Web Security with SSL/TLS

Module 1 Introduction
Web Security and Electronic Commerce
History of ssl and tls
Approaches to Network Security
Separate Security Protocol
Application-Specific Security
Security within Core Protocols
Parallel Security Protocol
Protocol Limitations
Fundamental Protocol Limitations
Tool Limitation
Environmental Limitations

Module 2 Basic Cryptography

Using Cryptography
Keeping Secrets
Proving Identity
Verifying Information
Types of Cryptography
Secret Key Cryptography
Public Key Cryptography
Combining Secret & Public Key Cryptography
Key Management
Public Key Certificates
Certificate Authorities
Certificate Hierarchies
Certificate Revocation Lists

Chapter 3 SSL Operation

SSL Roles
SSL Messages
Establishing Encrypted Communications
ClientHello
ServerHello
ServerKeyExchange
ServerHelloDone
ClientKeyExchange
ChangeCipherSpec
Finished
Ending Secure Communications
Authenticating the Server’s Identity
Certificate
ClientKeyExchange
Separating Encryption from Authentication
Certificate
ServerKeyExchange
ClientKeyExchange
Authenticating the Client’s Identity
CertificateRequest
 Certificate
CertificateVerify
Resuming a Previous Session

Chapter 4: Advanced SSL

Compatibility with Previous Versions
Negotiating ssl Versions
SSL Version 2.0 ClientHello
SSL Version 2.0 Cipher Suites
Netscape International Step-Up
Server Components
Client Components
Controlling Full-Strength Encryption
Microsoft Server Gated Cryptography
Server Gated Cryptography Certificates
Cipher Suite Renegotiation
The Transport Layer Security Protocol
TLS Protocol Version
Alert Protocol Message Types
Message Authentication
Key Material Generation
CertificateVerify
Baseline Cipher Suites
Interoperability with SSL
The Future of ssl and tls

Chapter 5 SSL Security Checklist

Authentication Issues
Certificate Authority
Certificate Signature
Certificate Validity Times
Certificate Revocation Status
Certificate Subject
Diffie-Hellman Trapdoors
Algorithm Rollback
Dropped ChangeCipherSpec Messages
Encryption Issues
Encryption Key Size
Traffic Analysis
The Bleichenbacher Attack
General Issues
RSA Key Size Version Rollback Attacks
Premature Closure
SessionID Values
Random Number Generation
Random Number Seeding