Hey everyone and welcome back.
Okay so we have a lot of cool things to get to within this Fairy Scale.
The very first thing that we're going to be talking about is how we can introduce encryption
into our web server.
So let's actually talk about some of the concepts that we have to understand with respect to
our encryption and then we'll walk through some configurations.
Now the first thing I will say is that the type of encryption we're going to be looking
at is something called SSL.
This is the secure sockets layer and this is the type of encryption that you're going
to find in your web browser when you happen to speak to your website in an encrypted
format that will either be SSL or the newer version TLS which is transport layer security.
Ultimately we're basically talking about the same thing.
We're talking about having an encrypted connection over the web.
So a few points to note here is that when we are talking in an unencrypted fashion we're
going to be using HTTP.
This is the Hypertext Transfer Protocol and this is going to operate typically using the
default port of port 80.
Now when you want to establish an encrypted connection with a web server you're going
to be using the protocol HTTPS which stands for the secure version of HTTP and when you
make this request the default port you're going to be using is port 443.
So again if you happen to be hosting a web server and you are using these particular
protocols you maybe have to pay attention to your firewall rules to perhaps allow traffic
using these particular port numbers.
Okay so here is the deal we have a few things that we have to discuss to understand how this
exactly is going to be implemented.
So we have a way to verify the authenticity of a server and this is via the use of what
is called a certificate.
Now in order for us to be able to implement this type of solution what we're going to
have to do is to use something called a certificate.
Now this certificate is going to allow us to provide our HTTPS service.
This is going to be part of the encryption process here.
Now one distinction we have to understand with respect to our certificates is that we
can have either what is called a self signed certificate or we can have a certificate that
has been signed by a CAA certificate authority.
Now when you happen to have your certificate signed by a certificate authority it gives
you strong verification that the server you think you're talking to is who they say they
are so this is good for validation here okay.
Now you can still provide HTTP services using a self signed certificate but understand
that inherently this is less secure purely because that these could be spoofed and you
may be talking to someone who is not who they say they are and this could be a potential
attack vector for someone like city hacker who is performing a man in the middle attack.
So let me just briefly explain the process of how this is going to happen between a website
and a user and how the encryption transaction actually happens.
Okay so over here we can have our user computer this could be you on your PC or your Mac whatever
it may be and you want to talk to a web server let's just maybe say this is youtube.com okay
let's say YT.
When I happen to type youtube.com into my browser here my browser is immediately going to go
and make a request to this server we already know the process of using DNS to look up the
domain name to the IP address once we do this we can establish this connection.
So we make this initial request specifying that we want to have an encrypted connection
over HTTPS.
Now what is going to happen at this point the server is going to receive this request
see that we want to use HTTPS and it's going to respond in this manner what it's going
to do the server is going to send to you something called its public key in conjunction with
its certificates.
Now this certificate in the event of someone like say youtube.com this is going to be signed
by a certificate authority verifying its authenticity.
So now this browser here has this certificate that has been digitally signed by the certificate
authority as well as the server's public key.
Now not to go into too much of the specifics but your browser is actually able to verify
this certificate authority because your browser has been built to include all of the major
certificate authorities public keys and this actually allows you to verify that the certificate
that you have just been sent has indeed been signed by those certificate authorities and
that gives you confidence that the certificate that was sent by youtube has indeed been verified.
So really now let me just clear my screen the user here like I say has this public key
and the certificate here verifies that we know we're talking to the server who says
they are youtube.com.
Now before we proceed any further I think it's worth making a note on public key and
private key cryptography here.
When we're talking about using a public as well as a private key the type of cryptography
we're talking about is called asymmetric.
So we're going to be using asymmetric cryptography here.
Now let me just talk about what these two keys actually do because this can be a little
bit confusing at first but once you get the concept it does stick in your head.
With respect to a public key and a private key these keys are ultimately linked together
okay.
So what we can do is we can encrypt data with our public key so that if you have a little
text file and you run it through the public key it's now going to be this encrypted garbage
so to speak unreadable nonsense until it is decrypted but the cool thing is is that
when you encrypt something with a public key you can no longer decrypt it back with the
public key.
So imagine it like this imagine you had a house key that you could lock your door with
so you leave the house and you lock the door with your key.
Now imagine that that key could no longer open the door you had to have a completely separate
key that could unlock it.
This key can lock something but it can unlock it.
In order to be able to unlock that door we would have to pull out a separate key entirely
this would be a private key.
