Pay is the application layer protocol of Web sites as you probably know.
So this is why you see Haiti T.P. slash slash flame going to be RIDO Google dot com and that will take
a page TTP version of the Web site.
Now if you look here it literally sends a text that looks like this to and from the servers.
And this is the hasty ETP protocol here.
It's saying that it's a hasty protocol it's talking about day servers and then below it you have the
hastier mail code which is what you'll see if you look at the source code of the pages.
It looks like there's so the GDP is in plain text.
Now if by close this and actually go to Google and change it to Haiti GP s I am now running Hayes's
E.P. over TLR or SSL has UDP provides the security services of Tellez because it uses tailless so data
encryption authentication usually at the server side message integrity an optional client or browser
authentication when you access a web site with hated CBS Web server will start the task to invoke SSL
and protect the communication the server sends a message back to the client indicating a secure session
should be established and the client in response sends it security parameters.
So that means it will say I'm prepared to use this digital signature unprepared to use this key exchange
algorithm.
I'm prepared to use this symmetric key and the server compares those security parameters to his own
until it finds a match.
And this is called the hand-shaking phase the server authenticate the client by sending it a digital
certificate which we will be covering next.
And if the client decides to trust the server the process continues the server can require the client
to send over a digital certificate to for mutual thanto occasion.
But that doesn't often happen.
But if you're looking for a full secure end to end session with authentication of yourself and the other
side you would use certificates either side with digital signatures those digital certificate finding
the authentication and you'll understand that a little bit more when we go to digital certificates the
client generates a symmetric sesshin key like by using a yes and encrypts it with a serve as public
key.
This encrypted key is sent to the web server and they both use the symmetric key to encrypt the data
they send back and forth.
This is how the secure channel is established tailless requires a tailless enabled server browser and
all modern browsers support TLR.
As we saw on the Wikipedia page and in all of the browsers you'll see hastier CPS which will indicate
that T.L. S is being used and you often see a padlock as well and all the browsers have some sort of
equivalent of this in order for you to know that I hated CPS or hate ETP with T.L. less is being used.
If this is not shown then the connection is not encrypted or authenticated and it will be sent in plain
text.
So just as you see here and all of the contents of the Web site just as I can see them now if HDTV is
not used we look at a padlock here.
We can see the technical details for what the encryption algorithms are.
So in this case it's using less using elliptical curve with DIFI Helmar.
The auction of rsa the symmetric key is a yes with 128 bits with a GCM mode of operation and Shaugh
to 5 6 for data integrity.
This had been negotiated between the client and the server.
And if we look in why I don't watch soccer as a protocol analyzer so you can see the traffic as it goes
in and out.
I can see here the conversation that happened where my client or my browser is said these are things
that I support and the server has responded.
And say well this is what I would actually like to use.
And then they provided the certificate with the digital signature and the public key on it.
And on the Web site you can go to is SSL labs and if you enter in the web site or you are now of a site
that is ruining Haiti CPS you can see more encryption options are off by that site.
So here we can see that bank of america signature algorithm is Shaar to 5:6 with our say for the digital
signature.
We can see the chain of trust here.
Bank of America's certificate a chain of trust comes down here and then we have the root certificate
here.
And the protocols.
The server is prepared to use current interest in site and it gives you a rating for how good it thinks
the site is.
A final point on Haiti and a privacy problem.
Something called the server name indication as an I is an extension to teach a class by which a client
indicates which hostname is attempting to connect to at the start of the handshake process and you can
see that represented here within Wireshark.
We can see the server name.
Do we do we w Daut outlook dot com.
This allows a server to present multiple certificates on the same IP address and TCAP port number and
hence allow multiple secure hasty T-P s web sites or any other service over Tellez to be secured by
the same IP address without requiring all those sites to use the same certificate the desired hostname
as you can see here is not encrypted.
So an eavesdropper can see which site is being requested as an I is used to implement censorship and
block sites as Sanai means if you're using Hastey CPS eavesdroppers can see what site you are going
to.
But then after that the communication is scrambled or encrypted.