当前位置：网站首页>Basic research on Chang'an chain TLS

Basic research on Chang'an chain TLS

2022-07-18 20:36:00 【InfoQ】

This article has participated in 「 Open source star picking program 」, Welcome to join us . Activity Links ：
https://github.com/weopenprojects/WeOpen-Star

TLS  Both symmetric algorithm and asymmetric algorithm are used .
TLS  The whole process of can be roughly divided into two main stages ：
handshake phase , To complete the verification , Negotiate a Password Suite , Then generate a symmetric key , For subsequent encrypted communication .
Encrypted communication phase , Data is encrypted and decrypted by symmetric encryption algorithm .

TLS  The handshake phase of requires different types of security in the following four links , They can be said to be  TLS  Of “ Four Dharma protectors ”.

Key exchange algorithm ： Ensure that the exchange of symmetric keys is secure , Typical algorithms include  DHE、ECDHE.

Authentication and signature algorithms ： Confirm the identity of the server , In fact, it is the verification of certificates , Asymmetric algorithm is used here . Typical algorithms include  RSA、ECDSA. Add ： In case of two-way verification （mTLS）, The server will verify the client's certificate .

Symmetric encryption algorithm ： Encrypt the application layer data , Typical algorithms include  AES、DES.

Message integrity verification algorithm ： Make sure that the message is not tampered with , Typical algorithms include  SHA1、SHA256.

Each type has many different specific algorithm implementations , Their combination , It's the password suite  Cipher Suite.
  First look at a typical Password Suite ：TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA（0xc013）

TLS  Needless to say , On behalf of  TLS  agreement .
ECDHE  It's a key exchange algorithm , Both parties do not need to directly transmit symmetric keys through it , It only needs to exchange the random numbers and other information generated by both sides , You can calculate the symmetric key respectively .
RSA  It is authentication and signature algorithm , It is mainly the client to verify the validity of the server certificate , Make sure the server is the one , Non counterfeit .AES128_CBC  It's symmetric encryption , This algorithm is used to encrypt and decrypt the application layer data . there  CBC  It belongs to block encryption mode , Another type of mode is streaming encryption .
SHA  The last integrity checking algorithm （ The hash algorithm ） 了 , It is used to ensure that the ciphertext is not tampered .
0xc013  Well , Is the number of this cipher suite , Each cipher suite has its own number

To Chang'an chain java The client catches the report , Look at the suite supported by the client
null
Look at the suite supported by the server
null
There are common kits , Two can match

TLS_AES_128_GCM_SHA256 (0x1301)

Find a problem , Continue to study tomorrow
原网站

版权声明
本文为[InfoQ]所创，转载请带上原文链接，感谢
https://yzsam.com/2022/199/202207161720162426.html

边栏推荐

猜你喜欢

随机推荐