SSL and TLS: Designing and Building Secure Systems

Eric Rescorla

SSL and TLS: Designing and Building Secure Systems
  • 出版商: Addison Wesley
  • 出版日期: 2000-10-17
  • 售價: $1,880
  • 貴賓價: 9.5 折 $1,786
  • 語言: 英文
  • 頁數: 528
  • 裝訂: Paperback
  • ISBN: 0201615983
  • ISBN-13: 9780201615982

    • 立即出貨 (庫存 < 3)

買這商品的人也買了...

相關主題

商品描述


Description

The step-by-step guide to securing Web systems and traffic with SSL and TLS, the Internet's leading security protocols.

  • Includes extensive coverage of Transport Level Security (TLS), the powerful security protocol that will succeed SSL.
  • From the basics to advanced topics: authentication, algorithms, Kerberos, and beyond.
  • By Eric Rescorla, leader of two IETF TLS working groups -- a world-renowned expert in network security architectures.
Secure Sockets Layer (SSL) is used in virtually every commercial web browser and server. In this book, one of the world's leading network security experts explains how SSL works -- and gives implementers step-by-step guidance and proven design patterns for building secure systems with SSL. Eric Rescorla also provides the first in-depth introduction to Transport Layer Security (TLS), the highly anticipated, maximum-security successor to SSL. Rescorla starts by introducing SSL's fundamentals: how it works, and the threats it is intended to address. One step at a time, he addresses each key SSL concept and technique, including cryptography, SSL performance optimization, designing and coding, and how to work around SSL's limitations. Rescorla demonstrates TLS at work in SMTP-based Internet security applications. The book includes detailed examples of SSL/TLS implementations, with in-depth insight into the key design choices that informed them. For all network and security designers, enterprise developers, system implementers, and suppliers of Internet security products and services.

Eric Rescorla is a security consultant specializing in systems design and architecture. He was one of the two designers of Secure-HTTP. At Terisa Systems, he implemented Secure HTTP, SSL, TLS, and SET for Terisa's SecureWeb Toolkit product. Rescola is active in many IETF security working groups, and currently author of the TLS, HTTP over TLS and S/MIME Working Groups.

Back to Top


Appropriate Courses

Networking--Advanced Topics.

Back to Top


Table Of Contents

Preface.
1. Security Concepts.
Introduction.
The Internet Threat Model.
The Players.
The Goals of Security.
Tools of the Trade.
Putting It All Together.
A Simple Secure Messaging System.
A Simple Secure Channel.
The Export Situation.
Real Cryptographic Algorithms.
Symmetric Encryption: Stream Ciphers.
Symmetric Encryption: Block Ciphers.
Digest Algorithms.
Key Establishment.
Digital Signature.
MACs.
Key Length.
Summary.

2. Introduction to SSL.
Introduction.
Standards and Standards Bodies.
SSL Over view.
SSL/TLS Design Goals.
SSL and the TCP/IP Suite.
SSL History.
SSL for the Web.
Everything over SSL.
Getting SSL.
Summary.

3. Basic SSL.
Introduction.
SSL Over view.
Handshake.
SSL Record Protocol.
Putting the Pieces Together.
A Real Connection.
Some More Connection Details.
SSL Specification Language.
Handshake Message Structure.
Handshake Messages.
Key Derivation.
Record Protocol.
Alerts and Closure.
Summary.

4. Advanced SSL.
Introduction.
Session Resumption.
Client Authentication.
Ephemeral RSA.
Rehandshake.
Server Gated Cryptography.
DSS and DH.
Elliptic Curve Cipher Suites.
Kerberos.
FORTEZZA.
The Story So Far.
Session Resumption Details.
Client Authentication Details.
Ephemeral RSA Details.
SGC Details.
DH/DSS Details.
FORTEZZA Details.
Error Alerts.
SSLv2 Backward Compatibility.
Summary.

5. SSL Security.
Introduction.
What SSL Provides.
Protect the master_secret.
Protect the Server's Private Key.
Use Good Randomness.
Check the Certificate Chain.
Algorithm Selection.
The Story So Far.
Compromise of the master_secret.
Protecting Secrets in Memory.
Securing the Server's Private Key.
Random Number Generation.
Certificate Chain Verification.
Partial Compromise.
Known Attacks.
Timing Cryptanalysis.
Million Message Attack.
Small-Subgroup Attack.
Downgrade to Export.
Summary.

6. SSL Performance.
Introduction.
SSL Is Slow.
Performance Principles.
Cryptography Is Expensive.
Session Resumption.
Handshake Algorithm and Key Choice.
Bulk Data Transfer.
Basic SSL Performance Rules.
The Story So Far.
Handshake Time Allocation.
Normal RSA Mode.
RSA with Client Authentication.
Ephemeral RSA.
DSS/DHE.
DSS/DHE with Client Authentication.
Performance Improvements with DH.
Record Processing.
Java.
SSL Servers under Load.
Hardware Acceleration.
Inline Hardware Accelerators.
Network Latency.
The Nagle Algorithm.
Handshake Buffering.
Advanced SSL Performance Rules.
Summary.

