Hey, everyone.
And welcome back.
In today's video, we will have a high level overview about the Https protocol.
Now, Https is basically an extension to Http.
Now in Https, the communication is encrypted using the transport layer security, which is also referred
as the TLS.
Now TLS is basically a newer version of SSL.
I'm sure you might have heard SSL somewhere down the way.
Now the protocol, the Https protocol is referenced here.
So this protocol is also referred to as Http over TLS or Http over SSL.
So many times within your browser when you open up websites like banking websites or typically websites
which might contain a sensitive information, you will see this lock and also green Https.
So this lock basically means that your community version is secure.
So this is my test website and if you see the domain is labs internal.com and it has this green lock.
All right so this green lock and it is https.
Same goes with the banking website.
Even for banking website you see it has this green lock and it has the Https.
So that basically means that the communication that might be happening between the client so client
can be this browser and the website here.
In this case it is city that communication is encrypted and that can be verified with this green lock
or the Https within the domain.
So let's understand certain scenarios where Https proves to be very useful.
So in this scenario you have a user who is sending his username and password in a plain text to web
server for authentication.
So you have a web server.
So this can be certain applications and this is the user.
So you open up this website from your browser and the website asks you for login and password.
So you put your login username as KB Labs and you put the password as the certain password.
Now if there is an attacker who is sitting between them, so if there is an attacker who is sitting
and sniffing the network, then he will be able to fetch all the credentials which are passing in this
network within plain text.
So if you see over here, you have an attacker who is doing a man in the middle attack.
He fetched the username, he fetched the password and he stored it within his database.
So the longer he sniffs the network, the more username and password he will be able to get.
Now, the reason why he is able to get the password and username is because they are travelling in a
plain text.
So there are various plain text protocol like you have FTP, you have Http.
So if you use that plain text protocol to transfer sensitive data, then if there is an attack then
your credentials would be leaked.
Now there is also a second scenario where you have a man in the middle with integrity attacks.
So what happens in the integrity attack is that attacker is changing the payment details while the packets
are in transit.
So let's say that you are sending information that send $100 to Zelle at the rate so now attacker can
modify that detail, so attacker can receive it and he can modify the details.
So it says send $100 to attacker at the rate example dot internal.
So now the destination server will receive this details and if the destination server sends $100 to
the attacker, then his attack is completely successful.
So this is the integrity attack where the data itself is changed during the transit.
So to avoid the previous two scenarios that we discussed and also various others, various cryptographic
standards were clubbed together to establish a secure communication over an untrusted network.
And those standards which were clubbed together were known as SSL.
TLS So SSL was the initial version of the protocol, which was basically intended for secure communication.
So SSL 2.0 was released in the year 1995, then certain improvements.
Then you have SSL 3.0 on 1996.
Then the name got changed.
So SSL, the various protocols which are used in SSL 3.0 could be easily compromised.
So let's say that you are using a secure communication with SSL 3.0.
Then the protocols which were being used because SSL and TLS are just cryptographic standards.
So it in turn contains a lot of other protocols.
Some protocols are generally used.
Encryption.
Some protocols are being used for integrity and others.
So SSL 3.0.
The protocols that were used here were deemed to be unsafe.
That means they could be compromised.
So.
SSL 3.0 ceased to be used and you had the brand new standards.
So TLS is just the name change.
The overall concept remains the same here with different protocols being used here.
So you have TLS 1.0 in 1999, then you have 1.1, then you have 1.2 and you have the latest 1.3 in 2018,
which was released.
Now let's understand Https in a easy way.
So what happens here is that every website has a certificate, so every website which uses Https has
a certificate.
So certificate is basically like a passport which gets issued by a trusted entity.
So passport generally gets issued by a government.
So whichever government.
So in my case, if I am living in India, then the passport is issued by government of India.
However, before passport gets issued, whatever contents are there within that passport.
So it might be your name, your date of birth, your address, that contents will be verified by the
government.
So typically in India, before the passport is issued, you will see that the cops, they visit your
place to verify whether you are actually living there.
And the data that you have shared is not malicious one.
So everything is verified within your passport.
And in a similar way, the certificate is also like a passport.
It contains a lot of information and that certificate is issued by a trusted entity.
So this certificate has a lot of details like your domain name, its validity, the public key and others.
So this is a sample certificate on how exactly it looks like.
So if you see this certificate is issued to Vodacom, similar to passport.
So if I have a passport, the passport will have a name, say Zebra.
Similarly, the certificate that is been issued for your website, it will have the domain name of your
website, which is Vodacom.
Now, along with that, it has a lot of other information like version.
You have serial number, you have certificate signature algorithm, you have the issuer and also the
validity as well as the public key related information.
Now generally, whenever you open up a Https website, the web server will send you its certificate.
So that is the first thing.
So you have, let's say the web server has sent you its own certificate.
So this is like a big certificate because it contains a lot of information.
Now the browser.
So in this case client verifies if it trusts the certificate issuer or not.
So this is a big thing.
So the client has to validate if it trusts or not.
Okay.
Now if it trusts, it will also verify all the details which are within the certificate.
Like when you go international, then during the channel they will verify each and every thing.
Then once it verifies and it accepts it to be genuine, then it will take the public key information
from this certificate.
So this certificate has the public key and then it also initiates the negotiation.
Now we know that a TLS is basically used primarily for secure communication, so that is one of the
important use case.
So in order for secure communication, it takes the public key information so you will understand the
public and private key if you know the asymmetric key encryption.
