Shulou(Shulou.com)05/31 Report--

This article mainly introduces the relevant knowledge of "HTTPS Application case Analysis". The editor shows you the operation process through the actual case. The operation method is simple, fast and practical. I hope this "HTTPS Application case Analysis" article can help you solve the problem.

1. HTTP protocol

Before talking about the HTTPS protocol, let's review the concept of the HTTP protocol.

1.1 introduction of HTTP protocol

HTTP protocol is a text-based transport protocol, which is located in the application layer of the OSI network model.

Img

The HTTP protocol communicates through the request response of the client and the server. At present, the previous RFC 2616 split into six separate protocol specifications (RFC 7230, RFC 7231, RFC 7232, RFC 7233, RFC 7234, RFC 7235). The communication message is as follows:

Request POST http://www.baidu.com HTTP/1.1

Host: www.baidu.com

Connection: keep-alive

Content-Length: 7

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36

Wd=HTTP response HTTP/1.1 200OK

Connection: Keep-Alive

Content-Encoding: gzip

Content-Type: text/html;charset=utf-8

Date: Thu, 14 Feb 2019 07:23:49 GMT

Transfer-Encoding: chunked

.. 1.2 HTTP man-in-the-middle attack

HTTP protocol is indeed very convenient to use, but it has a fatal disadvantage: it is not secure.

We know that the messages in the HTTP protocol are transmitted in clear text without any encryption. What problems will this cause? Here's an example:

Xiao Ming posted a post in the JAVA bar saying that I love JAVA:

Attacked by the middleman, the content was modified as I love PHP Xiaoming was mocked by the crowd (manual dog head)

You can see that during the HTTP transmission, the middleman can see and modify all the requests and responses in the HTTP communication, so it is very insecure to use HTTP.

1.3 prevent man-in-the-middle attacks

At this time, someone may have thought that since the content is plaintext, then I use symmetric encryption to encrypt the message so that the middleman can not see the plaintext, so it is modified as follows:

Both parties agreed to use AES to encrypt the message.

In this way, it seems that the middleman cannot get the plaintext information, but in fact, the encryption method and the secret key will be exposed in the plaintext during the communication process. If the first communication is intercepted, the secret key will be leaked to the middleman. The middleman can still decrypt subsequent communications:

So in this case, we will certainly consider whether the secret key can be encrypted from the middleman. The answer is yes, using asymmetric encryption, we can use the RSA algorithm to achieve.

When the encryption method is agreed, a pair of public and private keys are generated by the server, the server returns the public key to the client, and the client generates a string of secret keys (AES_KEY) locally for symmetric encryption, which is encrypted through the public key sent by the server (AES_KEY_SECRET), and then returned to the server. The server decrypts the AES_KEY_SECRET sent by the client through the private key to get the AEK_KEY. Finally, the client and the server encrypt the message through AEK_KEY. The modification is as follows:

You can see that in this case, the middleman cannot steal the key for AES encryption, so it is definitely impossible to decrypt subsequent communications, so is it absolutely safe to do so?

The so-called as virtue rises one foot vice rises ten, the middleman came up with a new cracking scheme in response to this encryption method. Since I couldn't get the AES_KEY, I simulated myself as a combination of the client and the server. The middleman simulated the server's behavior in the process of user-> middleman, so that we could get the plaintext of the user's request, and the middleman simulated the client behavior in the process of middleman-> server. In this way, you can get the plaintext of the server response to conduct man-in-the-middle attacks:

Img

This time the communication was intercepted again by the middleman, who also forged a pair of public and private keys and sent the public keys to the user to steal the AES_KEY generated by the client. After getting the AES_KEY, it can be easily decrypted.

If the middleman does whatever he wants, is there no way to impose sanctions? of course there is. Next, let's take a look at how HTTPS solves the problem of communication security.

2. Brief introduction of HTTPS Protocol 2.1 HTTPS

HTTPS is actually the abbreviation of SSL+HTTP. Of course, SSL has been basically replaced by TLS, but then we will take SSL as the abbreviation. SSL protocol is not only applied to HTTP protocol, but also to various application layer protocols, such as FTP and WebSocket.

In fact, SSL protocol is roughly the same as the nature of asymmetric encryption in the previous section. The main purpose of the handshake is to exchange keys, and then use symmetric encryption to communicate. The process is as follows:

Here I just draw a schematic diagram, in fact, the real SSL handshake would be much more complicated, but the nature is still similar, and the focus here is how HTTPS prevents man-in-the-middle attacks.

As can be seen from the figure above, the server passes the public key through the SSL certificate, and the client verifies the SSL certificate, in which the certificate authentication system is the key to ensure SSL security. Next, we will explain the CA authentication system and see how it prevents man-in-the-middle attacks.

2.2 CA authentication system

In the previous section, we saw that the client needs to verify the SSL certificate returned by the server, so how does the client verify the security of the server SSL certificate.

Authoritative certification organizations in the CA certification system, all certificates are issued by authoritative organizations, and CA certificates of authoritative institutions are already built into the operating system. We call these certificates CA root certificates:

Issue a certificate

If our application server wants to use SSL, it needs to be issued by an authoritative certification body.

CA certificate

We send the public key generated by the server and site-related information to

CA issuing agency

And then by

CA issuing agency

The relevant information sent through the server is used

CA issuing agency

Add the signature to get the certificate of our application server, which will generate the certificate content accordingly.

Signature

And put the

Signature

Use

CA issuing agency

The private key is encrypted to get

Certificate fingerprint

And generate a relationship chain with the superior certificate.

Here we download Baidu's certificate and have a look:

You can see that Baidu is trusted by GlobalSign G2, and the same GlobalSign G2 is trusted by GlobalSign R1. When the client (browser) verifies the certificate, it will check up level by level until the final root certificate. If there is no problem, the server certificate can be trusted.

How to verify the server certificate? how does the client (browser) verify the server certificate? first of all, it will find the superior certificate through the hierarchical relationship, decrypt the certificate fingerprint of the server through the public key in the superior certificate to get the signature (sign1), and then calculate the signature (sign2) of the server certificate through the signature algorithm. By comparing sign1 and sign2 If it is equal, it means that the certificate has not been tampered with or forged.

What is interesting here is that the RSA used for certificate verification is cleverly verified by private key encryption certificate signature and public key decryption.

In this way, through the certificate authentication system, we can prevent the middleman from stealing AES_KEY and initiate to intercept and modify the messages of HTTP communications.

This is the end of the introduction to "HTTPS Application case Analysis". Thank you for reading. If you want to know more about the industry, you can follow the industry information channel. The editor will update different knowledge points for you every day.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.