establishing every TLS connectedness. After all, information technology is possible to behave out a conversation over an encrypted tunnel with any peer, including an assailant, and unless nosotros tin can be certain that the host we are speaking to is the one nosotros trust, then all the encryption work could be for null. To understand how we can verify the peer'southward identity, permit's examine a unproblematic authentication workflow betwixt Alice and Bob:

• Both Alice and Bob generate their own public and individual keys.

• Both Alice and Bob hide their respective private keys.

• Alice shares her public central with Bob, and Bob shares his with Alice.

• Alice generates a new message for Bob and signs it with her private key.

• Bob uses Alice'south public primal to verify the provided message signature.

Trust is a key component of the preceding substitution. Specifically, public cardinal encryption allows usa to use the public key of the sender to verify that the bulletin was signed with the right private key, but the decision to corroborate the sender is nevertheless 1 that is based on trust. In the exchange but shown, Alice and Bob could have exchanged their public keys when they met in person, and because they know each other well, they are certain that their exchange was not compromised by an impostor—maybe they even verified their identities through another, clandestine (concrete) handshake they had established earlier!

Adjacent, Alice receives a message from Charlie, whom she has never met, but who claims to be a friend of Bob's. In fact, to testify that he is friends with Bob, Charlie asked Bob to sign his own public key with Bob's private key and attached this signature with his message (Effigy 4-4). In this case, Alice kickoff checks Bob's signature of Charlie's central. She knows Bob's public key and is thus able to verify that Bob did indeed sign Charlie's central. Because she trusts Bob's determination to verify Charlie, she accepts the bulletin and performs a like integrity check on Charlie's message to ensure that it is, indeed, from Charlie.

Figure 4-iv. Concatenation of trust for Alice, Bob, and Charlie

What we take merely done is established a chain of trust: Alice trusts Bob, Bob trusts Charlie, and by transitive trust, Alice decides to trust Charlie. Every bit long as nobody in the concatenation is compromised, this allows us to build and grow the listing of trusted parties.

Hallmark on the Web and in your browser follows the exact same process equally shown. Which means that at this point y'all should exist asking: whom does your browser trust, and whom practise you trust when you use the browser? There are at to the lowest degree three answers to this question:

Manually specified certificates

Every browser and operating system provides a mechanism for you to manually import whatsoever certificate you trust. How yous obtain the document and verify its integrity is completely upward to y'all.

Certificate government

A certificate authority (CA) is a trusted third party that is trusted by both the discipline (owner) of the certificate and the party relying upon the certificate.

The browser and the operating system

Every operating system and most browsers ship with a list of well-known certificate authorities. Thus, you too trust the vendors of this software to provide and maintain a list of trusted parties.

In do, it would be impractical to store and manually verify each and every key for every website (although you tin, if you are then inclined). Hence, the nigh common solution is to use certificate regime (CAs) to practice this job for us (Figure 4-5): the browser specifies which CAs to trust (root CAs), and the brunt is then on the CAs to verify each site they sign, and to inspect and verify that these certificates are not misused or compromised. If the security of any site with the CA's document is breached, then it is also the responsibleness of that CA to revoke the compromised document.

Effigy four-5. CA signing of digital certificates

Every browser allows you to inspect the chain of trust of your secure connectedness (Figure 4-6), usually attainable by clicking on the lock icon beside the URL.

Figure four-6. Certificate chain of trust for igvita.com (Google Chrome, v25)

• igvita.com certificate is signed by StartCom Class 1 Primary Intermediate Server.

• StartCom Course ane Principal Intermediate Server certificate is signed by the StartCom Certification Say-so.

• StartCom Certification Authority is a recognized root document authority.

The "trust ballast" for the entire chain is the root document authorisation, which in the case just shown, is the StartCom Certification Authority. Every browser ships with a pre-initialized list of trusted certificate authorities ("roots"), and in this case, the browser trusts and is able to verify the StartCom root certificate. Hence, through a transitive chain of trust in the browser, the browser vendor, and the StartCom certificate authorisation, nosotros extend the trust to our destination site.