So asymmetric key encryption is used to generate a new temporary symmetric key which will be used for
secure communication.
So what happens here?
It takes the public key information and a secure password.
So it's something like a secure password is generated.
So that secure password, which is referred as a symmetric key, will be used for encrypted and decryption
related operation throughout the channel.
However, that secure symmetric key is passed through asymmetric key encryption here.
So that's the high level overview.
Let me quickly show you a few things.
So if I just open up the labs internal.com.
So this is our test website.
So when I just open this up, it basically says secure connection.
So let me just expand it and it says verified by let's encrypt.
So that basically means that whatever details that are part of this certificate are being verified by
a issuer.
In this case, the issuer is let's encrypt.
There can be multiple issuers.
So when you do a more information, you will be able to get the certificate.
Information.
So here we see that this certificate is issued to labs internal.com.
It's verified by letsencrypt and it expires on 24th September 2019.
Now, if you go into the technical details, it says that the connection is encrypted.
And basically these are the protocols which are being used for the overall encryption.
And here you have TLS version 1.2.
So if you want to look into the actual certificate, this is how the certificate looks like, where
you have the common name, you have the serial number, you have the begins on.
So when it was issued till when it is issued, that basically means the expiry as well as the fingerprint.
Now, if you look into the details, these are all the details which are part of the certificate.
So you have the certificate version, you have the serial number, you have the issuer.
So in this case, the issuer is Letsencrypt.
We already seen the validity.
Now, this is one of the important part.
So this is the public key algorithm, which is RSA, and this is the actual public key.
All right.
So this is the public key through which the new symmetric key is generated, which in turn would be
used for the encrypted communication.
So it's like you cannot really send that symmetric key towards the website in plaintext.
If you send it in plaintext, again, the attacker will be able to find that out.
So you make use of this asymmetric key encryption to send the new symmetric key, which will then be
used for communication.
So what happens?
The web browser takes this public key.
Then the symmetric key is encrypted with this public key and sent it over to the web server.
Now, since the web server holds the private key, it will be able to decrypt the encrypted packet and
then the communication can begin.
Now one question comes is why will browser trust this?
So let's say browser receives a certificate and the certificate says verified by x, y, Z.
Now why will browser trust that?
That is the first question.
And second question is who will browser trust and who will it not trust?
So in order to understand that.
Let's go to options.
We'll go to privacy and security and let's go to view certificates.
So here, this basically contains the list of certificate authorities, which browser trusts.
So these are the entire list of the certificate authority, which my current Firefox browser trusts.
So if you go a bit up within the trusted entities, you also have let's encrypt over here.
So this is how things work.
So generally these issuers that you have, these issuers, you will have to pay to them.
So let's open up one of them.
So one of the issuers, you have a Comodo.
So Comodo is also one of the trusted entities within the browser.
So if you look into the SSL certificates, you can basically purchase the SSL certificates from them.
So basically they will verify because the issuer, whoever is the issuer, has to verify the details.
So if you're going through Comodo, then you will have to verify.
Then the Comodo will verify the details here.
So let's do one thing.
Let me quickly open up Wireshark.
And let's capture the packets going from the wireless interface.
And now let's open up a new private window.
And I'll open Labs internal.com.
So let's go back to Wireshark.
I'll stop the packet capture.
So let's do one thing.
Let's quickly find out the IP address associated with the domain.
So this is the IP address.
And we'll quickly create a filter.
So this is a filter.
So any packet going from my laptop towards the destination.
So currently you see the first packet was sin.
So this is part of the TCP handshake.
So as part of the TLS handshake, here you have the client.
Hello.
So any client who wants to communicate via the TLS protocol, the first packet is generally the client.
Hello.
So if you go a bit down, you also have the client key exchange.
So generally we already discussed that the server would typically send a certificate.
So the certificate would have all the information, including the public key.
So once the public key is being received by the client and the symmetric key is generated, then you
have the key exchange, which happens.
Then you have the Changecipherspec.
And just after Changecipherspec you have the encrypted message.
So this is part of the protocol.
Again, we will not be discussing in detail about the TLS handshake as of now, but generally after
this encrypted handshake message, then you typically have the application data.
Now if you look into the application data, so all the data is basically encrypted, so you will not
really know what exactly is being passed through.
So if there is any attacker who is sitting in between, he will not be able to get what exactly is this?
And if you look into the data protocol, it is Http over TLS.
This is something that we discussed in the Slide one.
To conclude this video, we'll just discuss the web server configuration because here when we open up
labs internal.com, right, it automatically happened.
The https trusted entity automatically appeared within the browser.
But internally we saw that there was a lot of things that happens in the TLS handshake.
So within the web server configuration, also the web server has to supply the certificate to the client.
Otherwise how will the client know?
So basically, so let's say this is a server name, this can be labs internal.com.
So what happens here is that you have a stanza of SSL underscore certificate where this is the certificate
chain.
So this is the certificate which is being passed to the client.
So client will then verify this certificate contents.
And you also have the SSL certificate key.
So this is basically the private key.
So we know that within the asymmetric key encryption there is both a public key and the private key.
So if a browser is encrypting the data with the public key, then the web server will decrypt the data
with the corresponding private key, which is being stored within the web server.
So the importance of this private key holds to be tremendously important because generally if this private
key is being stolen, then the communication can be decrypted as well.
So that's the high level overview about Https.
I hope at a glance you understood the Https protocol and why exactly it is being used for.
So with this we'll conclude this video.