Now this might seem a little bit weird why on earth would we want to be able to have
such functionality whereby we can encrypt something with a particular key but we can't
decrypt it back with that same key.
Well imagine this imagine you have two people here so this can be John and this can be Trevor
and John and Trevor want to communicate in an encrypted fashion.
So John wants to send Trevor a message so imagine John wrote up a little text file with a little
private message and then John encrypted it with a particular key.
So John sends this message over which is fully encrypted but Trevor here has a problem he
has successfully received the encrypted message but Trevor now needs to know the encryption
key that is going to be used to decrypt that message.
So John has this issue how do I actually securely send Trevor the encryption key.
So this can be the message this can be the key because think about it imagine someone
was actually spying on this transaction.
So when John sends Trevor the message that is encrypted the person spying on this conversation
sees this encrypted message.
Now right now they can't actually read this message because this message is encrypted but
as John actually sends Trevor the key the attacker now has the encrypted message as well
as the encrypted key therefore they can use this key to decrypt the message and read what
John sent to Trevor.
So this is the problem here we want to be able to find a way that we can securely share
information that isn't going to compromise this transaction.
Now this is exactly what asymmetric key encryption is going to do for us.
So let's reimagine the transaction once again we've got John on the left here and we have
Trevor on the right.
Now imagine the same process in action John wants to send Trevor a secret message how
on earth are we going to solve this now Trevor here is a smart cookie he has an idea he suggests
we use asymmetric cryptography.
So what Trevor does is he generates a private key and a public key.
Now his public key is exactly what it sounds like it is public it can be shared with absolutely
anyone it doesn't matter who sees it the only thing that matters is that Trevor keeps his
private key private to himself so Trevor could send me an unencrypted email or publish on
his website his actual public key okay.
So I could just read what this public key is and then use it to encrypt my own message
so this message once again is I'm going to take it and encrypt it with Trevor's public
key now like I say once I lock the door I encrypt this message with this public key
I can no longer decrypt that message myself I can't decrypt it back using the public
key so think about this now our adversary is watching the transaction once again now
I send this message to Trevor that is now being encrypted with Trevor's public key and
think about this what can the adversary actually do the adversary can actually see the message
they can see the public key but the public key can't be used to decrypt this message
it can only be used to encrypt messages to Trevor now when the actual message gets to
Trevor encrypted with this public key Trevor can now decrypt it because he has the private
key which is associated with this public key so that the only person who can decrypt the
message is Trevor so everyone who sees Trevor's public key can send encrypted messages to him
but he is the only one who can ever decrypt that message so that is the concept of asymmetric
encryption however we also have the concept of symmetric encryption now symmetric encryption
really is like your house key the key that can lock your door can also unlock your door
now the advantage here of symmetric encryption is that it is way way way faster than asymmetric
encryption now the reality is with respect to our SSL here we're actually going to be using a
combination of both so let's revisit what we talked about there now that we understand a little bit
more about the process that's going to happen so remember we have our user here we have our
YouTube server we have just sent a request for HTTPS and the server has sent back its public key
as well as its certificate which has been signed by a certificate authority and our browser is able
to verify this now that we have the public key for YouTube what our browser is going to do now is
something really quite smart the browser is going to generate a session key this is going to be an
encryption key just use for this session between the client and the server now this session key
is actually going to leverage symmetric encryption now here is the cool part what the browser is
going to do after it generates this key it's going to actually encrypt this key using the public key
that the server just sent to us so that means we can actually send this session key over to the
server and anyone who is watching this transaction can't actually read it because the session key
has been encrypted using the public key of the server meaning that no one can decrypt this
apart from the server who has the private key so now the server gets this encrypted message it
decrypts it and now the server also knows the session key so now we successfully have symmetric
encryption in place the user happens to know the session key and the server happens to know the
session key and nobody else who is watching the transaction is going to be able to know that
information and from now on we can have this two-way communication using symmetric encryption so I
know this is a lot to deal with we have certificates and certificate authorities and we have public
keys and private keys and symmetric encryption and asymmetric encryption all of this can take a
little bit of time just to sink in and fully clarify within your head but understanding these core
concepts is going to be absolutely crucial to being able to understand what exactly is going on
when we configure our server to use SSL so now that we have some of these core concepts under
our belts how about we begin creating these certificates and configuring your server to use
these certificates and well that's what we're going to be doing in the very next nuggets I hope
this has been informative for you and I'd like to thank you for viewing