§Certificate Revocation

Occasionally the issuer of a document will need to revoke or invalidate the certificate due to a number of possible reasons: the private key of the certificate has been compromised, the certificate potency itself has been compromised, or due to a diverseness of more beneficial reasons such as a superseding certificate, change in affiliation, and so on. To address this, the certificates themselves incorporate instructions (Figure 4-7) on how to check if they accept been revoked. Hence, to ensure that the chain of trust is non compromised, each peer tin check the status of each document by following the embedded instructions, forth with the signatures, as it verifies the certificate chain.

Effigy four-seven. CRL and OCSP instructions for igvita.com (Google Chrome, v25)

§Certificate Revocation List (CRL)

Document Revocation List (CRL) is defined past RFC 5280 and specifies a simple mechanism to cheque the status of every certificate: each certificate dominance maintains and periodically publishes a list of revoked document serial numbers. Anyone attempting to verify a certificate is then able to download the revocation list, cache it, and check the presence of a detail serial number within information technology—if it is present, and then information technology has been revoked.

This process is simple and straightforward, but it has a number of limitations:

• The growing number of revocations ways that the CRL list will only get longer, and each client must retrieve the entire list of series numbers.

• There is no machinery for instant notification of certificate revocation—if the CRL was cached past the customer before the document was revoked, then the CRL volition deem the revoked document valid until the cache expires.

• The demand to fetch the latest CRL listing from the CA may block document verification, which tin add meaning latency to the TLS handshake.

• The CRL fetch may neglect due to variety of reasons, and in such cases the browser behavior is undefined. Most browsers treat such cases as "soft neglect", assuasive the verification to proceed—aye, yikes.

§Online Certificate Condition Protocol (OCSP)

To address some of the limitations of the CRL mechanism, the Online Certificate Status Protocol (OCSP) was introduced past RFC 2560, which provides a mechanism to perform a real-time check for status of the document. Unlike the CRL file, which contains all the revoked serial numbers, OCSP allows the client to query the CA's document database directly for just the serial number in question while validating the certificate chain.

Equally a issue, the OCSP mechanism consumes less bandwidth and is able to provide real-time validation. However, the requirement to perform existent-time OCSP queries creates its own set of issues:

• The CA must be able to handle the load of the existent-time queries.

• The CA must ensure that the service is upwards and globally available at all times.

• Real-fourth dimension OCSP requests may impair the client'due south privacy considering the CA knows which sites the customer is visiting.

• The customer must block on OCSP requests while validating the certificate concatenation.

• The browser behavior is, once once more, undefined and typically results in a "soft fail" if the OCSP fetch fails due to a network timeout or other errors.

As a existent-world data point, Firefox telemetry shows that OCSP requests fourth dimension out as much as 15% of the time, and add approximately 350 ms to the TLS handshake when successful—see hpbn.co/ocsp-performance.

§OCSP Stapling

For the reasons listed higher up, neither CRL or OSCP revocation mechanisms offering the security and operation guarantees that we want for our applications. However, don't despair, because OCSP stapling (RFC 6066, "Document Status Request" extension) addresses virtually of the issues nosotros saw before past allowing the validation to exist performed by the server and be sent ("stapled") as part of the TLS handshake to the client:

• Instead of the client making the OCSP request, information technology is the server that periodically retrieves the signed and timestamped OCSP response from the CA.

• The server and so appends (i.due east. "staples") the signed OCSP response as part of the TLS handshake, allowing the customer to validate both the certificate and the fastened OCSP revocation record signed by the CA.

This role reversal is secure, because the stapled record is signed by the CA and can exist verified by the client, and offers a number of important benefits:

• The client does not leak its navigation history.

• The client does not have to block and query the OCSP server.

• The client may "hard-fail" revocation treatment if the server opts-in (by advertisement the OSCP "Must-Staple" flag) and the verification fails.

In curt, to get both the best security and performance guarantees, brand certain to configure and test OCSP stapling on your servers.

§TLS Record Protocol

Not unlike the IP or TCP layers beneath it, all data exchanged within a TLS session is also framed using a well-divers protocol (Effigy 4-8). The TLS Record protocol is responsible for identifying different types of messages (handshake, alert, or data via the "Content Blazon" field), too every bit securing and verifying the integrity of each bulletin.

