WEBVTT

1
00:00.000 --> 00:01.850 align:middle line:84%


2
00:01.850 --> 00:03.380 align:middle line:90%
As we look for
ways of protecting

3
00:03.380 --> 00:06.860 align:middle line:90%
our data and our traffic, one
method is use secure protocols.

4
00:06.860 --> 00:10.520 align:middle line:90%
And one of those is the
family of SSL, Secure Sockets

5
00:10.520 --> 00:13.160 align:middle line:90%
Layer/TLS, Transport
Layer Security.

6
00:13.160 --> 00:16.568 align:middle line:90%
I'd like to chat with you in
this video about exactly that.

7
00:16.568 --> 00:18.110 align:middle line:90%
And to bring this
home, let's imagine

8
00:18.110 --> 00:19.850 align:middle line:90%
that you and I are
at this computer

9
00:19.850 --> 00:22.970 align:middle line:90%
and we're going up to our
favorite banking website

10
00:22.970 --> 00:25.980 align:middle line:90%
or we're going to a shopping
website, what have you.

11
00:25.980 --> 00:28.440 align:middle line:90%
And as we see in our traffic,
we don't want this traffic--

12
00:28.440 --> 00:30.440 align:middle line:90%
as it goes over the
internet which is definitely
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:28.440 --> 00:30.440 align:middle line:90%
as it goes over the
internet which is definitely

13
00:30.440 --> 00:31.746 align:middle line:84%
an untrusted network--

14
00:31.746 --> 00:33.996 align:middle line:90%
we don't want that traffic
if someone eavesdrops on it

15
00:33.996 --> 00:36.770 align:middle line:90%
to be able to see what's in
it or perhaps manipulate it.

16
00:36.770 --> 00:38.810 align:middle line:90%
Maybe we have credit card
information or perhaps

17
00:38.810 --> 00:41.270 align:middle line:90%
we have other sensitive
details in banking

18
00:41.270 --> 00:44.280 align:middle line:90%
that we simply don't want
anyone to be able to look at.

19
00:44.280 --> 00:46.640 align:middle line:90%
So we could use a secure
protocol like SSL/TLS.

20
00:46.640 --> 00:49.160 align:middle line:84%


21
00:49.160 --> 00:50.600 align:middle line:90%
And the reason
this is so popular

22
00:50.600 --> 00:52.850 align:middle line:90%
is because that functionality
is built in to virtually

23
00:52.850 --> 00:54.405 align:middle line:84%
every browser on the planet.

24
00:54.405 --> 00:56.780 align:middle line:90%
And it basically goes like
this, when the client connects

25
00:56.780 --> 00:59.990 align:middle line:90%
to the website, the client,
our browser in this case

26
00:59.990 --> 01:02.680 align:middle line:90%
wants to validate that
that's the correct website.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:59.990 --> 01:02.680 align:middle line:90%
wants to validate that
that's the correct website.

27
01:02.680 --> 01:06.470 align:middle line:90%
This really talking to,
let's call it bank 5.

28
01:06.470 --> 01:08.090 align:middle line:84%
We want to verify bank 5.

29
01:08.090 --> 01:11.510 align:middle line:90%
And the way they do
that is through HTTPS,

30
01:11.510 --> 01:14.210 align:middle line:90%
which behind the scenes
is using SSL/TLS.

31
01:14.210 --> 01:16.130 align:middle line:90%
The bank is going to
give us, the client,

32
01:16.130 --> 01:18.260 align:middle line:90%
a copy of its
digital certificate

33
01:18.260 --> 01:21.140 align:middle line:90%
and in that digital certificate
it has a public key.

34
01:21.140 --> 01:24.510 align:middle line:90%
Not just any public key, but
it has the bank's public key.

35
01:24.510 --> 01:27.860 align:middle line:90%
So when PC1, when we receive
that, our browser says, "hmm.

36
01:27.860 --> 01:30.680 align:middle line:90%
This is the certificate I'm
now getting from this bank.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:27.860 --> 01:30.680 align:middle line:90%
This is the certificate I'm
now getting from this bank.

37
01:30.680 --> 01:31.958 align:middle line:84%
How do I know it's valid?

38
01:31.958 --> 01:33.500 align:middle line:90%
How do I know it's
not a hacker who's

39
01:33.500 --> 01:37.165 align:middle line:90%
giving me its certificate
with the hackers public key?"

40
01:37.165 --> 01:38.540 align:middle line:90%
And the answer to
that is, we are

41
01:38.540 --> 01:40.832 align:middle line:90%
going to see if this certificate
the bank is sending us

42
01:40.832 --> 01:43.730 align:middle line:90%
is signed by someone
that we trust.

