Why is HTTPS protocol secure?

1. What is HTTPS protocol security?

As we all know, HTTP, as an Internet application layer protocol standard, does not have much security design. From the perspective of cryptography theory, the security of a transmission must ensure three basic elements: (1) data confidentiality; (2) data integrity; and (3) identity verification security .

HTTPS can be simply understood as HTTP over SSL/TLS. Before the client and server use HTTPS to transmit business data, the SSL/TLS protocol first establishes a secure channel between the two ends (this process is called the handshake negotiation phase), and then encrypts the HTTP business message on the secure channel for transmission (this process is called the encrypted data transmission phase). Next, we will discuss in detail why the HTTPS protocol is secure, starting from the security issues of HTTP itself and how HTTPS solves the above three problems.

Figure 1 HTTP vs HTTPS

2. Problems with HTTP communication transmission

Where is the security of SSL/TLS reflected, what security issues does it solve, and how are they solved? The following is an introduction step by step.

First, let's understand the security issues that exist when using plaintext HTTP communication between clients and servers.

Figure 2 HTTP security issues and transformation from HTTP to HTTPS

Regarding the plaintext data transmission of the HTTP protocol, the most common attack method used by attackers is network sniffing , which attempts to analyze sensitive data from the data packets in the transmission process, such as the administrator's login process in the background of the Web program, the user's private information (mobile phone number, ID number, credit card number) and other important information, which may lead to serious security incidents.

When the HTTP protocol transmits client requests and server responses, the only data integrity check is to include the length of the data being transmitted in the message header, but no confirmation is made on whether the content has been tampered with. Therefore, attackers can easily launch a man-in-the-middle attack, modify the data transmitted between the client and the server, or even insert malicious code into the transmitted data, causing the client to be directed to a malicious website and implanted with a Trojan.

3. The role of SSL/TLS protocol

The SSL/TLS protocol uses technologies such as digital certificates, asymmetric keys, symmetric encryption algorithms, and message authentication code algorithms to implement security protection measures such as identity authentication, data transmission encryption, and anti-tampering for both parties in communication. Its main goals are:

• Data confidentiality: Ensure that data content will not be viewed by a third party during transmission, preventing leakage of user data information.
• Data integrity: timely discover transmission content that has been tampered with by a third party, and refuse to receive the data if it is found that the data has been tampered with.
• Identity verification security: ensures that data reaches the destination expected by the user. The client needs to verify whether the other party currently communicating is the expected server, not a fake server. Conversely, the server can also verify the validity of the client.

3.1 How to achieve data confidentiality through SSL/TLS protocol?

In HTTPS, data confidentiality refers to the encryption of HTTP plaintext data transmitted between the client and the server. The algorithm used is a symmetric encryption algorithm, such as AES. The data confidentiality implementation process is as follows:

Figure 3 Data confidentiality implementation process

Data confidentiality requires that both parties have the same key, and this key can only be known by the two parties and cannot be obtained by a third party. In actual communication, this key is not fixed and will not be saved to a disk file. Every time the client establishes a new connection with the server, it will renegotiate the same key. In the first phase of the SSL/TLS protocol, the handshake negotiation phase, the server and the client will exchange some message information. The server and the client will each generate the same key based on the information in the message and save the key in memory. Once the connection is disconnected, the key in the memory will be automatically destroyed to avoid key leakage.

3.2 How to achieve data integrity through SSL/TLS protocol?

Data integrity is used to prevent HTTP data from being tampered with. If the data is found to be tampered with, the data packet will be rejected. The algorithm used is called the message authentication code algorithm ( MAC) . The data integrity implementation process is as follows:

Figure 4 Data integrity implementation process

Similar to the key acquisition method in data confidentiality, the keys here are also generated during the SSL/TLS key negotiation phase, are identical, and are stored in their respective memories.

3.3 How to achieve identity verification security through SSL/TLS protocol?

In HTTPS, the client needs to verify the identity validity of the communication end to ensure that the client is communicating with the expected real server, rather than with an impersonated attacker.