Figure four-viii. TLS record structure

A typical workflow for delivering application data is as follows:

• Record protocol receives application data.

• Received data is divided into blocks: maximum of 2¹⁴ bytes, or 16 KB per record.

• Message hallmark lawmaking (MAC) or HMAC is added to each record.

• Data within each record is encrypted using the negotiated zippo.

Once these steps are complete, the encrypted data is passed down to the TCP layer for transport. On the receiving terminate, the same workflow, but in reverse, is applied by the peer: decrypt record using negotiated cipher, verify MAC, extract and deliver the data to the application above it.

The good news is that all the work just shown is handled by the TLS layer itself and is completely transparent to near applications. Nonetheless, the record protocol does innovate a few important implications that we need to be enlightened of:

• Maximum TLS tape size is sixteen KB

• Each record contains a 5-byte header, a MAC (upward to 20 bytes for SSLv3, TLS 1.0, TLS 1.ane, and up to 32 bytes for TLS ane.ii), and padding if a block nix is used.

• To decrypt and verify the tape, the entire tape must be available.

Picking the right record size for your application, if you lot have the power to do so, can be an important optimization. Small records incur a larger CPU and byte overhead due to tape framing and MAC verification, whereas big records will have to be delivered and reassembled by the TCP layer before they can be processed by the TLS layer and delivered to your awarding—skip ahead to Optimize TLS Tape Size for full details.

§Optimizing for TLS

Deploying your application over TLS volition require some additional work, both within your application (e.grand. migrating resources to HTTPS to avoid mixed content), and on the configuration of the infrastructure responsible for delivering the application data over TLS. A well tuned deployment can make an enormous positive difference in the observed performance, user experience, and overall operational costs. Let'due south swoop in.

§Reduce Computational Costs

Establishing and maintaining an encrypted channel introduces additional computational costs for both peers. Specifically, first there is the disproportionate (public key) encryption used during the TLS handshake (explained TLS Handshake). And so, in one case a shared hugger-mugger is established, information technology is used as a symmetric key to encrypt all TLS records.

As we noted earlier, public primal cryptography is more computationally expensive when compared with symmetric key cryptography, and in the early on days of the Web ofttimes required additional hardware to perform "SSL offloading." The good news is, this is no longer necessary and what once required defended hardware can at present be washed directly on the CPU. Large organizations such as Facebook, Twitter, and Google, which offer TLS to billions of users, perform all the necessary TLS negotiation and computation in software and on commodity hardware.

In Jan this year (2010), Gmail switched to using HTTPS for everything by default. Previously it had been introduced as an option, only at present all of our users use HTTPS to secure their e-mail between their browsers and Google, all the time. In order to exercise this nosotros had to deploy no additional machines and no special hardware. On our production frontend machines, SSL/TLS accounts for less than one% of the CPU load, less than ten KB of memory per connection and less than 2% of network overhead. Many people believe that SSL/TLS takes a lot of CPU time and we hope the preceding numbers (public for the first time) will aid to dispel that.

If yous end reading now you lot only need to remember i thing: SSL/TLS is not computationally expensive anymore.

Adam Langley (Google)

We have deployed TLS at a large calibration using both hardware and software load balancers. We accept found that modern software-based TLS implementations running on article CPUs are fast plenty to handle heavy HTTPS traffic load without needing to resort to dedicated cryptographic hardware. Nosotros serve all of our HTTPS traffic using software running on commodity hardware.

Doug Beaver (Facebook)

Elliptic Curve Diffie-Hellman (ECDHE) is merely a lilliputian more than expensive than RSA for an equivalent security level… In practical deployment, we found that enabling and prioritizing ECDHE nada suites actually caused negligible increase in CPU usage. HTTP keepalives and session resumption hateful that most requests do not require a full handshake, so handshake operations practise not dominate our CPU usage. We find 75% of Twitter's client requests are sent over connections established using ECDHE. The remaining 25% consists generally of older clients that don't yet support the ECDHE cipher suites.