43
01:43.730 --> 01:46.130 align:middle line:90%
And the way we're going
to do that is beforehand

44
01:46.130 --> 01:50.390 align:middle line:90%
our computer has a list of
CAs Certificate Authorities

45
01:50.390 --> 01:53.630 align:middle line:90%
and if this PC receives a
certificate from the bank

46
01:53.630 --> 01:55.825 align:middle line:90%
and sees it signed and it
can verify that signature

47
01:55.825 --> 01:56.450 align:middle line:84%
and say, "Woop.

48
01:56.450 --> 01:56.950 align:middle line:84%
Yeah.

49
01:56.950 --> 02:00.140 align:middle line:90%
I trust it because it's
signed by a CA that I trust."
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
01:56.950 --> 02:00.140 align:middle line:90%
I trust it because it's
signed by a CA that I trust."

50
02:00.140 --> 02:03.410 align:middle line:90%
The PC can then take the
contents of that certificate

51
02:03.410 --> 02:07.040 align:middle line:90%
and very importantly, the
public key from that certificate

52
02:07.040 --> 02:08.780 align:middle line:90%
and use that as
part of setting up

53
02:08.780 --> 02:12.650 align:middle line:90%
a secure session between
itself and the bank.

54
02:12.650 --> 02:15.140 align:middle line:90%
And many times if a
customer goes to a website

55
02:15.140 --> 02:19.040 align:middle line:90%
and they go with HTTP
not HTTPS, the server

56
02:19.040 --> 02:23.240 align:middle line:90%
will redirect them in
the background to HTTPS,

57
02:23.240 --> 02:24.740 align:middle line:90%
so they can start
the negotiation,

58
02:24.740 --> 02:27.470 align:middle line:90%
validate that the bank is
really who it says it is

59
02:27.470 --> 02:29.790 align:middle line:90%
and then continue on to
authenticating the user.

60
02:29.790 --> 02:31.460 align:middle line:90%
Now, a lot of times
the bank is going
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:29.790 --> 02:31.460 align:middle line:90%
Now, a lot of times
the bank is going

61
02:31.460 --> 02:34.220 align:middle line:90%
to use a digital certificate
as explained here

62
02:34.220 --> 02:37.030 align:middle line:90%
and then as the bank needs
to verify who the user is,

63
02:37.030 --> 02:38.720 align:middle line:90%
there's often a
password or something

64
02:38.720 --> 02:41.180 align:middle line:90%
similar to a password that's
used so that the bank can

65
02:41.180 --> 02:43.610 align:middle line:90%
verify who the user is
like Bob or you or I

66
02:43.610 --> 02:45.470 align:middle line:84%
that is connecting to the bank.

67
02:45.470 --> 02:48.680 align:middle line:90%
So digital certificates on one
side and possibly a username

68
02:48.680 --> 02:51.410 align:middle line:90%
and password or maybe
multi-factor authentication

69
02:51.410 --> 02:52.850 align:middle line:84%
on the side of the PC.

70
02:52.850 --> 02:54.060 align:middle line:84%
And for fun, let's do this.

71
02:54.060 --> 02:56.630 align:middle line:90%
Let's look at a packet capture
between a device that's

72
02:56.630 --> 02:58.310 align:middle line:84%
connecting to a website.

73
02:58.310 --> 03:00.350 align:middle line:90%
And we'll do it
first with these HTTP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
02:58.310 --> 03:00.350 align:middle line:90%
And we'll do it
first with these HTTP

74
03:00.350 --> 03:02.690 align:middle line:90%
without any type of
encryption or protection

75
03:02.690 --> 03:06.800 align:middle line:90%
and then we'll do with HTTPS
which is then leveraging TLS.

76
03:06.800 --> 03:09.680 align:middle line:90%
And from this PC over here,
let's go ahead and connect over

77
03:09.680 --> 03:10.660 align:middle line:84%
with HTTP.

78
03:10.660 --> 03:12.937 align:middle line:90%
First, we'll authenticate
at the router

79
03:12.937 --> 03:14.270 align:middle line:84%
and then we'll capture all that.

80
03:14.270 --> 03:16.280 align:middle line:90%
And then let's also
then change gears,

81
03:16.280 --> 03:19.190 align:middle line:90%
we'll connect via HTTPS
so we can visually

82
03:19.190 --> 03:21.470 align:middle line:90%
see with the protocol
capture what's

83
03:21.470 --> 03:24.590 align:middle line:90%
going on behind the scenes and
also identify that the HTTPS

84
03:24.590 --> 03:26.430 align:middle line:84%
session is completely protected

85
03:26.430 --> 03:26.930 align:middle line:84%
All right.

86
03:26.930 --> 03:29.930 align:middle line:90%
So this represents the client
over on the 10.1 network.

