How Does Secure Socket Layer (SSL) Work?

The Secure Socket Layer, SSL for short, is a protocol by which many services that communicate over the Internet can do so in a secure fashion. Before we discuss how SSL works and what kinds of security it provides, let us first see what happens without SSL.

Life on the Internet without SSL
Let us make an analogy between communications between computers on the Internet and communications between people over the telephone. Without SSL, your computer-to-computer communications suffer from the same security problems from which your telephone communications suffer:

• Who are you talking to?In a phone conversation, how can you be sure that the person who picks up the phone at the other end is really the person you are trying to call (especially if you have never spoken to them before)? What if your phone call was intercepted or re-routed, or what if someone else is answering your call recipient's phone? There really is no way to be sure you have reached the right person, especially if they are trying to fool you.
• Eavesdropping? As you are aware of from watching TV or reading, it is very easy to tap phone lines: the police and spies do this all the time to covertly gather information. It is not easy to detect if your lines are tapped. The same applies with communications over the Internet - how can you be sure that your communications are not being "tapped" and recorded?

This results in two very real security issues for communications over the Internet: 1. knowing for sure that you are connecting to the right computers (i.e. those at your bank and not those at a hacker's or phisher's web site), and 2. knowing that your data is safe from prying eyes during transit to those computers. This is where SSL comes in.

Enter the Secure Socket Layer (SSL)
To solve these problems to a large degree, most Internet services support use of SSL as a mechanism for securing communications. To illustrate how SSL works, let us use another analogy.
Client wants to communicate with Company to send important information back and forth. Client wants to be 100% sure that s/he is communicating with Company and that no one can eavesdrop on the communications. How can s/he do this?

• Client sends a courier to the Company's address.
• The company has envelopes that, when closed, can only be opened by the company. The company and the courier go together to a trusted third party - a notary - which makes the company provide documentation to prove its identity. The notary certifies the company's secure envelopes and the courier takes these back to the client.
• The client gets the envelopes and, if it trusts the notary's reputation, can be sure that they are actually from the company indicated.
• The client also has secure envelopes that, once sealed, only the client can open. It puts some of these in one of the company's secure envelopes and sends them back to the company.
• The company gets the sealed secure envelope. It opens the envelope (as only it can). It now has the client's secure envelopes.
• The company has another kind of envelope that can be opened and sealed only by using a special combination. The company puts this special envelope with the combination lock, together with the combination, into one of the client's secure envelopes. The company seals the envelope.
• The company has another type of secure envelope that anyone can open, but which only the company can seal. If you open one of these sealed envelopes, you know for sure that it was sent by the company. The company puts the whole package inside this and sends it to the client.
• When the client gets the secure envelope, it opens it and thus knows that it came from the company. It then opens the next secure envelope inside that can only be opened by the client. Inside it gets out the combination-envelope and the combination itself.
• The client the puts his data in the combination envelope, seals it and sends it to the company.
• The company receives it, opens it, and puts the response in the same secure envelope and sends it back.
• The procedure is repeated as often as necessary for required communications.

SSL relies on the concept of "public key cryptography" to accomplish these tasks. In normal encryption, the two parties communicating share a "password" and that password is used to both encrypt and decrypt messages. While this is fast and efficient, how do you communicate passwords to people you have not yet met in a way that is itself secure?
In "public key cryptography", each person has two keys - a "public" key and a "private" key. Anything encrypted with the user's public key can only be decrypted with the private key and vice versa. Each person then tells the world what his public key is and keeps his private key safe and secure, and private.
If John sends Mary a message encrypted with Mary's public key, then only Mary can open it, as only she has her private key. This is like an envelope that anyone can seal but which only Mary can open.
If John sends Mary a message encrypted with John's private key, then anyone can open it, as everyone has access to John's public key. However, successfully opening the message proves that it was sent by John and no one else, as only John has access to his private key. This is like an envelope that only John can seal, but which anyone can open and thus prove that John sealed it.

SSL in Action
So, lets see how SSL actually works for securing your communications over the Internet. Before the communications occur, the following takes place:

• Company wishes to secure communications to their server company.com.
• They create a public and private key for company.com (this is also known as a "certificate").
• They go to a "Trusted" third party company such as Thawte or Verisign: Thawte makes Company prove its identity and right to use the company.com domain. This usually involves a lot of paperwork and paying a hefty fee.
• Once the verification is complete, Thawte gives Company a new public key that has some additional information in it. This information is the certification from Thawte that this public key is for Company and company.com and that this is verified by Thawte. This certification information is encrypted using Thawte's private key... we will see why below.

Then, when Client wishes to communicate with Company at company.com,

• Client makes a connection to company.com with its computer. This connection is made to a special "port" (address) on company.com that is set up for SSL communications only.
• When Client connects to company.com on its SSL-secured port, Company sends back its public key.
• Client gets the public key and decides if it is OK...

1. If the public key has expired, this could be a problem
2. If the public key claims to be for some domain that is not company.com that could be a problem.
3.Client has the public key for Thawte (and many other third party companies) stored in its computer - because these come with the computer. Thus, client can decrypt the validation information, prove the validation is from Thawte and verify that the public key is certified by Thawte. If Client trusts Thawte, then Client can trust that he/she is really communicating with Company. If Client doesn't trust Thawte, or whatever Third Party company is actually being used, then the identity of who is running the computers to which Client is connecting is suspect.