Jacob Hoffman-Andrews (Twitter)

To get the best results in your own deployments, make the best of TLS Session Resumption—deploy, mensurate, and optimize its success charge per unit. Eliminating the need to perform the plush public primal cryptography operations on every handshake will significantly reduce both the computational and latency costs of TLS; at that place is no reason to spend CPU cycles on piece of work that you don't demand to do.

Speaking of optimizing CPU cycles, make sure to keep your servers upwardly to date with the latest version of the TLS libraries! In addition to the security improvements, you will as well oft see performance benefits. Security and operation become hand-in-hand.

§Enable 1-RTT TLS Handshakes

An unoptimized TLS deployment can easily add many additional roundtrips and introduce significant latency for the user—e.g. multi-RTT handshakes, tiresome and ineffective document revocation checks, large TLS records that require multiple roundtrips, and so on. Don't be that site, you can do much better.

A well-tuned TLS deployment should add at nigh one extra roundtrip for negotiating the TLS connection, regardless of whether information technology is new or resumed, and avert all other latency pitfalls: configure session resumption, and enable forrard secrecy to enable TLS Imitation Start.

To become the best cease-to-end functioning, brand sure to audit both own and third-party services and servers used by your application, including your CDN provider. For a quick report-card overview of popular servers and CDNs, check out istlsfastyet.com.

§Optimize Connection Reuse

The best style to minimize both latency and computational overhead of setting up new TCP+TLS connections is to optimize connection reuse. Doing so amortizes the setup costs across requests and delivers a much faster experience to the user.

Verify that your server and proxy configurations are setup to allow keepalive connections, and audit your connectedness timeout settings. Many popular servers gear up aggressive connexion timeouts (e.1000. some Apache versions default to 5s timeouts) that force a lot of unnecessary renegotiations. For all-time results, use your logs and analytics to determine the optimal timeout values.

§Leverage Early Termination

As nosotros discussed in Primer on Latency and Bandwidth, we may not be able to make our packets travel faster, but we tin make them travel a shorter distance. Past placing our "edge" servers closer to the user (Figure 4-9), we can significantly reduce the roundtrip times and the total costs of the TCP and TLS handshakes.

Figure 4-9. Early on termination of client connections

A simple way to accomplish this is to leverage the services of a content commitment network (CDN) that maintains pools of border servers around the globe, or to deploy your own. By allowing the user to finish their connection with a nearby server, instead of traversing beyond oceans and continental links to your origin, the customer gets the benefit of "early termination" with shorter roundtrips. This technique is equally useful and important for static and dynamic content: static content tin also be cached and served by the border servers, whereas dynamic requests tin be routed over established connections from the edge to origin.

§Configure Session Caching and Stateless Resumption

Terminating the connection closer to the user is an optimization that will help decrease latency for your users in all cases, merely in one case over again, no flake is faster than a fleck not sent—send fewer bits. Enabling TLS session caching and stateless resumption allows united states to eliminate an entire roundtrip of latency and reduce computational overhead for echo visitors.

Session identifiers, on which TLS session caching relies, were introduced in SSL ii.0 and take broad support amid nearly clients and servers. Nevertheless, if you lot are configuring TLS on your server, do non presume that session support will be on by default. In fact, it is more than common to have it off on almost servers past default—but yous know amend! Double-cheque and verify your server, proxy, and CDN configuration:

• Servers with multiple processes or workers should utilise a shared session cache.

• Size of the shared session cache should be tuned to your levels of traffic.

• A session timeout period should be provided.

• In a multi-server setup, routing the same client IP, or the same TLS session ID, to the aforementioned server is ane style to provide good session cache utilization.

• Where "sticky" load balancing is not an option, a shared cache should exist used between different servers to provide good session cache utilization, and a secure mechanism needs to be established to share and update the secret keys to decrypt the provided session tickets.

• Check and monitor your TLS session cache statistics for best performance.

In practice, and for all-time results, you should configure both session caching and session ticket mechanisms. These mechanisms work together to provide best coverage both for new and older clients.

