What is a Root CA and Intermediate Certificate? (86/285 technotes for 2015)

• The Root certificate has the private key issued by the CA (Certificate Authority). 
• This is set offline and has to be in a secured location as it contains the private key.
• From the Root CA - 2nd Level / Intermediate Certificate’s are generated
  
• 2nd Level Certificates are responsible for issuing certificated to any websites which require certificates.

• In order for the browser accesing a website to trust a certificate, the browser has to be pre-loaded with the Root Certificate (the red arrow).

References:

https://youtu.be/LRMBZhdFjDI

Creating a SSL Initiation Policy (78/285 technotes for 2015)

• Login
  
• Resources –> Security Policies –> SSL

Importing SSL Certificate in Forum Sentry (76/285 technotes for 2015)

• Login 
• Resources –> PKI –> Keys

What are the short comings of SSL? (21 of 285 technotes for 2015)

SSL/TLS Shortcomings -

• SSL is point to point - when the message reaches a peer server
• SSL needs to be stripped off so that the message can be processed
  

SSL Limitations:

• SSL is point to point - where as we need end 2 end security, as typical enterprise application has multiple layers.

• SSL is transport layer security - not message level security - data in disk cannot be protected by ssl

• HTTPS - does not support nonrepudiation well - critical for business
  
• server can prove that a completed transaction was requested by a client (in case a dispute arises)
  
• SSL does not support element wise signing - i.e. sign only the credit card details of the entire message.
  

What is SSL Accelerators? (20 of 285 technotes for 2015)

SSL acceleration is a method of offloading the processor-intensive public-key encryption algorithms involved in SSL transactions to a hardware accelerator.


Typically this means having a separate card that plugs into a PCI slot in a computer that contains one or more co-processors able to handle much of the SSL processing.

References:
http://en.wikipedia.org/wiki/SSL_acceleration

What is XML Signature? (16 of 285 tech notes for 2015)

XML Signature or Digital Signature:

• Provides end 2 end message integrity - gurantee
  
• authentication information about msg originator

To handle SSL shortcomings the XML Signature is used.

XML Signature:

• “hash” the message - 
  
• arbitrary stream of bytes and converts it to a single fixed-size value known as a digest.
  
• A digest is a one-way process: it’s “computationally infeasible” to recreate a message from the hash
  
• or to find two different messages which produce the same digest value.
  
• common hash mechanism is SHA1, the Secure Hash Algorithm

• (read more in the link below)

——————————–

• To hash the message - we need a shared secret key which should be difficult to guess
• use Kerberos
• when 2 entities want to communicate
• a central authority distributes “tickets” that contain a temporary session key 

• Or use public-key cryptography
• private key, known only to the holder
  
• public key, accessible to anyone who wants to communicate with the key holder
  
• anything encrypted with the private key can only be decrypted with the public key, and vice versa 
• (read more about RSA in the link below)

——————————– 

• I want to send message M
• generate a digest, H(M)
  
  
  
• signature  - encrypt the digest with my private key, {H(M)}private-key
• you receive the message, M and the signature
  
• you generate the digest, H’(M)
  
  
  
• decrypt the signature using my public key getting the H(M)
• If H(M)and H’(M) are the same, then we know that M is the same  
  

References:

MSDN - http://bit.ly/1Hnqek1

What is SSL (Secure Sockets Layer)? (14 of 285 technotes for 2015)

• SSL is a security protocol for the transport layer.
• A protocol is  guideline to define how an algorithm should be written.
• SSL encrypts the messages between the web server and the browser.