Identity verification security is mainly achieved by using digital certificate technology. There are many concepts involved in digital certificates, such as digital certificate issuance, CA certificate, root certificate, certificate chain, certificate validity verification, asymmetric key algorithm, signature/verification, etc. This article does not provide a comprehensive introduction, but only describes the concepts involved in SSL/TLS:

3.3.1 Asymmetric Key Algorithms

In a symmetric key algorithm, the key used for encryption and decryption operations is the same, and both parties in communication need to know this key. In an asymmetric key algorithm, there are two keys, forming a key pair; the key that can be made public is called the public key, and anyone can know the public key, so there is no fear of leakage; the key that needs to be kept secret is called the private key, and only the person knows the private key and cannot be leaked; each party in communication can send its public key to the other party, but only the person knows its private key; the same data can be encrypted with the public key and decrypted with the private key, and vice versa, encrypted with the private key and decrypted with the public key.

Figure 5 Asymmetric key usage 1 - encrypted transmission of communication data

As shown in Figure 5, in the SSL/TLS protocol, there is an operation to encrypt and transmit communication data using an asymmetric key algorithm. In the scenario where the communication data is encrypted and transmitted using an asymmetric key algorithm, the process on the left of Figure 5 will be used. It should be noted here that the process on the right of Figure 5 is public and anyone can know it. Data encrypted with a private key is not confidential because anyone with the public key can decrypt the data. All eavesdroppers can obtain the public key and see the real data content. In fact, the use scenario of "private key encryption-public key decryption" on the right of Figure 5 is called signature generation and verification, which is also used in the SSL/TLS protocol. The signature generation and verification process is as follows:

Figure 6 Asymmetric key application 2 - Generation and verification of communication data signature

The data encrypted by the private key - the signature value - does not have confidentiality, but it has a verification function. In Figure 7, the communication data is the plaintext message plus the signature value of the message. The signature value is used to verify the plaintext message to verify the correctness of the plaintext message and whether it has been tampered with.

The usage of asymmetric key algorithms can be summarized as follows:

📌Public key encryption-private key decryption ➜Used for data encryption transmission ➜Communication data is ciphertext

📌Private key encryption-public key decryption ➜Used for signature generation and verification ➜Communication data is plaintext message plus message signature value

3.3.2 Digital Certificate

This article does not go into detail about the issuance of digital certificates, verification of digital certificates, and certificate chains. You only need to know the following points:

①HTTP to HTTPS, some modifications involved in the client and server , mainly including

• Server

-The server needs to configure SSL/TLS related configuration items for a certain service, such as cipher suites, certificate/private key file paths.

-Deploy a digital certificate issued by a CA that contains the server public key and server domain name information, and the certificate can be made public.

-Deploy a private key file that is paired with the public key. The private key file must have certain security protection measures and cannot be leaked.

• Client

-The browser configures CA certificates, root certificates and other files, which are generally built-in by default.

②The use of certificates is mainly in the SSL/TLS protocol handshake negotiation phase , which is briefly described as follows:

-After the client and server establish a connection, at the beginning of the SSL/TLS protocol handshake negotiation phase, the server sends its digital certificate to the client, and the server uses its own private key file.

-After the client receives the server digital certificate, it verifies the validity of the server digital certificate through the configured CA certificate and root certificate according to the verification logic of the certificate chain. Once the verification is successful, it means that the server identity is correct.

-The client retrieves the server public key from the digital certificate, and the server retrieves the server private key from its own private key file.

After that, the client and server will use this pair of asymmetric keys to perform other processing in the SSL/TLS protocol handshake negotiation phase. The RSA key negotiation algorithm uses the usage of Figure 5, while the DHE and ECDHE key negotiation algorithms use the usage of Figure 6.

IV. Conclusion

With the rapid development of the Internet, network security has become an important factor related to the smooth operation and security of the economy. As the international information security environment becomes increasingly complex, the West has stepped up its containment of my country's network and accelerated the use of the network for ideological infiltration. my country's network security faces severe challenges. As the operator of my country's basic network facilities, China Mobile will accelerate the construction of related network security in the future.