§Enable TLS Faux Start

Session resumption provides two important benefits: it eliminates an extra handshake roundtrip for returning visitors and reduces the computational price of the handshake past allowing reuse of previously negotiated session parameters. However, it does not help in cases where the visitor is communicating with the server for the commencement time, or if the previous session has expired.

To get the best of both worlds—a i roundtrip handshake for new and repeat visitors, and computational savings for repeat visitors—we tin use TLS False Showtime, which is an optional protocol extension that allows the sender to send application information (Figure 4-10) when the handshake is simply partially complete.

Figure 4-ten. TLS handshake with Imitation Start

Fake Starting time does not modify the TLS handshake protocol, rather it just affects the protocol timing of when the application data tin be sent. Intuitively, once the client has sent the ClientKeyExchange record, information technology already knows the encryption key and tin brainstorm transmitting awarding data—the residual of the handshake is spent confirming that nobody has tampered with the handshake records, and tin be washed in parallel. As a issue, False Commencement allows united states to continue the TLS handshake at one roundtrip regardless of whether we are performing a full or abbreviated handshake.

§Optimize TLS Tape Size

All application data delivered via TLS is transported inside a record protocol (Effigy 4-8). The maximum size of each tape is 16 KB, and depending on the called naught, each record will add anywhere from xx to 40 bytes of overhead for the header, MAC, and optional padding. If the record then fits into a unmarried TCP bundle, then we also accept to add together the IP and TCP overhead: 20-byte header for IP, and 20-byte header for TCP with no options. Equally a result, in that location is potential for threescore to 100 bytes of overhead for each tape. For a typical maximum manual unit (MTU) size of one,500 bytes on the wire, this packet structure translates to a minimum of 6% of framing overhead.

The smaller the tape, the higher the framing overhead. Notwithstanding, simply increasing the size of the record to its maximum size (16 KB) is not necessarily a practiced idea. If the record spans multiple TCP packets, then the TLS layer must expect for all the TCP packets to arrive before it can decrypt the data (Figure four-xi). If any of those TCP packets get lost, reordered, or throttled due to congestion control, then the private fragments of the TLS tape will accept to exist buffered before they can be decoded, resulting in boosted latency. In practice, these delays can create pregnant bottlenecks for the browser, which prefers to consume data in a streaming style.

Figure 4-11. WireShark capture of eleven,211-byte TLS record split over 8 TCP segments

Small records incur overhead, big records incur latency, and at that place is no one value for the "optimal" record size. Instead, for spider web applications, which are consumed by the browser, the best strategy is to dynamically adjust the record size based on the state of the TCP connexion:

• When the connectedness is new and TCP congestion window is low, or when the connection has been idle for some time (see Slow-Kickoff Restart), each TCP packet should conduct exactly ane TLS tape, and the TLS tape should occupy the full maximum segment size (MSS) allocated by TCP.

• When the connection congestion window is large and if nosotros are transferring a big stream (e.g., streaming video), the size of the TLS record tin can exist increased to span multiple TCP packets (up to 16KB) to reduce framing and CPU overhead on the client and server.

If the TCP connection has been idle, and even if Slow-Start Restart is disabled on the server, the all-time strategy is to decrease the record size when sending a new burst of information: the conditions may take inverse since last manual, and our goal is to minimize the probability of buffering at the awarding layer due to lost packets, reordering, and retransmissions.

Using a dynamic strategy delivers the best performance for interactive traffic: modest tape size eliminates unnecessary buffering latency and improves the time-to-commencement-{HTML byte, …, video frame}, and a larger record size optimizes throughput by minimizing the overhead of TLS for long-lived streams.

To determine the optimal record size for each land let's get-go with the initial case of a new or idle TCP connectedness where we want to avoid TLS records from spanning multiple TCP packets:

• Classify 20 bytes for IPv4 framing overhead and xl bytes for IPv6.

• Allocate twenty bytes for TCP framing overhead.

• Allocate 40 bytes for TCP options overhead (timestamps, SACKs).

Assuming a mutual i,500-byte starting MTU, this leaves 1,420 bytes for a TLS record delivered over IPv4, and i,400 bytes for IPv6. To be future-proof, employ the IPv6 size, which leaves usa with 1,400 bytes for each TLS record, and adjust equally needed if your MTU is lower.

