HTTPS vs HTTP

HTTPS stands for Hyper Text Transfer Protocol Secure. This is the secure version of HTTP, the protocol over which data is sent between your browser and the website that you are connected to. The ‘S’ at the end of HTTPS stands for ‘Secure’. This means all communications between your browser and the website are encrypted.

HTTP, on the other hand, stands for Hyper Text Transfer Protocol. The key difference between the two is the security layer with HTTPS, which is not present with HTTP. This means that the data exchanged between your browser and the server of the website you’re using is not encrypted and could potentially be intercepted and read by others.

When a URL begins with “https://”, this means that the website has a secure connection, and it is using a Secure Sockets Layer (SSL) or Transport Layer Security (TLS) protocol to encrypt data that’s being transferred. This is particularly important when sensitive information is being exchanged, such as credit card numbers or personal information.

When a URL starts with “http://”, it means that the website does not have this layer of security and information being exchanged is not encrypted. This does not necessarily mean that the website is unsafe, but it does mean that it is not as secure as a website that uses HTTPS. It’s recommended to be careful about what information you share on websites that only use HTTP, especially in forms or fields where sensitive information might be entered.

How is connection between a client device and a website is established in HTTPS?

HTTPS is related to the concepts of private and public key encryption, which is often realized through a system called SSL/TLS (Secure Sockets Layer/Transport Layer Security).

In the context of HTTPS, here is a simplified explanation of how it works:

• When a user navigates to a website via HTTPS, the website sends its SSL certificate to the user’s browser. This certificate contains the website’s public key.
• The browser checks the validity of this SSL certificate. If it is valid, the browser generates a unique symmetric key (a session key) for that browsing session.
• The browser then encrypts this session key with the website’s public key and sends it back to the website.
• The website then uses its private key to decrypt the session key. Now, both the browser and the website have the same session key, and this key can be used for encrypting and decrypting the data that they exchange.

All the data sent between the browser and the website during that session is encrypted with the session key. This ensures that even if the data is intercepted, it would be unreadable without the session key.

This process ensures a secure and private connection between a user’s browser and the website, as the public key is available to anyone, but the private key is kept secret by the website. The session key, which is used for the actual encryption and decryption of data, is unique to each session and is securely exchanged with the help of the public and private keys.

How does public and private key work in message exchange in general?

Public key cryptography, also known as asymmetric cryptography, uses a pair of keys: a public key, which is shared with everyone, and a private key, which is kept secret. Here’s a simplified explanation of how these two keys are used in message exchange:

1. Encryption: Suppose Alice wants to send a secure message to Bob. She gets Bob’s public key (which is openly available) and uses it to encrypt the message. The encryption process transforms the original message into an unreadable format (known as ciphertext) using the public key.

2. Transmission: Alice sends the encrypted message (ciphertext) over the network. Even if someone intercepts this message during transmission, they cannot understand it because it’s encrypted.

3. Decryption: On receiving the message, Bob uses his private key (which only he has) to decrypt the message. The private key transforms the ciphertext back into the original, readable format.

The beauty of this system is that the public key can only be used to encrypt messages, and only the corresponding private key can be used to decrypt them. This means that anyone can encrypt a message (since the public key is public), but only the intended recipient can decrypt it (since only they have the private key).

There is also a process called digital signing, where the private key is used to ‘sign’ a message, and the public key is used to verify that signature. This provides an assurance that the message came from the person who claims to have sent it, and that it wasn’t altered during transmission. This is crucial in many security protocols, including HTTPS.

Step by step procedure of public key cryptogrpahy:

1. Key Generation:

Alice and Bob generate their own public and private keys:

APu is Alice’s Public Key

APr is Alice’s Private Key

BPu is Bob’s Public Key

BPr is Bob’s Private Key

2. Public Key Exchange:

They openly share their public keys:

Alice — (sends APu) –> Bob                 AND               Alice <— (receives BPu) — Bob

3. Message Encryption & Sending:

Alice wants to send a secure message to Bob. She uses Bob’s public key to encrypt it:

Plain Message + BPu —(encryption)—> Encrypted Message —(Alice sends to)—> Bob

4. Message Decryption & Reading:

Bob uses his private key to decrypt the message:

Encrypted Message + BPr —(decryption)—> Plain Message

Now, Bob can read the original message sent by Alice.

Remember, in public key cryptography, the public key is used to encrypt the data, and the corresponding private key is used to decrypt it. This means that anyone can encrypt a message (since the public key is public), but only the holder of the private key can decrypt it.

For Simulation:

https://www.devglan.com/online-tools/rsa-encryption-decryption

https://www.javainuse.com/rsagenerator

Digital signature

Digital signatures are an important component of cryptography and secure communications, providing a way to confirm the authenticity and integrity of a message. Here’s a simplified explanation of how digital signatures work:

Creating a Digital Signature: Suppose Alice wants to send a signed message to Bob. First, Alice creates a hash (digest) of her message. A hash is a fixed-size string of characters that is unique to the original input—think of it as a “digital fingerprint” of the message. Alice then uses her private key to encrypt this hash, creating the digital signature.

Attaching the Signature to the Message: Alice attaches this digital signature to her original message. She then sends the combined signed message to Bob.

Verifying the Digital Signature: Upon receiving the signed message, Bob uses Alice’s public key (which he has or can easily obtain) to decrypt the digital signature, getting back the original hash that Alice created.

Checking Message Integrity: Bob also creates a hash of the message he received (excluding the signature). If this hash matches the decrypted hash from Alice’s digital signature, Bob can be confident that the message was not altered during transmission (integrity) and that it indeed came from Alice (authenticity), as only Alice has her private key and could have created that specific signature.

Here’s a step-by-step procedure of Digital signature process:

1. Creating a Digital Signature:

Alice creates a hash of her message and encrypts it with her private key:

Message —(hash function)—> Hash —(Alice’s Private Key)—> Digital Signature

2. Attaching the Signature to the Message:

Alice attaches the signature to her message:

Message + Digital Signature

3. Sending the Message:

Alice sends the signed message to Bob:

Alice —(sends Message + Digital Signature)—> Bob

4. Verifying the Digital Signature:

Bob uses Alice’s public key to decrypt the signature, getting back the original hash:

Digital Signature —(Alice’s Public Key)—> Hash

5. Checking Message Integrity:

Bob creates a hash of the received message and compares it to the decrypted hash:

Message —(hash function)—> Hash

If the two hashes match, the message is verified as authentic and intact.

This is a simplified explanation. In practice, the processes of hashing and encrypting can be quite complex, and they rely on advanced mathematical algorithms to ensure security.

Online hash simulation

http://hash-functions.online-domain-tools.com/