First oversimplified and rough overview then dive into the abyss.
Intro
The bulk of the Internet is based on the HTTP (HyperText Transfer Protocol) protocol. Data transferred through HTTP flows in ‘plain’ text meaning that anyone who can intercept it – can read it. Usernames and passwords included. To address this security issue the SSL protocol (Secure Sockets Layer) was created (thank you Netscape). SSL provided the means to ensure certain level of privacy by encrypting the data (in motion) between a client (you) and a server (some resource), along with authentication and data integrity.
SSL did its job until design issues (security flaws) were discovered. Those could not be “worked around” hence a new protocol was needed – TLS (Transport Layer Security). That’s the reason why one can often find the SSL/TLS abbreviation instead of only TLS. When SSL/TLS is used over HTTP it is notated as HTTPS (s = secure).
The TLS protocol allows for data encryption between communicating devices (a.k.a machines, endpoints, devices, computers, servers, phones, Internet enabled babies, dogs, cats & etc) over the Internet (and any other network). Encryption is the act of scrambling data in a way that makes it readable only by the intended parties. Unencrypted data can read ‘Hello world!’ while encrypted could be ‘NcvLb.cefJVR’. To see ‘Hello world!’ the receiving party must decrypt the data and to do that it must know some secret, the key used to scramble the data.
Hail Cryptography !
Cryptography is an interdisciplinary science that focuses on data encryption and decryption, authentication, confidentiality, integrity and non-repudiation. For now let’s focus on the encryption part. TLS encrypts the data (traffic) that flows between networking devices . It does so by taking advantage of a mathematical problem related to integer factorization. Integer factorization decomposes a given (positive) integer into its composites. 6 can be decomposed to 3 and 2, 14 can be decomposed to 7 and 2 & etc. Those numbers that cannot be decomposed to smaller ones are called primer numbers (sans 1). For instance 2, 3, 5, 7, 11 and 13 are primes, so is 21577 and (as far as we speculate) infinitely many others. The problem with integer factorization is the lack of an algorithm that can quickly decompose any big (very big) integer to its prime factors. There’s none, at least for now. Doing the reverse, getting an arbitrary large integer knowing its primes is fast. Thanks to this, Ron Rivest, Adi Shamir and Leonard Adleman we have RSA. RSA is one of the oldest, most widely used and adopted public key encryption algorithms. Wait. What does public key means?
There are two distinctive types of encryption – symmetrical and asymmetrical. When using symmetrical the same key used to encrypt the data can be used to decrypt it. When using asymmetrical, one key is used for encryption and another for decryption. The symmetrical encryption is fast while the asymmetrical is not. Both kinds are used because each addresses a specific issue.
How to secretly share a secret?
Imagine I want to share some text with you over the Internet. I don’t want this text to be read by anyone else so I encrypt it. To encrypt it I need to use some secret, some key. To decrypt it you need to use the same key (a.k.a session key). How can I securely share this key without passing it in person (physically)? By using RSA. TLS and RSA provide the means to exchange a secret (session) key without anyone else being able to read it. How does this work? Client and Server agree on certain parameters which are then used to compute and exchange the secret (session) key. Things are not that simple of course but that’s enough for a start.
Public key cryptography (in this case RSA), which is asymmetrical encryption, serves as the means to securely exchange the secret between the communicating parties. Wait! There’s something missing here. When I try to securely exchange a secret with you how do I know you is you? How do I trust that the receiving end is John and not Bob?
It’s a matter of trust
Being able to exchange a secret, in a secure manner, is one thing, knowing you are exchanging it with the intended party is another topic entirely. How one trusts another? In the real world it is relatively easy. You know John, so when you see John you know-know this is John, but when you are connecting, over the Internet, to some endpoint, device, machine, cat, dog or baby, how do you know they are the right ones? How do you know there is no impersonation? You don’t unless you have some means to establish trust. How is trust established when it comes to TLS?
PKI and the chain of trust
PKI stands for Public Key Infrastructure and it includes everything (literally) that provides the means to manage public-key encryption. Trust included. When using RSA one needs to generate two keys, a private key, kept private at all times and a public key, made available to anyone. Then if you are the server (the endpoint to which one connects using TLS) you need to create a CSR, Certificate Signing Request. The CSR includes information for your domain and organization (and other data) along with the public key. Then this CSR needs to be ‘signed’ by a trusted third party. That third party is called a Certificate Authority. Certificate Authorities (CAs) sign CSRs and provide certificates (CERs/CRTs) that (in a sense) validate that the person (or business) using them is the one that it claims to be. When communication is established over TLS, the server shares not only his certificate (public key) but also the certificate of the CA that signed the CSR and issued the certificate. Having a set of related certificates is called a chain. Great, but how one knows to trust a given CA?
Public trust and trust stores
General purpose OSes (Operating Systems) usually come with a store of publicly trusted CA certificates. Same applies for every browser and, sometimes, each piece of software can have a trust store of its own. The certificates (public-keys) in those stores are trusted by default. Explicit trust. If a given certificate was issued (signed) by a CA certificate present in the store, then it is trusted by default. Yei.
It’s all relative
Wait! What happens if a given CA certificate is compromised? Then I’ll be trusting something that I should not! Yup. You will. One of the reasons why things are way more complicated than they seam. Other posts will cover that.