SSh public key authentication and TLS basics

 Ssh publuc key authenticaion: video

History of ssl and tsl: here

For authentication,it uses hand shake(Using asymetric keys) and after sucessful authentication for data transfer(using symetric key) it uses record protocal.

Hand shake is very important and it goes like this:

Client: “Hello there. I want to determine secure communication between the two of us. Here are my cipher suites and compatible SSL/TLS version.”

Server: “Hello, Client. I verified your cipher suites and SSL/TLS version. I feel we’re good to travel ahead. Here are my certificate file and my public key. Verify them”

Client: “Let me verify your certificate… (After Verification) Okay, it seems fine, but I want to verify your private key. I will generate and encrypt a pre-master (shared secret key) key using your public key. Decrypt it using your private key, and we’ll use the master key to encrypt and decrypt the information.”

Server: “Done.”

[Now that both parties know who they’re rebuking, the information transferred between them is secured using the master key. When the verification part is over, the encryption takes place only through the master key. This is often called symmetric encryption.]

Client: “I’m sending you this sample message to verify that our master key works. Please send me the decrypted version of this message. If it works, our data is in safe hands.”

Server: “Yeah, it works. I feel we’ve accomplished what we were trying to find.”l we’ve accomplished what we were trying to find.”

Points to remember:

• The web server needs a certicate signed by ca authority.
• The web server sends that certificate signed by ca which contains the private key of the web server  to web browser or clients.
• Browsers validate the certificate by using ca authority public keys(ca certicates contains public keys),they are built in all browsers.CA signs the certificates of web servs using their private keys and ca certificate(which in turn contains public key) and ca certificates(or root certificates) of ca are available in all browsers
• browser then sends symmetric key encrypted with web server public key and web server decrypts the msg using its private key and now web server and browser both have symetric keys.So then can comminicate using record protocal by simply encrypting msgs using symetric key

Cerficate Generation process :

1.Web server will generate a private key using, openssl genrsa -out ca.key 2048

2.Then web server will create a certificate signing request(csr) , which contains the details of organisation and public key

3.CA authotity verifies the information and if company information is legitimate then that certificate will be signed by ca private key and ca.crt(CA certificate which contains ca public key as well) file .

Note:Incase of kubernetes cluster, ca authority needs to follow same steps but step i.e  signing csr will be performed using its own private key generated in step1 and this is called self signed certificate

Generating client certificates

step1 and step2 are same,in the step 3, ca authority will sign the csr of admin or other client certificates using cs.key(private) and ca.crt(ca certificate which contains the public key).