TLS and Network Security
TLS / HTTPS
TLS provides confidentiality, integrity and authentication for a connection. HTTPS is HTTP over TLS.
Handshake (TLS 1.3, simplified)
Client Server
ClientHello (versions, ciphers, key share) ->
<- ServerHello, certificate, key share, Finished
Finished ->
=== encrypted application data ===
- The client and server agree on parameters and exchange key shares.
- The server proves its identity with a certificate signed by a trusted certificate authority (CA).
- Both derive the same symmetric session keys (fast bulk encryption).
| Primitive | Role |
|---|---|
| Asymmetric crypto (RSA, ECDSA, ECDH) | Authentication and key exchange |
| Symmetric crypto (AES-GCM, ChaCha20) | Encrypting the data |
| Hashes / MACs (SHA-256, HMAC) | Integrity |
Firewalls and proxies
| Component | Role |
|---|---|
| Packet-filter firewall | Allow or block by IP, port, protocol |
| Stateful firewall | Tracks connection state |
| Web application firewall | Inspects HTTP traffic for attacks |
| Forward proxy | Clients reach the Internet through it |
| Reverse proxy / load balancer | Sits in front of servers |
| VPN | Encrypted tunnel across an untrusted network |
Common attacks
| Attack | Description | Mitigation |
|---|---|---|
| Sniffing / MITM | Reading or altering traffic | TLS, certificate validation |
| DoS / DDoS | Overwhelm a service | Rate limiting, CDN, scrubbing |
| SYN flood | Exhaust half-open connections | SYN cookies |
| ARP spoofing | Poison ARP caches | Dynamic ARP inspection |
| DNS spoofing | Forge DNS answers | DNSSEC, DoT / DoH |
| XSS | Inject script into pages | Output encoding, CSP |
| CSRF | Trick a browser into sending requests | SameSite cookies, CSRF tokens |
| SQL injection | Inject SQL via input | Parameterised queries |
CAUTION
Never disable certificate verification in production code to "make it work". It removes the authentication half of TLS.
Loading Comments...