The Secure Socket Layer Port (SSL)

The Secure Sockets Layer (SSL) protocol is a security protocol that provides privacy over the Internet.
It is designed to provide privacy between client/server applications.

SSL requires a reliable transport protocol (e.g.TCP) for data transmission and reception.
The advantage of the SSL Protocol is that it is application protocol independent. A "higher level" application protocol (e.g. HTTP, FTP, TELNET, etc.) can layer on top of the SSL protocol transparently.
The SSL Protocol can negotiate an encryption algorithm and session key as well as authenticate a server before the application protocol transmits or receives its first byte of data.
All of the application protocol data is transmitted encrypted, ensuring privacy.

The SSL protocol provides "channel security" which has three basic properties:

• The channel is private. Encryption is used for all messages after a simple handshake is used to define a secret key.
• The channel is authenticated. The server endpoint of the conversation is always authenticated, while the client endpoint is optionally authenticated.
• The channel is reliable. The message transport includes a message integrity check (using a MAC).

Terminology

Application Protocol

An application protocol is a protocol that normally layers directly on top of TCP/IP. For example: HTTP, TELNET, FTP, and SMTP.

Authentication

Authentication is the ability of one entity to determine the identity of another entity. Identity is defined by this document to mean the binding between a public key and a name and the implicit ownership of the corresponding private key.

Bulk Cipher

This term is used to describe a cryptographic technique with certain performance properties. Bulk ciphers are used when large quantities of data are to be encrypted/decrypted in a timely manner. Examples include RC2, RC4, and IDEA.

Client

In this document client refers to the application entity that is initiates a connection to a server.

CLIENT-READ-KEY

The session key that the client uses to initialize the client read cipher. This key has the same value as the SERVER-WRITE-KEY.

CLIENT-WRITE-KEY

The session key that the client uses to initialize the client write cipher. This key has the same value as the SERVER-WRITE-KEY.

MASTER-KEY

The master key that the client and server use for all session keys generation. The CLIENT-READ-KEY, CLIENT-WRITE-KEY, SERVER-WRITE-KEY and SERVER-WRITE-KEY are generated from the MASTER-KEY.

MD2

MD2 is a hashing function that converts an arbitrarily long data stream into a digest of fixed size. This function predates MD5, which is viewed as a more robust hash function.

MD5

MD5 is a hashing function that converts an arbitrarily long data stream into a digest of fixed size. The function has certain properties that make it useful for security, the most important of which is it is inability to be reversed.

Nonce

A randomly generated value used to defeat "playback" attacks. One party randomly generates a nonce and sends it to the other party. The receiver encrypts it using the agreed upon secret key and returns it to the sender. Because the nonce was randomly generated by the sender this defeats playback attacks because the replayer can't know in advance the nonce the sender will generate. The receiver denies connections that do not have the correctly encrypted nonce.

Non-repudiable Information Exchange

When two entities exchange information it is sometimes valuable to have a record of the communication that is non-repudiable. Neither party can then deny that the information exchange occurred. Version 2 of the SSL protocol does not support Non-repudiable information exchange.

Public Key Encryption

Public key encryption is a technique that leverages asymmetric ciphers. A public key system consists of two keys: a public key and a private key. Messages encrypted with the public key can only be decrypted with the associated private key. Conversely, messages encrypted with the private key can only be decrypted with the public key. Public key encryption tends to be extremely compute intensive and so is not suitable as a bulk cipher.

Privacy

Privacy is the ability of two entities to communicate without fear of eavesdropping. Privacy is often implemented by encrypting the communications stream between the two entities.

RC2, RC4

Proprietary bulk ciphers invented by RSA. RC2 is block cipher and RC4 is a stream cipher.

Server

The server is the application entity that responds to requests for connections from clients. The server is passive, waiting for requests from clients.

Session cipher

A session cipher is a bulk cipher that is capable of encrypting or decrypting arbitrarily large amounts of data. Session ciphers are used primarily for performance reasons. The session ciphers used by this protocol are symmetric. Symmetric ciphers have the property of using a single key for encryption and decryption.

Session identifier

A session identifier is a random value generated by a client that identifies itself to a particular server. The session identifier can be thought of as a handle that both parties use to access a recorded secret key (in our case a session key). If both parties remember the session identifier then the implication is that the secret key is already known and need not be negotiated.

Session key

The key to the session cipher. In SSL there are four keys that are called session keys: CLIENT-READ-KEY, CLIENT-WRITE-KEY, SERVER-READ-KEY, and SERVER-WRITE-KEY.

SERVER-READ-KEY

The session key that the server uses to initialize the server read cipher. This key has the same value as the CLIENT-WRITE-KEY.

SERVER-WRITE-KEY

The session key that the server uses to initialize the server write cipher. This key has the same value as the CLIENT-READ-KEY.

Symmetric Cipher

A symmetric cipher has the property that the same key can be used for decryption and encryption. An asymmetric cipher does not have this behavior. Some examples of symmetric ciphers: IDEA, RC2, RC4.

SSL 2.0

Secure Sockets Layer (SSL) protocol version 2.0.

SSL 3.0

Secure Sockets Layer (SSL) protocol version 3.0.

TLS

Transport Layer Security (TLS) protocol.

