title: "SSL/TLS advanced"
description: "SSL/TLS advanced"
cleanUrl: /sw-engineer/ssl-tls-advanced
ogImage: "<https://anyflower.notion.site/image/https%3A%2F%2Fprod-files-secure.s3.us-west-2.amazonaws.com%2F7570d2fc-66b1-4e23-bb3c-ff7b56842b0d%2F74d8fede-9348-4630-bb85-883867a643ee%2FIT_Study_Note_(1).png?table=block&id=73e1fb70-6a5a-4110-9915-7645e4d7895e&spaceId=7570d2fc-66b1-4e23-bb3c-ff7b56842b0d&width=2000&userId=&cache=v2>"
floatFirstTOC: right

Introduction

SSL/TLS 관련 심화 주제를 다룹니다.

TLS의 Cipher Suite

• TLS는 쌍방이 사용할 4개의 알고리즘 즉, 키교환, 전자서명, 대칭키 암호화, MAC 알고리즘을 handshaking 과정을 통해 합의한다. 아래와 같은 형식으로.

  

• 대칭키 교환 방식은 ECDHE(Elliptic Curve Diffie Hellman Ephemeral)을 사용
• 인증서 서명 방식은 RSA로 서명된 인증서로 상호 간의 신원을 확인
• 대칭키 암호화 알고리즘은 AES 256bit와 GCM을 사용
• HMAC 알고리즘으로는 SHA-384를 사용해서 메시지의 무결성을 확인

TLS authentication 메커니즘

Domain 유효성 검증

• 접근한 domain name과 certificate 내 CN(Common Name) field 값의 동일성 비교
• 참고 : CN에는 일반적으로 domain name이 들어감(wildcard 포함 가능)

signature 검증

사전 지식

• 검증 대상 certificate 내 signature는 CA의 private key로 sign됨
• 검증 주체는 검증 대상 certificate을 sign한 CA certificate을 갖고 있음

검증 절차(digital signature 검증 메커니즘 그대로 사용)