How HTTP/HTTPS Works?

How HTTP(S) Works? Shao-Chung Chen /* CC BY-SA 4.0 */
Trend Micro / September 17, 2015

• HTTP(S) Overview • HTTP Tool Clients • Troubleshooting HTTP
Traﬀics Outline

Hypertext Transfer Protocol (Secure) or “Over TLS” / or “Over
SSL”

Let’s visit http://www.trendmicro.com.tw/ GET / HTTP/1.1 Host: www.trendmicro.tw Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml; q=0.9,image/webp,*/*;q=0.8 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36 Accept-Encoding: gzip, deflate, sdch Accept-Language: en-US,en;q=0.8 HTTP Request Header GET POST PUT DELETE …

http://www.trendmicro.com.tw/ replies… HTTP/1.1 302 Moved Temporarily Server: nginx Content-Type: text/html
Content-Length: 154 Location: http://www.trendmicro.tw/tw/index.html Date: Mon, 14 Sep 2015 14:09:55 GMT Connection: keep-alive HTTP Response Header 2xx = Success 3xx = Redirection 4xx = Client Error 5xx = Server Error

Redirecting to http://www.trendmicro.com.tw/tw/index.html GET /tw/index.html HTTP/1.1 Host: www.trendmicro.tw Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml; q=0.9,image/webp,*/*;q=0.8 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36 Accept-Encoding: gzip, deflate, sdch Accept-Language: en-US,en;q=0.8 HTTP Request Header

Finally, http://www.trendmicro.com.tw/tw/index.html replies… HTTP/1.1 200 OK Server: nginx Content-Type: text/html;
charset=UTF-8 Content-Encoding: gzip Content-Length: 12772 Date: Mon, 14 Sep 2015 14:09:55 GMT Connection: keep-alive <!DOCTYPE html> <html lang="zh-TW"> <head> <meta name="GENERATOR" content="IMPERIA 9.0.0.25" /> <meta charset="utf-8"> <title>Ӣ୺๷ಟᢛ໢࿏҆શతશٿྖಋऀ| ๷ಟ๷᱆ɺ๷ࢿྉ֎ ӮɺݸਓࢿྉอޢɼӢ୺ӡࢉ๷ಟጯ༻ሢՈ: ਼੎ՊٕTrend Micro ୆ᖯ - Trend Micro Taiwan - Trend Micro Taiwan</title> HTTP Response Header HTTP Response Body

{ Request Header } • Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ== • Cookie:
Hello=1 • Content-Length: 123 • Content-Type: application/x-www-form-urlencoded • Referer: http://en.wikipedia.org/wiki/Main_Page Yes, I know, it is. Base64 Encoding { Response Header } • Content-Disposition: attachment; filename=“fname.ext" • Content-Type: text/html; charset=utf-8 • Set-Cookie: UserID=JohnDoe; Max-Age=3600; Version=1

{ 2xx Success } • 200: OK { 3xx Redirection
} • 301: Moved Permanently • 302: Found • 307: Temporary Redirect • 308: Permanent Redirect { 4xx Client Error } • 400: Bad Request • 401: Unauthorized • 402: Payment Required • 403: Forbidden • 404: Not Found • 418: I’m a teapot (RFC 2324) { 5xx Server Error } • 500: Internal Error • 501: Not Implemented • 502: Bad Gateway • 503: Service Unavailable

Representational State Transfer -ful RESTful ⡲罏㢩⳿《勞劤갤㖈涯匢♳闌9%

{ HTTP URL } http://example.com/:@-._~!$&'()*+,=;:@-._~!$&'()*+,=:@-._~! $&'()*+,==?/?:@-._~!$%27()*+,;=/?:@-._~!$%27()*+,;==#/?:@-._~! $&'()*+,;= Valid HTTP URL
(fulfills the standard) http://blog.lunatech.com/2009/02/03/ what-every-web-developer-must-know-about-url-encoding https://alice:[email protected]:8080/file;p=1?q=2#third Scheme User Passowrd Host Port Path Path Params Query Params Fragment Uniform Resource Locator

{ How Browser Works — WebKit } http://www.html5rocks.com/en/tutorials/internals/howbrowserswork/

{ Brief SSL & TLS History } Transport Layer Security
Secure Sockets Layer

{ Brief SSL & TLS History } • 1994, Netscape
designed SSL 1.0 which is Never published Transport Layer Security Secure Sockets Layer

designed SSL 1.0 which is Never published • 1995, SSL 2.0 and many security flaws founded. Transport Layer Security Secure Sockets Layer

designed SSL 1.0 which is Never published • 1995, SSL 2.0 and many security flaws founded. • 1996, SSL 3.0 (RFC 6101) and getting popular Transport Layer Security Secure Sockets Layer

designed SSL 1.0 which is Never published • 1995, SSL 2.0 and many security flaws founded. • 1996, SSL 3.0 (RFC 6101) and getting popular • 1999, TLS 1.0 (RFC 2246) as an upgrade of SSL 3.0 (aka SSL 3.1) Transport Layer Security Secure Sockets Layer