• If client decides to trust the public key, then Client will send to Company the Client's public key.
• Company will then generate a "password" and encrypt it using both Client's public key and Company's private key, in succession, and send it back to the client.
• Client will decrypt the password. This process proves that Company sent the password and that only Client was able to read it.
• Client will start communicating with Company by encrypting data using this password. Normal "symmetric" (password-based) encryption takes place from this point forward because it is much faster than using the public and private keys for everything. These keys were needed to enable Company to prove its identity and right to domain.com and to give client the password in a safe way.

So, Are there Limitations to This Process?
This all sounds great - what are the down sides? There are a few.
Key Length:The statement that "only someone with the private key can decrypt something encrypted with the public key" is true so long as the private key cannot be "guessed". Hackers may try to do this by trying all possible private key combinations. Older "40bit" keys can be broken by trial and error if one has access to vast computer resources and a good amount of time. These days, keys used in SSL are 128bit or better. There are so many possible keys with 128bit that it would take significantly longer than the age of the universe to "guess" one.
Trust:While use of SSL ensures that your communications cannot be spied on, it comes down to trust to ensure that you are actually communicating with your intended company. This is reflected in the validation of company.com and your trust of the third party organization. Some "secure sites" do not bother to get a third party's approval and have their keys approved by "themselves". Others use third parties that are almost free and which spend very little effort in validating the company. In these cases, SSL provides you with no real assurance that you are really talking to your intended company and not some hacker trying to forge their identity to communicate with you in a manner in which you think you are safe.
For defensive use of the web, you should pay attention to warnings generated by SSL when you connect to secure sites. Such warnings include "expired certificates", "domain name mismatches" - where the domain name presented by the company is different than the one to which your are connecting, and "non trusted certificates" - where the public key (certificate) presented by the company was not validated by a third party that your computer trusts. In all of these cases, you should be wary.

New Specs for Next-Generation Blu-ray Players

Blu-ray Disc Association clarifies what new specs, due later this year, mean for owners of current Blu-ray players.
Reports that your newly purchased Blu-ray Disc player will be obsolete by October are greatly exaggerated.
While it is true that the Blu-ray Disc Association recently set new minimum specifications for players produced after October 31--as we first outlined in our "High-Def Video Superguide"-those specifications only expand on the capabilities already present in existing players.
I spoke with Andy Parsons, chair of the U.S. promotion committee for the Blu-ray Disc Association, to clarify some of the common misconceptions.
All current Blu-ray Disc players support the BD-Java spec. (BD-Java is the programming language used to design the menus and present interactive content on a Blu-ray Disc.) In fact, says Parsons, this was a requirement from the get-go: "All players introduced since day one must support BD-Java."
Already, movie titles like Chicken Little and The League of Extraordinary Gentlemen are taking advantage of BD-Java's capabilities; in both of those cases, the movie discs offer interactive games.
If BD-Java is shipping today, why the confusion? "This fall," explains Parsons, "is the end of a grace period. Any new Blu-ray Disc player model introduced after October 31 must now fully comply with the full range of existing Blu-ray Disc player specifications."

Blu-ray's New Specs
The new specification requirements will enable many cool, long-promised Blu-ray Disc features that will boost Blu-ray's competitiveness in the interactivity realm with archrival HD DVD on players produced after the October 31 deadline.
These features include mandatory minimum storage requirements of 256MB for stand-alone players and 1GB for BD Live-connected players. (BD Live players can download additional entertainment content from the Internet, and will also require an ethernet connection.) All players will also need to support on-demand picture-in-picture via a secondary video stream (which could be accomplished via one video decoder or two, depending on how the real-time video is encoded); in addition, the players must support secondary audio mixing for mixing sound effects generated within the player with the soundtrack of the film.
"What's caused the confusion is that BD-Java will be utilized to implement these new capabilities. It's not that this is a new version of Java, it's just the code that will be used to run these features," Parsons says.

HD DVD's Requirements
In contrast, HD DVD already has a minimum storage requirement of 128MB of memory, an ethernet connection for connected interactivity, and a secondary video stream for on-demand picture-in-picture video. The memory requirement enables HD DVD players and titles to support persistent bookmarks that can stay in your player's memory, even after you eject the disc. And some titles, such as Mission: Impossible III, already have picture-in-picture director commentaries that you can activate at any time during the playback of the movie.
Parsons notes that these new capabilities "are not make-or-break features. Picture-in-picture is nice for on-screen directory commentaries and the like. But the fundamental functions of a Blu-ray player are already available in existing players.
"And," he stresses, "your existing Blu-ray player will continue to play future titles as it does today."

What Current Players Won't Do
Current Blu-ray players won't be able to play an on-demand picture-in-picture commentary, for example, that may come on a disc a year from now. Nor will they be able to connect to the Internet for future interactive functions that may be incorporated into the disc. But when that happens, Hollywood studio technologists have explained to me, they will likely program the disc in such a way that--if your player can't support the new feature--the option won't even show as available during playback.
The one possible exception to this among the currently shipping players: Sony's PlayStation 3, which ranked fourth in our recent high-definition player roundup. For one thing, the PS3 meets the technical requirements for BD Live Internet connectivity. According to Sony, the company is investigating and evaluating the implementation of BD Live, but it has not yet made any announcements of adopting and supporting BD Live.