7. Designing with SSL.
Introduction.
Know What You Want to Secure.
Client Authentication Options.
Reference Integrity.
Inappropriate Tasks.
Protocol Selection.
Reducing Handshake Overhead.
Design Strategy.
The Story So Far.
Separate Ports.
Upward Negotiation.
Downgrade Attacks.
Reference Integrity.
Username/Password Authentication.
SSL Client Authentication.
Mutual Username/Password Authentication.
Rehandshake.
Secondary Channels.
Closure.
Summary.

8. Coding with SSL.
Introduction.
SSL Implementations.
Sample Programs.
Context Initialization.
Client Connect.
Server Accept.
Simple I/O Handling.
Multiplexed I/O Using Threads.
Multiplexed I/O with select().
Closure.
Session Resumption.
What's Missing?
Summary.

9. HTTP over SSL.
Introduction.
Securing the Web.
HTTP.
HTML.
URLs.
HTTP Connection Behavior.
Proxies.
Virtual Hosts.
Protocol Selection.
Client Authentication.
Reference Integrity.
HTTPS.
HTTPS Overview.
URLs and Reference Integrity.
Connection Closure.
Proxies.
Virtual Hosts.
Client Authentication.
Referrer.
Substitution Attacks.
Upgrade.
Programming Issues.
Proxy CONNECT.
Handling Multiple Clients.
Summary.

10. SMTP over TLS.
Introduction.
Internet Mail Security.
Internet Messaging Overview.
SMTP.
RFC 822 and MIME.
E-Mail Addresses.
Mail Relaying.
Virtual Hosts.
MX Records.
Client Mail Access.
Protocol Selection.
Client Authentication.
Reference Integrity.
Connection Semantics.
STARTTLS.
STARTTLS Overview.
Connection Closure.
Requiring TLS.
Virtual Hosts.
Security Indicators.
Authenticated Relaying.
Originator Authentication.
Reference Integrity Details.
Why Not CONNECT?
What's STARTTLS Good For?
Programming Issues.
Implementing STARTTLS.
Server Startup.
Summary.

11. Contrasting Approaches.
Introduction.
The End-to-End Argument.
The End-to-End Argument and SMTP.
Other Protocols.
IPsec.
Security Associations.
ISAKMP and IKE.
AH and ESP.
Putting It All Together: IPsec.
IPsec versus SSL.
Secure HTTP.
CMS.
Message Format.
Cryptographic Options.
Putting It All Together: S-HTTP.
S-HTTP versus HTTPS.
S/MIME.
Basic S/MIME Formatting.
Signing Only.
Algorithm Choice.
Putting It All Together: S/MIME.
Implementation Barriers.
S/MIME versus SMTP/TLS.
Choosing the Appropriate Solution.
Summary.

Appendix A: Example Code.
Chapter 8.
Examples.
Java Examples.
Chapter 9.
HTTPS Examples.
mod_ssl Session Caching.

Appendix B: SSLv2.
Introduction.
SSLv2 Overview.
Missing Features.
Security Problems.
PCT.
What about SSLv1?

Bibliography.
Index. 0201615983T04062001


Back to Top

商品描述(中文翻譯)

《逐步指南：使用SSL和TLS保護Web系統和流量》是關於互聯網領先的安全協議SSL和TLS的安全性的逐步指南。本書包括對傳輸層安全性（TLS）的廣泛介紹，這是將取代SSL的強大安全協議。從基礎知識到高級主題：身份驗證、算法、Kerberos等等。作者Eric Rescorla是兩個IETF TLS工作組的負責人，是網絡安全架構方面的世界知名專家。Secure Sockets Layer（SSL）幾乎在每個商業網頁瀏覽器和服務器中都有應用。在本書中，世界頂尖的網絡安全專家之一解釋了SSL的工作原理，並提供了實施者使用SSL建立安全系統的逐步指導和成熟的設計模式。Eric Rescorla還首次深入介紹了傳輸層安全性（TLS），這是SSL的高度期待的最高安全性後繼者。Rescorla首先介紹了SSL的基本原理：它的工作原理以及它旨在解決的威脅。他逐步解釋了每個關鍵的SSL概念和技術，包括加密、SSL性能優化、設計和編碼以及如何解決SSL的限制。Rescorla演示了基於SMTP的互聯網安全應用中的TLS工作原理。本書包含了詳細的SSL/TLS實現示例，深入解析了其中的關鍵設計選擇。適用於所有網絡和安全設計師、企業開發人員、系統實施者以及互聯網安全產品和服務供應商。

Eric Rescorla是一位專注於系統設計和架構的安全顧問。他是Secure-HTTP的兩位設計師之一。在Terisa Systems，他實現了Secure HTTP、SSL、TLS和SET，用於Terisa的SecureWeb Toolkit產品。Rescorla活躍於許多IETF安全工作組，目前是TLS、HTTP over TLS和S/MIME工作組的作者。

適合的課程包括：網絡-高級主題。

目錄包括：前言、安全概念、SSL簡介、基本SSL、高級SSL等等。

類似商品