Explaining HTTPS & TLS
HTTP (Hypertext Transfer Protocol) and HTTPS (Hypertext Transfer Protocol Secure) are both protocols used for transferring data over a network, particularly on the web. In this article we will delve into significant difference between them, and explain more details about TCP/TLS protocols.
Table of contents:
- Difference between HTTP and HTTPS
- Analyzing traffic using Wireshark
- Analyzing TCP Packet
- Analyzing TLS Packet
Difference between HTTP and HTTPS:
Data Transmission:
— HTTP: Data is transmitted in plain text, making it susceptible to eavesdropping. This is a potential security risk, especially when transmitting sensitive information.
- HTTPS: Data is encrypted, providing a secure way to transmit sensitive information over the internet. This encryption ensures that even if someone intercepts the data, they won’t be able to understand or tamper with it without the proper decryption key.
Protocol Port:
— HTTP: Typically uses port 80 for communication.
— HTTPS: Typically uses port 443 for communication.
Analyzing traffic using Wireshark:
Let’s break down the steps for analyzing traffic using Wireshark:
Start Wireshark:
- Open Wireshark and select the network interface you want to capture traffic on.
Visit multividas.com:
- Open a web browser and go to multividas.com.
Get IP address using nslookup:
- Open a command prompt.
- Type
nslookup multividas.comto get the IP address of multividas.com.
Filter Wireshark results:
- In Wireshark, use a display filter to focus on traffic related to the IP address obtained in the previous step.
- For example:
ip.addr == <Multividas IP>.
Analyzing TCP Packet:
Following this, you will observe a sequence of requests originating from my computer. To provide a concrete example, let’s examine a specific request in which the source is my computer’s IP address, and the destination is the IP address of the remote website. The subsequent line in the communication log displays the response, where the source is the IP address of the remote computer, and the destination is my computer’s IP address.
In addition to the IP addresses, the communication involves source and destination ports. The source port is randomly selected by the sender and always exceeds 1024. In this case, the destination port is 443, commonly associated with HTTPS.
A notable aspect of the communication is the presence of flags;
- SYN (Synchronize) Flag: The sender initiates the communication by sending a packet with the SYN flag set. This flag indicates the intention to establish a connection or initiate a new session.
- SYN-ACK (Synchronize-Acknowledge) Flag: Upon receiving the initial packet, the recipient responds with a packet containing both the SYN and ACK (Acknowledge) flags. The SYN-ACK signifies the acknowledgment of the sender’s request to establish a connection and communicates the recipient’s readiness for further communication.
- ACK (Acknowledge) Flag: In the final step of the three-way handshake, the sender acknowledges the recipient’s response by sending a packet with the ACK flag set. This indicates that the connection has been successfully established. At this point, both parties are synchronized and ready to exchange data securely.
Analyzing TLS Packet:
HTTP over TLS, and that means that HTTP communication occurs over TLS tunnel and all data that is sent over TLS is fully encrypted using symmetric key encryption. And that means that my computer and remote server have same key that is used for encryption and decryption.
Data is transmitted from the server and encoded using symmetric key encryption, relying on a shared key between the local computer and the remote server.
The key exchange, facilitated by asymmetric RSA Keys, happens at the session’s start.
HTTPS utilizes the TLS protocol for complete data encryption, including TLS version, payload length, and encrypted application data. Access to the designated encryption key enables successful decryption, revealing the intended readable data.
