All language subtitles for 8. HTTPS (HTTP Secure)

Pay is the application layer protocol of Web sites as you probably know.

So this is why you see Haiti T.P. slash slash flame going to be RIDO Google dot com and that will take

a page TTP version of the Web site.

Now if you look here it literally sends a text that looks like this to and from the servers.

And this is the hasty ETP protocol here.

It's saying that it's a hasty protocol it's talking about day servers and then below it you have the

hastier mail code which is what you'll see if you look at the source code of the pages.

It looks like there's so the GDP is in plain text.

Now if by close this and actually go to Google and change it to Haiti GP s I am now running Hayes's

E.P. over TLR or SSL has UDP provides the security services of Tellez because it uses tailless so data

encryption authentication usually at the server side message integrity an optional client or browser

authentication when you access a web site with hated CBS Web server will start the task to invoke SSL

and protect the communication the server sends a message back to the client indicating a secure session

should be established and the client in response sends it security parameters.

So that means it will say I'm prepared to use this digital signature unprepared to use this key exchange

algorithm.

I'm prepared to use this symmetric key and the server compares those security parameters to his own

until it finds a match.

And this is called the hand-shaking phase the server authenticate the client by sending it a digital

certificate which we will be covering next.

And if the client decides to trust the server the process continues the server can require the client

to send over a digital certificate to for mutual thanto occasion.

But that doesn't often happen.

But if you're looking for a full secure end to end session with authentication of yourself and the other

side you would use certificates either side with digital signatures those digital certificate finding

the authentication and you'll understand that a little bit more when we go to digital certificates the

client generates a symmetric sesshin key like by using a yes and encrypts it with a serve as public

key.

This encrypted key is sent to the web server and they both use the symmetric key to encrypt the data

they send back and forth.

This is how the secure channel is established tailless requires a tailless enabled server browser and

all modern browsers support TLR.

As we saw on the Wikipedia page and in all of the browsers you'll see hastier CPS which will indicate

that T.L. S is being used and you often see a padlock as well and all the browsers have some sort of

equivalent of this in order for you to know that I hated CPS or hate ETP with T.L. less is being used.

If this is not shown then the connection is not encrypted or authenticated and it will be sent in plain

text.

So just as you see here and all of the contents of the Web site just as I can see them now if HDTV is

not used we look at a padlock here.

We can see the technical details for what the encryption algorithms are.

So in this case it's using less using elliptical curve with DIFI Helmar.

The auction of rsa the symmetric key is a yes with 128 bits with a GCM mode of operation and Shaugh

to 5 6 for data integrity.

This had been negotiated between the client and the server.

And if we look in why I don't watch soccer as a protocol analyzer so you can see the traffic as it goes

in and out.

I can see here the conversation that happened where my client or my browser is said these are things

that I support and the server has responded.

And say well this is what I would actually like to use.

And then they provided the certificate with the digital signature and the public key on it.

And on the Web site you can go to is SSL labs and if you enter in the web site or you are now of a site

that is ruining Haiti CPS you can see more encryption options are off by that site.

So here we can see that bank of america signature algorithm is Shaar to 5:6 with our say for the digital

signature.

We can see the chain of trust here.

Bank of America's certificate a chain of trust comes down here and then we have the root certificate

here.

And the protocols.

The server is prepared to use current interest in site and it gives you a rating for how good it thinks

the site is.

A final point on Haiti and a privacy problem.

Something called the server name indication as an I is an extension to teach a class by which a client

indicates which hostname is attempting to connect to at the start of the handshake process and you can

see that represented here within Wireshark.

We can see the server name.

Do we do we w Daut outlook dot com.

This allows a server to present multiple certificates on the same IP address and TCAP port number and

hence allow multiple secure hasty T-P s web sites or any other service over Tellez to be secured by

the same IP address without requiring all those sites to use the same certificate the desired hostname

as you can see here is not encrypted.

So an eavesdropper can see which site is being requested as an I is used to implement censorship and

block sites as Sanai means if you're using Hastey CPS eavesdroppers can see what site you are going

to.

But then after that the communication is scrambled or encrypted.