While current internet standards implement TLS 1.3 (Transport Layer Security), we’ve made significant strides in securing communication over the internet. The journey began with the development of SSL (Secure Sockets Layer) 1.0, which was never publicly released due to serious flaws. This was followed by SSL 2.0, which introduced a handshake protocol before establishing a connection between the client and server. Every protocol has its own vulnerabilities, and to this day, no single protocol provides a completely secure solution. However, in cybersecurity, we continuously strive to develop ‘better’ solutions, recognising that while these may not be perfect, they are the best options available at present.
The SSL 2.0 handshake protocol aims to send ‘ClientHello’ from the client and ‘ServerHello’ from the server over an insecure channel, typically over a Transmission Control Protocol (TCP) connection. The purpose of these messages is to establish the parameters for the secure session that will follow, including negotiating the encryption methods and exchanging the necessary cryptographic data. This includes a ‘cipher suite’ which is a list of encryption algorithms such as RC4-MD5, DES-CBC-MD5, and RC2CBC-MD5 sent to the server to choose the most secure algorithm that both machines support, as shown in Figure 1.
The server responds with a ‘ServerHello’ message including the selected cipher suite, another random value (nonce), and the server’s certificate containing its public key. After these initial messages are exchanged, the process of key exchange and session establishment begins, and eventually, the communication is encrypted using the session key derived from the handshake process. This encryption secures subsequent data exchanges.
Key exchange methods
This story is from the October 2024 edition of Open Source For You.
Start your 7-day Magzter GOLD free trial to access thousands of curated premium stories, and 9,000+ magazines and newspapers.
Already a subscriber ? Sign In
This story is from the October 2024 edition of Open Source For You.
Start your 7-day Magzter GOLD free trial to access thousands of curated premium stories, and 9,000+ magazines and newspapers.
Already a subscriber? Sign In
Helgrind: Detecting Synchronisation Issues in Multithreaded Programs
Let's explore how Helgrind can be used to detect and debug multithreading issues with the help of a multithreaded C program.
The Perfect Process of Booting a PC
Booting a PC seems as simple as eating a cake. But are you aware of all that goes on behind-the-scenes to bake a delicious cake or seamlessly boot a PC?
Exploring eBPF and its Integration with Kubernetes
eBPF, a game-changing technology that extends the capabilities of the Linux kernel, offers significant advantages for Kubernetes networking. It also greatly improves Kubernetes observability by capturing detailed telemetry data directly from the kernel. Read on to find out how its integration with Kubernetes has immense benefits.
Deploying Generative AI LLMs on Docker
Built on massive datasets, large language models or LLMS are closely associated with generative Al. Integrating these models with Docker has quite a few advantages.
Containerisation: The Cornerstone of Multi-Cloud and Hybrid Cloud Success
Open source containerisation software provides the flexibility, cost-effectiveness, and community support needed to build and manage complex multi-cloud and hybrid cloud environments. By leveraging this software, businesses can unlock the full potential of multicloud and hybrid cloud architectures while minimising vendor lock-in risks.
From Virtual Machines to Docker Containers: The Evolution of Software Development
Containerisation and Kubernetes have eased software development, making it faster and better. Let's see where these are headed, looking at trends that are making life easier for developers.
India's Leap in Supercomputing: Innovating for Tomorrow
As India strides towards self-sufficiency in supercomputing, embracing this evolution isn't just an option-it is pivotal for global competitiveness and technological leadership.
SageMath: A Quick Introduction to Cybersecurity
In the previous articles in this SageMath series, we delved into graph theory and explored its applications using SageMath. In this seventh article in the series, it is time to shift our focus to another crucial subfield of computer science: cybersecurity and cryptography.
Efficient Prompt Engineering: Getting the Right Answers
OpenAl's GPT-3 and GPT-4 are powerful tools that can generate human-like text, answer questions, and provide insights. However, the quality of these outputs depends heavily on how you frame the input, or prompt. Efficient prompt engineering ensures you get the right answers by designing inputs that guide the AI towards relevant, clear, and useful responses. Let's find out how to craft effective prompts with examples.
Analysing Linus Torvald's Critique of Docker
This article looks at Docker's security flaws, particularly its shared-kernel model, and contrasts it with traditional VMs for better isolation. It discusses Linus Torvalds' concerns, explores mitigation techniques, and proposes a roadmap for building a more secure containerisation platform using hardware-assisted virtualisation, true isolation, and a robust orchestration layer.