designed SSL 1.0 which is Never published • 1995, SSL 2.0 and many security flaws founded. • 1996, SSL 3.0 (RFC 6101) and getting popular • 1999, TLS 1.0 (RFC 2246) as an upgrade of SSL 3.0 (aka SSL 3.1) • 2006, TLS 1.1 (RFC 4346) aka SSL 3.2 Transport Layer Security Secure Sockets Layer

designed SSL 1.0 which is Never published • 1995, SSL 2.0 and many security flaws founded. • 1996, SSL 3.0 (RFC 6101) and getting popular • 1999, TLS 1.0 (RFC 2246) as an upgrade of SSL 3.0 (aka SSL 3.1) • 2006, TLS 1.1 (RFC 4346) aka SSL 3.2 • 2008, TLS 1.2 (RFC 5246) aka SSL 3.3 Transport Layer Security Secure Sockets Layer

designed SSL 1.0 which is Never published • 1995, SSL 2.0 and many security flaws founded. • 1996, SSL 3.0 (RFC 6101) and getting popular • 1999, TLS 1.0 (RFC 2246) as an upgrade of SSL 3.0 (aka SSL 3.1) • 2006, TLS 1.1 (RFC 4346) aka SSL 3.2 • 2008, TLS 1.2 (RFC 5246) aka SSL 3.3 • 2014, SSL 3.0 found vulnerable to POODLE attacks Transport Layer Security Secure Sockets Layer Padding Oracle On Downgraded Legacy Encryption

designed SSL 1.0 which is Never published • 1995, SSL 2.0 and many security flaws founded. • 1996, SSL 3.0 (RFC 6101) and getting popular • 1999, TLS 1.0 (RFC 2246) as an upgrade of SSL 3.0 (aka SSL 3.1) • 2006, TLS 1.1 (RFC 4346) aka SSL 3.2 • 2008, TLS 1.2 (RFC 5246) aka SSL 3.3 • 2014, SSL 3.0 found vulnerable to POODLE attacks • 2015, TLS 1.3 (draft) Transport Layer Security Secure Sockets Layer Padding Oracle On Downgraded Legacy Encryption

Cat 5 Cable / WiFi IPv4 / IPv6 TCP (Transport
Layer) HTTP http://blogs.msdn.com/b/kaushal/archive/2013/08/03/ssl-handshake-and-https-bindings-on-iis.aspx { SSL Layered Model }

Cat 5 Cable / WiFi IPv4 / IPv6 TCP (Transport
Layer) HTTP SSL Record Layer Fragmentation, Compression, Authentication, Encryption SSL Handshake SSL Change Cipher Spec SSL Alert http://blogs.msdn.com/b/kaushal/archive/2013/08/03/ssl-handshake-and-https-bindings-on-iis.aspx { SSL Layered Model }

Client Server

Client Server SYN SYN/ACK ACK TCP Established TCP Three-way Handshake

Client Hello (SSL Version, Session ID, List of Cipher Suites) (SSL Version, Session ID, Selected Cipher, Server Cert) Server Hello Server Certificate Authenticate Server

Client Hello (SSL Version, Session ID, List of Cipher Suites) (SSL Version, Session ID, Selected Cipher, Server Cert) Server Hello Server Certificate Authenticate Server Server Key Exchange & Server Hello Done Client Key Exchange & Change Cipher Spec & Client Finished New Session Ticket & Change Cipher Spec & Server Finished Create Session Key (Shared Secret)

Client Hello (SSL Version, Session ID, List of Cipher Suites) (SSL Version, Session ID, Selected Cipher, Server Cert) Server Hello Server Certificate Authenticate Server Server Key Exchange & Server Hello Done Client Key Exchange & Change Cipher Spec & Client Finished New Session Ticket & Change Cipher Spec & Server Finished Create Session Key (Shared Secret) Encrypted Messages HTTP Requests & Responses

Client Server

{ Cipher Suites } TLS_RSA_WITH_AES_256_CBC_SHA Key Exchange Certificate Signing (Authentication)
Cipher (Encryption) MAC (Integrity) TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, …

