Know and understand secure socket layer (SSL) including encrypted links between the server and the client computer

Published by Patrick Mutisya · 14 days ago

Cambridge IGCSE ICT 0417 – Safety and Security: Secure Socket Layer (SSL)

Safety and Security – Secure Socket Layer (SSL)

What is SSL?

Secure Socket Layer (SSL) is a cryptographic protocol that provides secure communication over a computer network, most commonly the Internet. It creates an encrypted link between a web server (the “server”) and a web browser (the “client”). This link ensures that any data transferred cannot be read or altered by third parties.

Key Concepts

  • Encryption – transforms readable data (plaintext) into an unreadable form (ciphertext) using an algorithm and a key.
  • Decryption – the reverse process that converts ciphertext back to plaintext using the appropriate key.
  • Public‑key (asymmetric) cryptography – uses a pair of keys: a public key (shared openly) and a private key (kept secret).
  • Symmetric cryptography – uses a single secret key for both encryption and decryption; it is faster than asymmetric encryption.
  • Digital certificate – an electronic document issued by a Certificate Authority (CA) that binds a public key to the identity of a server.

How SSL Works – The Handshake Process

The SSL handshake establishes a secure session before any actual data is exchanged. The steps are shown in the table below.

StepActionPurpose
1Client sends a ClientHello messageNegotiates SSL/TLS version, cipher suites, and random data
2Server replies with a ServerHello messageSelects the protocol version and cipher suite; sends its digital certificate
3Client validates the server’s certificateEnsures the server is authentic (checks CA signature, expiration, domain name)
4Client generates a pre‑master secret and encrypts it with the server’s public keyOnly the server can decrypt it using its private key
5Both parties derive the session keys from the pre‑master secretCreates symmetric keys for bulk data encryption and integrity checking
6Client sends a Finished message encrypted with the session keyConfirms that the handshake was successful from the client side
7Server replies with its own Finished message encrypted with the session keyConfirms that the handshake was successful from the server side

Encryption Used After the Handshake

Once the handshake is complete, all data transferred between client and server is encrypted using the symmetric session keys. The typical process is:

  1. Plaintext data is taken from the application layer (e.g., a web form).
  2. The data is encrypted with the session’s symmetric key using a block cipher such as AES.
  3. The ciphertext is sent over the network.
  4. The receiving side decrypts the ciphertext with the same symmetric key to retrieve the original plaintext.

Why SSL Is Important for Security

  • Confidentiality – Prevents eavesdropping on sensitive information such as passwords, credit‑card numbers, and personal data.
  • Integrity – Detects any alteration of data during transmission using message authentication codes (MACs).
  • Authentication – Verifies that the client is communicating with the intended server, reducing the risk of phishing and man‑in‑the‑middle attacks.

Common SSL Indicators in a Web Browser

  • Padlock icon in the address bar.
  • URL begins with https:// instead of http://.
  • Clicking the padlock shows certificate details (issuer, validity period, etc.).

Potential SSL \cdot ulnerabilities

  • Use of outdated protocol versions (e.g., SSL 2.0, SSL 3.0) – these are vulnerable to attacks such as POODLE.
  • Weak cipher suites (e.g., RC4, DES) – can be broken with modern computing power.
  • Improper certificate validation – may allow attackers to present fraudulent certificates.

Best Practices for Maintaining SSL Security

  1. Always use the latest TLS version supported by both client and server (currently TLS 1.3).
  2. Configure servers to disable obsolete protocols and weak cipher suites.
  3. Obtain certificates from reputable Certificate Authorities and renew them before expiration.
  4. Implement HTTP Strict Transport Security (HSTS) to force browsers to use HTTPS.
  5. Regularly scan for SSL/TLS configuration issues using tools such as SSL Labs.

Suggested diagram: SSL handshake flow showing messages between client and server, highlighting the exchange of the certificate, encrypted pre‑master secret, and creation of session keys.

Summary

SSL (now superseded by TLS) creates a secure, encrypted link between a client computer and a server. The handshake uses asymmetric cryptography to safely exchange a symmetric session key, after which all data is encrypted with fast symmetric algorithms. Understanding SSL is essential for protecting data privacy, ensuring data integrity, and authenticating web services in the digital world.