Next, the determination every bit to when the record size should be increased and reset if the connection has been idle, can exist ready based on pre-configured thresholds: increase record size to upward to 16 KB after X KB of data have been transferred, and reset the record size after Y milliseconds of idle time.

Typically, configuring the TLS record size is not something we tin can control at the application layer. Instead, often this is a setting and sometimes a compile-time constant for your TLS server. Check the documentation of your server for details on how to configure these values.

§Optimize the Certificate Chain

Verifying the chain of trust requires that the browser traverse the concatenation, starting from the site certificate, and recursively verify the certificate of the parent until information technology reaches a trusted root. Hence, it is disquisitional that the provided chain includes all the intermediate certificates. If whatever are omitted, the browser will be forced to pause the verification process and fetch the missing certificates, adding additional DNS lookups, TCP handshakes, and HTTP requests into the process.

How does the browser know from where to fetch the missing certificates? Each child certificate typically contains a URL for the parent. If the URL is omitted and the required certificate is not included, and so the verification volition fail.

Conversely, do not include unnecessary certificates, such every bit the trusted roots in your certificate chain—they add unnecessary bytes. Recall that the server certificate chain is sent as part of the TLS handshake, which is likely happening over a new TCP connection that is in the early stages of its slow-start algorithm. If the certificate chain size exceeds TCP'southward initial congestion window, and so we will inadvertently add additional roundtrips to the TLS handshake: certificate length volition overflow the congestion window and crusade the server to terminate and expect for a client ACK before proceeding.

In practice, the size and depth of the certificate chain was a much bigger business organisation and trouble on older TCP stacks that initialized their initial congestion window to 4 TCP segments—come across Ho-hum-Outset. For newer deployments, the initial congestion window has been raised to 10 TCP segments and should be more sufficient for almost certificate chains.

That said, verify that your servers are using the latest TCP stack and settings, and optimize and reduce the size of your certificate chain. Sending fewer bytes is ever a adept and worthwhile optimization.

§Configure OCSP Stapling

Every new TLS connexion requires that the browser must verify the signatures of the sent document chain. However, there is one more critical step that we can't forget: the browser also needs to verify that the certificates have not been revoked.

To verify the status of the certificate the browser tin use one of several methods: Document Revocation List (CRL), Online Document Condition Protocol (OCSP), or OCSP Stapling. Each method has its own limitations, but OCSP Stapling provides, by far, the best security and functioning guarantees-refer to earlier sections for details. Make sure to configure your servers to include (staple) the OCSP response from the CA to the provided certificate concatenation. Doing so allows the browser to perform the revocation cheque without any extra network roundtrips and with improved security guarantees.

• OCSP responses can vary from 400 to 4,000 bytes in size. Stapling this response to your certificate concatenation will increase its size—pay close attending to the total size of the certificate chain, such that it doesn't overflow the initial congestion window for new TCP connections.

• Current OCSP Stapling implementations only allow a single OCSP response to be included, which means that the browser may accept to fallback to another revocation machinery if it needs to validate other certificates in the concatenation—reduce the length of your certificate chain. In the future, OCSP Multi-Stapling should address this detail problem.

Well-nigh popular servers support OCSP stapling. Check the relevant documentation for support and configuration instructions. Similarly, if using or deciding on a CDN, check that their TLS stack supports and is configured to apply OCSP stapling.

§Enable HTTP Strict Transport Security (HSTS)

HTTP Strict Transport Security is an important security policy mechanism that allows an origin to declare admission rules to a compliant browser via a simple HTTP header—due east.g., "Strict-Transport-Security: max-age=31536000". Specifically, information technology instructs the user-agent to enforce the following rules:

• All requests to the origin should be sent over HTTPS. This includes both navigation and all other aforementioned-origin subresource requests—e.one thousand. if the user types in a URL without the https prefix the user agent should automatically convert it to an https request; if a page contains a reference to a non-https resource, the user agent should automatically convert it to request the https version.

• If a secure connectedness cannot be established, the user is non allowed to circumvent the warning and request the HTTP version—i.due east. the origin is HTTPS-only.