87
03:29.930 --> 03:32.360 align:middle line:90%
Over on the left,
we'll open up a browser
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
03:29.930 --> 03:32.360 align:middle line:90%
Over on the left,
we'll open up a browser

88
03:32.360 --> 03:37.040 align:middle line:90%
and let's first go to
HTTP without the S.

89
03:37.040 --> 03:40.100 align:middle line:84%
And we'll go to 25.2.2.2.

90
03:40.100 --> 03:42.320 align:middle line:90%
Press Enter and
we'll authenticate.

91
03:42.320 --> 03:46.710 align:middle line:90%
So the user is admin and
this is the password.

92
03:46.710 --> 03:48.570 align:middle line:90%
And bada bing bada
boom, we're connected.

93
03:48.570 --> 03:50.820 align:middle line:84%
Now that is not secure.

94
03:50.820 --> 03:53.600 align:middle line:90%
So up here in our browser,
it's indicating that we are not

95
03:53.600 --> 03:54.990 align:middle line:84%
on a secure connection.

96
03:54.990 --> 03:56.570 align:middle line:84%
So it's just warning us.

97
03:56.570 --> 03:58.880 align:middle line:90%
If we did it again,
but we did with HTTPS,

98
03:58.880 --> 03:59.880 align:middle line:84%
it would look like this.

99
03:59.880 --> 04:02.990 align:middle line:90%
I'll close that browser
and open it up again
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
03:59.880 --> 04:02.990 align:middle line:90%
I'll close that browser
and open it up again

100
04:02.990 --> 04:08.711 align:middle line:90%
and this time we'll go
to https://25.2.2.2.

101
04:08.711 --> 04:11.075 align:middle line:90%
It's asking me to authenticate
again which I will.

102
04:11.075 --> 04:13.580 align:middle line:84%


103
04:13.580 --> 04:15.930 align:middle line:84%
And this is the HTTPS session.

104
04:15.930 --> 04:18.887 align:middle line:90%
Now, right here, it's showing
us under the little lock there,

105
04:18.887 --> 04:20.720 align:middle line:90%
they're saying, the
connection is not secure

106
04:20.720 --> 04:23.750 align:middle line:90%
and that's because my
browser, this one right here,

107
04:23.750 --> 04:26.030 align:middle line:84%
doesn't trust the certificate.

108
04:26.030 --> 04:28.490 align:middle line:90%
It can't verify the
signature on the certificate.

109
04:28.490 --> 04:30.950 align:middle line:90%
That's because I'm using a
self signed certificate over
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
04:28.490 --> 04:30.950 align:middle line:90%
That's because I'm using a
self signed certificate over

110
04:30.950 --> 04:31.820 align:middle line:84%
on the router.

111
04:31.820 --> 04:35.600 align:middle line:90%
So now we've opened those two
sessions, one with HTTP and one

112
04:35.600 --> 04:39.080 align:middle line:90%
with HTTPS, let's take a
look at the packet captures.

113
04:39.080 --> 04:41.205 align:middle line:90%
So if we go down the
capture a little bit here,

114
04:41.205 --> 04:42.830 align:middle line:90%
this looks like the
three way handshake

115
04:42.830 --> 04:44.160 align:middle line:84%
for initial conversation there.

116
04:44.160 --> 04:47.870 align:middle line:90%
If we right click on that and
specify Follow and then follow

117
04:47.870 --> 04:50.910 align:middle line:90%
the TCP stream,
there's our connection.

118
04:50.910 --> 04:53.630 align:middle line:90%
So anything we typed in,
it would show up here.

119
04:53.630 --> 04:57.740 align:middle line:90%
Because HTTP without TLS
is going to be plain text,

120
04:57.740 --> 05:00.896 align:middle line:90%
anybody eavesdropping could
read all of this information.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
04:57.740 --> 05:00.896 align:middle line:90%
anybody eavesdropping could
read all of this information.

121
05:00.896 --> 05:02.670 align:middle line:90%
So that's without
the protection.

122
05:02.670 --> 05:04.160 align:middle line:84%
I might go ahead and close that.

123
05:04.160 --> 05:06.535 align:middle line:90%
So let's scroll down a little
bit further in the capture.

124
05:06.535 --> 05:08.290 align:middle line:84%
And here we have a--

125
05:08.290 --> 05:09.200 align:middle line:84%
fantastic right here.

126
05:09.200 --> 05:11.617 align:middle line:90%
So it looks like a three-way
handshake starting right here

127
05:11.617 --> 05:14.710 align:middle line:90%
tag at 60, then we have a,
client hello using TLS version

128
05:14.710 --> 05:18.400 align:middle line:90%
1.2 and then we have a
server responding back.