{ X.509 Public Key Infrastructure }

$ openssl x509 -in thawte-ca-certificate.pem -noout -text Certificate: Data: Version:
3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: md5WithRSAEncryption Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Server CA/[email protected] Validity Not Before: Aug 1 00:00:00 1996 GMT Not After : Dec 31 23:59:59 2020 GMT Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Server CA/[email protected] Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:d3:a4:50:6e:c8:ﬀ:56:6b:e6:cf:5d:b6:ea:0c:68:75:47:a2:aa:c2:da:84:25:fc:a8:f4:47:51:da:85:b5:20:74:94:86:1e:0f:75:c9:e9:08:61:f5:06: 6d:30:6e:15:19:02:e9:52:c0:62:db:4d:99:9e:e2:6a:0c:44:38:cd:fe:be:e3:64:09:70:c5:fe:b1:6b:29:b6:2f:49:c8:3b:d4:27:04:25:10:97:2f:e7:90: 6d:c0:28:42:99:d7:4c:43:de:c3:f5:21:6d:54:9f:5d:c3:58:e1:c0:e4:d9:5b:b0:b8:dc:b4:7b:df:36:3a:c2:b5:66:22:12:d6:87:0d Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: critical CA:TRUE Signature Algorithm: md5WithRSAEncryption 07:fa:4c:69:5c:fb:95:cc:46:ee:85:83:4d:21:30:8e:ca:d9:a8:6f:49:1a:e6:da:51:e3:60:70:6c:84:61:11:a1:1a:c8:48: 3e:59:43:7d:4f:95:3d:a1:8b:b7:0b:62:98:7a:75:8a:dd:88:4e:4e:9e:40:db:a8:cc:32:74:b9:6f:0d:c6:e3:b3:44:0b:d9: 8a:6f:9a:29:9b:99:18:28:3b:d1:e3:40:28:9a:5a:3c:d5:b5:e7:20:1b:8b:ca:a4:ab:8d:e9:51:d9:e2:4c:2c:59:a9:da:b9: b2:75:1b:f6:42:f2:ef:c7:f2:18:f9:89:bc:a3:ﬀ:8a:23:2e:70:47

{ Sunsetting SHA-1 Signatures } “The SHA-1 cryptographic hash algorithm
has been known to be considerably weaker than it was designed to besince at least 2005 — 9 years ago. Collision attacks against SHA-1 are too affordable for us to consider it safe for the public web PKI. We can only expect that attacks will get cheaper.” • Google Security Blog – Gradually sunsetting SHA-1 (Sept 5, 2014) http://googleonlinesecurity.blogspot.tw/2014/09/gradually-sunsetting-sha-1.html • Filippo Valsorda – The Unofficial Chrome SHA-1 Deprecation FAQ https://blog.filippo.io/the-unofficial-chrome-sha1-faq/

{ Diﬀie-Hellman Key Exchange } https://commons.wikimedia.org/wiki/File:Diﬀie-Hellman-Schl%C3%BCsselaustausch.svg

{ /etc/ssh/modulei } # Time Type Tests Tries Size Generator
Modulus 20120821044040 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE033 7E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F 8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A770E2EC9F … 20120705194100 2 6 100 8191 2 DA2167F01CB32874E032B38C40FEC5F2557C9C4411B3A4B3D38C889A8BEED4EB7EF08A9A1E1EAAEEC22C2A46891D3CA 84517FDFCDFA2BACBCDE2FC8EA87182542F5C8D3897B6C8A6DB951256F3DDBA7C5D6E7060925AD1F3046F49D00B4337 70B412DAA2A74E539EB81E3266DDDA82781BB21B19695FB925FA8BB6D249B5C33401C5D9E5C6B1719A36F1EB36E7CCD 28AD98AA74DFD453D343BD189C968EB8F459809E87F77C6BA985B82B960A46660C7A277970E016EBD183CE7D6232F56 EB06ECC0931024B9333879EF063F976C3603649AB9DCBE9714753E0A865020C3EF22BABF2F473F771CFC70A7C43FE32 0640D6E2816E88B6CA501A85A34F88EFF26AD8FFA0D11B0A21CB1A4FC7F90DB97B11BD5367302CBB45A390D2CB28CE8 3D50156A161D0080FD5F3961872ABC56FBCB973C517F6D7205E6CCF44E22E5DF8793D5037A9E779A52628D258CEA6B4 5CA4AC604CD69875D51145EE4C3D8856E24F9DBCA0134D54A734320A46A0AF52E20DD604AD465508172D4185C0D5C72 0B325ABC1760B1680B7BDFBAA1AE845A84AC3C7BBC53CD01C000B2186DC3915A1879224DD703E817C58F5FFCFBDF018 9BB4B5033769F49852F3C48A88B88FB659B4AC96EE9DFC1D7E1760194EE4E1B6A8052BA17C827BE8A74C9F3FA7EA323 6171F3DF9ACF19C40636825F1C49EFAAB12CEAD24F4585FE7C466FDE7ACF7E1FC91C8D473A8AB12C652AF568227E7CE 3421256F83084D8E82DC977309E5B8C73EB8D92B71B9DAF6A53D13539D55C1A67BAC646358352529958AA3599DF0D88 2B8640ABFF17031C3F246A3E07F86AEB29CEACACF3B3EB931C40D292D09F4B99E08E4C68D811F9425DA30AC45610745

HTTP Tool Clients

http://curl.haxx.se/ -v https://example.org/

#!/usr/bin/env python import json import requests if __name__ == "__main__":
payload = { 'hello': 'world', 'foo': 'bar' } r = requests.post("http://example.org", data=payload) if r.status_code == requests.codes.ok: result = json.loads(r.text) http://www.python-requests.org/en/latest/

Troubleshooting HTTP Traﬀics

Fin. Thanks

How HTTP/HTTPS Works?

How HTTP/HTTPS Works?

More Decks by Dan Chen

Other Decks in Technology

Featured

Transcript