• max-historic period specifies the lifetime of the specified HSTS ruleset in seconds (e.g., max-age=31536000 is equal to a 365-day lifetime for the advertised policy).

• includeSubdomains indicates that the policy should apply to all subdomains of the current origin.

HSTS converts the origin to an HTTPS-only destination and helps protect the application from a diverseness of passive and agile network attacks. Equally an added bonus, it likewise offers a nice performance optimization by eliminating the need for HTTP-to-HTTPS redirects: the client automatically rewrites all requests to the secure origin before they are dispatched!

Make certain to thoroughly test your TLS deployment earlier enabling HSTS. Once the policy is cached past the client, failure to negotiate a TLS connexion volition upshot in a difficult-fail—i.e. the user will see the browser error folio and won't be immune to proceed. This behavior is an explicit and necessary blueprint choice to foreclose network attackers from tricking clients into accessing your site without HTTPS.

§Enable HTTP Public Key Pinning (HPKP)

One of the shortcomings of the current system—every bit discussed in Chain of Trust and Document Authorities—is our reliance on a big number of trusted Certificate Authorities (CA's). On the ane hand, this is convenient, because it means that we can obtain a valid document from a broad pool of entities. However, information technology also ways that whatsoever ane of these entities is also able to issue a valid document for our, and any other, origin without their explicit consent.

The compromise of the DigiNotar document authority is 1 of several high-profile examples where an attacker was able to issue and use simulated—but valid—certificates against hundreds of high profile sites.

Public Key Pinning enables a site to send an HTTP header that instructs the browsers to remember ("pin") one or more certificates in its document chain. Past doing and then, it is able to scope which certificates, or issuers, should be accepted by the browser on subsequent visits:

• The origin can pin information technology's leaf certificate. This is the most secure strategy considering y'all are, in outcome, hard-coding a minor set of specific certificate signatures that should exist accepted by the browser.

• The origin can pin 1 of the parent certificates in the certificate concatenation. For case, the origin can pin the intermediate certificate of its CA, which tells the browser that, for this particular origin, information technology should just trust certificates signed past that particular certificate authority.

Picking the correct strategy for which certificates to pin, which and how many backups to provide, duration, and other criteria for deploying HPKP are important, nuanced, and beyond the telescopic of our discussion. Consult your favorite search engine, or your local security guru, for more than information.

HPKP also exposes a "report only" mode that does not enforce the provided pin just is able to report detected failures. This tin can be a great starting time step towards validating your deployment, and serve as a mechanism to detect violations.

§Update Site Content to HTTPS

To go the best security and operation guarantees it is critical that the site actually uses HTTPS to fetch all of its resource. Otherwise, we come across a number of problems that volition compromise both, or worse, break the site:

• Mixed "active" content (e.thousand. scripts and stylesheets delivered over HTTP) will be blocked past the browser and may break the functionality of the site.

• Mixed "passive" content (e.g. images, video, audio, etc., delivered over HTTP) will be fetched, but will allow the attacker to observe and infer user activeness, and dethrone performance by requiring additional connections and handshakes.

Audit your content and update your resources and links, including third-party content, to utilize HTTPS. The Content Security Policy (CSP) mechanism can be of keen assist here, both to identify HTTPS violations and to enforce the desired policies.

Content-Security-Policy: upgrade-insecure-requests  Content-Security-Policy-Report-Only: default-src https:;   report-uri https://example.com/reporting/endpoint               

1. Tells the browser to upgrade all (own and tertiary-party) requests to HTTPS.

2. Tells the browser to report whatever non-HTTPS violations to designated endpoint.

CSP provides a highly configurable mechanism to control which asset are immune to be used, and how and from where they can be fetched. Brand utilize of these capabilities to protect your site and your users.

§Performance Checklist

As application developers we are shielded from most of the complexity of the TLS protocol—the customer and server do most of the difficult work on our behalf. However, every bit we saw in this chapter, this does not mean that we can ignore the functioning aspects of delivering our applications over TLS. Tuning our servers to enable disquisitional TLS optimizations and configuring our applications to enable the client to take advantage of such features pays high dividends: faster handshakes, reduced latency, better security guarantees, and more.