Configuration of the Secure Socket Layer Port (SSL)

The Secure Socket Layer (SSL) ports is identified by the mnemonic "SSL" and it is provided with the parameters described in this section.

Here are examples on how to display the SSL port parameters. Displayed values are the defaults ones:

[11:47:16] ABILIS_CPX: D P PO:SSL

PO:917 - Not Saved (SAVE CONF), Not Refreshed (INIT) --------------------------
SSL    ------------------------------------------------------------------------
       LOG:NO        ACT:NO            max-cli:0           max-srv:4          
       mpxs:2048     SEND-TOUT:20      CACH-TOUT:300       AUTH-CLI:NO    
       PWDKEY-CLI:DFT                  PWDKEY-SRV:DFT             
       CERT-PATH:SYS (C:\1506\)                                

To activate changes made on the parameters displayed by low case characters, it is needed to restart the system; on the contrary for activating changes made on upper case parameters it is enough to execute the initialization command INIT PO:.
Changes made on LOG: parameter are immediately active.

The "Not Saved (SAVE CONF)" message is displayed every time the port configuration is modified but not saved with the SAVE CONF command.

The "Not Refreshed (INIT)" message is displayed every time the port configuration is modified but not refreshed with the INIT PO: command.

Detail of the SSL port parameters

Statistics of the Secure Socket Layer Port (SSL)

Example on how to show state and statistics of the SSL port through the command D S:

[11:10:58] ABILIS_CPX: D S PO:SSL

PO:917 ------------------------------------------------------------------------
SSL    STATE:INACTIVE         MAX-SRV:4               MAX-CLI:0   
       ------------------------------------------------------------------------
       -----------------------+---CHAN----+-CHAN-EST--+-CHAN-PEAK-+-SESS-CACH-|
       SERVER                 |0          |0          |0          |0          |
       CLIENT                 |0          |0          |0          |0          |
       ------------------------------------------------------------------------
       -----------------------+--HNDSHK---+-HNDSHK-OK-+----HIT----+--SESS-TO--|
       SERVER                 |0          |0          |0          |0          |
       CLIENT                 |0          |0          |0          |0          |
       ------------------------------------------------------------------------
       -----------|---INPUT---|--OUTPUT---|-----------|---INPUT---|--OUTPUT---|
       CHR        |          0|          0|PCK        |          0|          0|
       LONG       |          0|          0|BAD        |          0|           |
       ------------------------------------------------------------------------
       - Channels -------------------------------------------------------------
       +---+----+-------------+-----------+-----------+-----------+-----------+
       |CH |MODE|    STATE    |  CHAR-IN  |  PCK-IN   | CHAR-OUT  |  PCK-OUT  |
       +---+----+-------------+-----------+-----------+-----------+-----------+
       |  1|SRV |INACT        |          0|          0|          0|          0|
       |  2|SRV |INACT        |          0|          0|          0|          0|
       |  3|SRV |INACT        |          0|          0|          0|          0|
       |  4|SRV |INACT        |          0|          0|          0|          0|
       +---+----+-------------+-----------*-----------+-----------+-----------+

Example on how to show extended statistics of the SSL port through the command D SE:

[11:11:13] ABILIS_CPX: D SE PO:SSL

PO:917 ------------------------------------------------------------------------
SSL    --- Cleared 000:01:17:37 ago, on 25/03/2004 at 09:54:16 ----------------
       +---+----+-------------+-----------+-----------+-----------+-----------+
       |CH |MODE|    STATE    |  CHAR-IN  |  PCK-IN   | CHAR-OUT  |  PCK-OUT  |
       +---+----+-------------+-----------+-----------+-----------+-----------+
       |  1|SRV |INACT        |          0|          0|          0|          0|
       |  2|SRV |INACT        |          0|          0|          0|          0|
       |  3|SRV |INACT        |          0|          0|          0|          0|
       |  4|SRV |INACT        |          0|          0|          0|          0|
       +---+----+-------------+-----------*-----------+-----------+-----------+

It also possible to inspect extended statistics of the single SSL channel, by executing the command "D SE PO:xxx CH:yyy", where "xxx" is the SSSL port number and the "yyy" is a value in the range [1..100] corresponding to the channel identifier.

[11:13:55] ABILIS_CPX: D SE PO:917 CH:3

PO:917 ------------------------------------------------------------------------
SSL    --- Cleared 000:01:21:03 ago, on 25/03/2004 at 09:54:15 ----------------
       +---+----+-------------+-----------+-----------+-----------+-----------+
       |CH |MODE|    STATE    |  CHAR-IN  |  PCK-IN   | CHAR-OUT  |  PCK-OUT  |
       +---+----+-------------+-----------+-----------+-----------+-----------+
       |  3|SRV |INACT        |          0|          0|          0|          0|
       +---+----+-------------+-----------*-----------+-----------+-----------+

The information "Cleared DDD:HH:MM:SS ago, at DD/MM/YYYY HH:MM:SS", referred by the extended statistics, shows the elapsed time from the last reset of the statistics (by the format "days:hours:minutes:seconds") and date/time of its execution (by the format "day/month/year" and "hours:minutes:seconds").

Details of the state fields and statistics of the SSL port

Details of the state fields and statistics of the SSL channel

Print this page