129
05:18.400 --> 05:21.370 align:middle line:90%
And in the payload here of this
packet from the server going

130
05:21.370 --> 05:23.260 align:middle line:90%
back to the client,
if we open this up,

131
05:23.260 --> 05:25.810 align:middle line:90%
here is information,
TLS information.

132
05:25.810 --> 05:28.220 align:middle line:90%
Well, first of all, it says
it's 1.2 which is great.

133
05:28.220 --> 05:30.670 align:middle line:90%
And it's also the information
here in your certificate
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

133
05:28.220 --> 05:30.670 align:middle line:90%
And it's also the information
here in your certificate

134
05:30.670 --> 05:34.270 align:middle line:90%
that is being presented by
the server back to the client.

135
05:34.270 --> 05:36.280 align:middle line:90%
Then we have an
acknowledgment here.

136
05:36.280 --> 05:38.350 align:middle line:90%
Some more traffic
coming from the server.

137
05:38.350 --> 05:39.670 align:middle line:84%
And check this out.

138
05:39.670 --> 05:41.800 align:middle line:90%
Right here as part
of the negotiation

139
05:41.800 --> 05:44.830 align:middle line:90%
it says EC for Elliptical
Curve Diffie-Hellman server

140
05:44.830 --> 05:45.920 align:middle line:84%
parameters.

141
05:45.920 --> 05:48.490 align:middle line:90%
So it's using Diffie-Hellman
as part of the TLS

142
05:48.490 --> 05:50.090 align:middle line:84%
for key negotiation.

143
05:50.090 --> 05:53.560 align:middle line:90%
So the initial authentication is
done with a digital certificate

144
05:53.560 --> 05:54.960 align:middle line:84%
and a public private key pair.

145
05:54.960 --> 05:57.730 align:middle line:90%
However, they are setting
up shared keying information

146
05:57.730 --> 06:00.550 align:middle line:90%
that they can then use for
the bulk encryption of data
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

146
05:57.730 --> 06:00.550 align:middle line:90%
that they can then use for
the bulk encryption of data

147
06:00.550 --> 06:03.040 align:middle line:90%
they'll be sending back and
forth between the client

148
06:03.040 --> 06:04.090 align:middle line:84%
and the server.

149
06:04.090 --> 06:06.430 align:middle line:90%
Also, here if we right
click on one of these

150
06:06.430 --> 06:11.700 align:middle line:90%
and said Follow and said I
want to follow the TCP stream.

151
06:11.700 --> 06:13.450 align:middle line:90%
There's not a lot of
sense we can make out

152
06:13.450 --> 06:16.750 align:middle line:90%
of this because most of the
payload here is encrypted.

153
06:16.750 --> 06:19.420 align:middle line:90%
Unless you have the keys
involved to unlock the data,

154
06:19.420 --> 06:21.190 align:middle line:90%
it's just a bunch
of gobbledygook.

155
06:21.190 --> 06:23.050 align:middle line:90%
Now, fortunately the
client and the server

156
06:23.050 --> 06:24.470 align:middle line:90%
because they
negotiated and set up

157
06:24.470 --> 06:27.640 align:middle line:90%
the keying material it can
use, they have the keys to lock

158
06:27.640 --> 06:29.388 align:middle line:90%
and unlock that
data respectively.

159
06:29.388 --> 06:31.180 align:middle line:90%
In this video, we've
looked at the benefits
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

159
06:29.388 --> 06:31.180 align:middle line:90%
In this video, we've
looked at the benefits

160
06:31.180 --> 06:34.570 align:middle line:90%
of using transport layer
security to protect our packets

161
06:34.570 --> 06:36.790 align:middle line:90%
as they're going between
a client and a server

162
06:36.790 --> 06:39.112 align:middle line:90%
leveraging TLS or
Transport Layer Security.

163
06:39.112 --> 06:40.570 align:middle line:90%
Now, one of the
challenges that I'd

164
06:40.570 --> 06:43.120 align:middle line:90%
like to tackle in the next
video is, how in the world

165
06:43.120 --> 06:45.550 align:middle line:90%
did a client like
a PC and a browser,

166
06:45.550 --> 06:47.770 align:middle line:90%
how did it verify that
the certificate it

167
06:47.770 --> 06:50.600 align:middle line:90%
got from the server
is actually valid?

168
06:50.600 --> 06:53.720 align:middle line:90%
So we'll go into PKI and how
that works in the next video.

169
06:53.720 --> 06:55.430 align:middle line:84%
See you there in just a moment.

170
06:55.430 --> 06:58.000 align:middle line:90%
Meanwhile, I hope this has
been informative for you

171
06:58.000 --> 07:01.320 align:middle line:90%
and I'd like to thank
you for viewing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

171
06:58.000 --> 07:01.320 align:middle line:90%
and I'd like to thank
you for viewing.