Podobne
- Strona startowa
- (App Tutorial) Microsoft Office Excel 2003 Inside Out
- iptables tutorial
- TCP IP
- Linux Podręcznik Administratora Sieci
- MARKETING W INTERNECIE
- Kres Feliks W Polnocna Granica
- Conrad Joseph Wsrod pradow (2)
- Władysław Zahorski Podania i legendy
- linuxadmOK
- Williams Tad Smoczy tron (SCAN dal 952)
- zanotowane.pl
- doc.pisz.pl
- pdf.pisz.pl
- myszkuj.opx.pl
Cytat
Do celu tam się wysiada. Lec Stanisław Jerzy (pierw. de Tusch-Letz, 1909-1966)
A bogowie grają w kości i nie pytają wcale czy chcesz przyłączyć się do gry (. . . ) Bogowie kpią sobie z twojego poukładanego życia (. . . ) nie przejmują się zbytnio ani naszymi planami na przyszłość ani oczekiwaniami. Gdzieś we wszechświecie rzucają kości i przypadkiem wypada twoja kolej. I odtąd zwyciężyć lub przegrać - to tylko kwestia szczęścia. Borys Pasternak
Idąc po kurzych jajach nie podskakuj. Przysłowie szkockie
I Herkules nie poradzi przeciwko wielu.
Dialog półinteligentów równa się monologowi ćwierćinteligenta. Stanisław Jerzy Lec (pierw. de Tusch - Letz, 1909-1966)
[ Pobierz całość w formacie PDF ]
.4.The server sends a finished message indicating the negotiation part iscompleted.The server then sends the change cipher spec message.5.Finally the session partners separately generate an encryption key, the masterkey from which they derive the keys to use in the encrypted session thatfollows.The Handshake protocol changes the state to the connection state.All data taken from the application layer is transmitted as special messages tothe other party.There is significant additional overhead in starting up an SSL session comparedwith a normal HTTP connection.The protocol avoids some of this overhead byallowing the client and server to retain session key information and to resume thatsession without negotiating and authenticating a second time.Following the handshake, both session partners have generated a master key.From that key they generate other session keys, which are used in thesymmetric-key encryption of the session data and in the creation of messagedigests.The first message encrypted in this way is the finished message from theserver.If the client can interpret the finished message, it means:Privacy has been achieved, because the message is encrypted using asymmetric-key bulk cipher (such as DES or RC4).The message integrity is assured, because it contains a MessageAuthentication Code (MAC), which is a message digest of the message itselfplus material derived from the master key.The server has been authenticated, because it was able to derive the masterkey from the pre-master key.As this was sent using the server's public key, it336 TCP/IP Tutorial and Technical Overview could only have been decrypted by the server (using its private key).Note thatthis relies on the integrity of the server's public key certificate.5.7.2.3 SSL Record ProtocolOnce the master key has been determined, the client and server can use it toencrypt application data.The SSL record protocol specifies a format for thesemessages.In general they include a message digest to ensure that they have notbeen altered and the whole message is encrypted using a symmetric cipher.Usually this uses the RC2 or RC4 algorithm, although DES, triple-DES and IDEAare also supported by the specification.The U.S.National Security Agency (NSA), a department of the United Statesfederal government imposes restrictions on the size of the encryption key that canbe used in software exported outside the U.S.These rules are currently underreview, but the present effect is to limit the key to an effective size of 56 bits.TheRC2 and RC4 algorithms achieve this by using a key in which all but 56 bits are setto a fixed value.International (export) versions of software products have thishobbled security built into them.SSL checks for mismatches between the exportand nonexport versions in the negotiation phase of the handshake.For example, ifa U.S.browser tries to connect with SSL to an export server, they will agree onexport-strength encryption.See 5.2.7, Export/Import Restrictions on Cryptography on page 279 for more information on recent changes of U.S.export regulations ofcryptographic material.5.8 Transport Layer Security (TLS)The Transport Layer Security 1.0 protocol is based on SSL.At the time of writing,the TLS 1.0 protocol is not a standard protocol.(Please refer to current TLS draftdocument for more information about SSL.) There are not significant differencesbetween SSL 3.0 and TLS 1.They can interoperate with some modifications onthe message formats.5.9 Secure Multipurpose Internet Mail Extension (S-MIME)Secure Multipurpose Internet Mail Extension (S-MIME) can be thought of as a veryspecific SSL-like protocol.S-MIME is an application-level security construct, but itsuse is limited to protecting e-mail via encryption and digital signatures.It relies onpublic key technology, and uses X.509 certificates to establish the identities of thecommunicating parties.S-MIME can be implemented in the communicating endsystems; it is not used by intermediate routers or firewalls.5.10 Virtual Private Networks (VPN) OverviewThe Internet has become a popular, low-cost backbone infrastructure.Its universalreach has led many companies to consider constructing a secure virtual privatenetwork (VPN) over the public Internet
[ Pobierz całość w formacie PDF ]