With that in mind, a curt checklist to put on the agenda:

• Become best performance from TCP; see Optimizing for TCP.

• Upgrade TLS libraries to latest release, and (re)build servers against them.

• Enable and configure session caching and stateless resumption.

• Monitor your session caching striking rates and suit configuration accordingly.

• Configure forwards secrecy ciphers to enable TLS False Start.

• Terminate TLS sessions closer to the user to minimize roundtrip latencies.

• Use dynamic TLS record sizing to optimize latency and throughput.

• Inspect and optimize the size of your certificate chain.

• Configure OCSP stapling.

• Configure HSTS and HPKP.

• Configure CSP policies.

• Enable HTTP/2; see HTTP/two.

§Testing and Verification

Finally, to verify and test your configuration, you can utilise an online service, such as the Qualys SSL Server Examination to scan your public server for common configuration and security flaws. Additionally, you should familiarize yourself with the openssl command-line interface, which will help you lot inspect the entire handshake and configuration of your server locally.

              $> openssl s_client -state -CAfile root.ca.crt -connect igvita.com:443              Continued(00000003)   SSL_connect:before/connect initialization   SSL_connect:SSLv2/v3 write client howdy A   SSL_connect:SSLv3 read server hello A   depth=two /C=IL/O=StartCom Ltd./OU=Secure Digital Document Signing           /CN=StartCom Certification Authorization   verify render:1   depth=1 /C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing           /CN=StartCom Course 1 Primary Intermediate Server CA   verify return:i   depth=0 /description=ABjQuqt3nPv7ebEG/C=United states of america           /CN=www.igvita.com/emailAddress=ilya@igvita.com   verify return:1   SSL_connect:SSLv3 read server certificate A   SSL_connect:SSLv3 read server done A    SSL_connect:SSLv3 write customer cardinal exchange A   SSL_connect:SSLv3 write alter nada spec A   SSL_connect:SSLv3 write finished A   SSL_connect:SSLv3 flush data   SSL_connect:SSLv3 read finished A   ---   Certificate concatenation     0 southward:/clarification=ABjQuqt3nPv7ebEG/C=US        /CN=world wide web.igvita.com/emailAddress=ilya@igvita.com      i:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing        /CN=StartCom Class 1 Main Intermediate Server CA    1 southward:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing        /CN=StartCom Grade 1 Primary Intermediate Server CA      i:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing        /CN=StartCom Certification Authority   ---   Server document   -----BEGIN Certificate-----   ... snip ...   ---   No client certificate CA names sent   ---   SSL handshake has read 3571 bytes and written 444 bytes    ---   New, TLSv1/SSLv3, Cipher is RC4-SHA   Server public key is 2048 scrap   Secure Renegotiation IS supported   Pinch: NONE   Expansion: NONE   SSL-Session:       Protocol  : TLSv1       Nada    : RC4-SHA       Session-ID: 269349C84A4702EFA7 ...        Session-ID-ctx:       Master-Key: 1F5F5F33D50BE6228A ...       Central-Arg   : None       Start Time: 1354037095       Timeout   : 300 (sec)       Verify render code: 0 (ok)   ---            

1. Customer completed verification of received certificate concatenation.

2. Received document chain (two certificates).

3. Size of received certificate chain.

4. Issued session identifier for stateful TLS resume.

In the preceding example, we connect to igvita.com on the default TLS port (443), and perform the TLS handshake. Because the s_client makes no assumptions about known root certificates, nosotros manually specify the path to the root certificate which, at the time of writing, is the StartSSL Certificate Authority for the case domain. Your browser already has common root certificates and is thus able to verify the concatenation, simply s_client makes no such assumptions. Effort omitting the root certificate, and yous will run into a verification mistake in the log.

Inspecting the certificate chain shows that the server sent ii certificates, which added up to three,571 bytes. Also, we can run into the negotiated TLS session variables—chosen protocol, aught, key—and we can too see that the server issued a session identifier for the current session, which may be resumed in the future.

brunismadving.blogspot.com

Source: https://hpbn.co/transport-layer-security-tls/

Share this post