Hypertext Transfer Protocol over Secure Socket Layer (HTTPS) - Revision history

KathyBennett: /* History and development */

2009-10-06T19:42:47Z

History and development

← Older revision		Revision as of 19:42, 6 October 2009
Line 12:		Line 12:

	== History and development ==		== History and development ==
-	~~Early~~ research efforts toward transport layer security included the Secure Network Programming (SNP) API, which in 1993 explored the approach of having a secure transport layer API closely resembling sockets, to facilitate retrofitting preexisting network applications with security measures. The SNP project received the 2004 ACM Software System Award.'''[5]'''	+	According to many [http://www.research-service.com/custom-research-paper.html research papers] that they make, early research efforts toward transport layer security included the Secure Network Programming (SNP) API, which in 1993 explored the approach of having a secure transport layer API closely resembling sockets, to facilitate retrofitting preexisting network applications with security measures. The SNP project received the 2004 ACM Software System Award.'''[5]'''

	The SSL protocol was originally developed by Netscape. Version 1.0 was never publicly released; version 2.0 was released in February 1995 but "contained a number of security flaws which ultimately led to the design of SSL version 3.0", which was released in 1996 (Rescorla 2001). This later served as the basis for TLS version 1.0, an Internet Engineering Task Force (IETF) standard protocol first defined in RFC 2246 in January 1999. '''[5]'''Visa, MasterCard, American Express and many leading financial institutions have endorsed SSL for commerce over the Internet.		The SSL protocol was originally developed by Netscape. Version 1.0 was never publicly released; version 2.0 was released in February 1995 but "contained a number of security flaws which ultimately led to the design of SSL version 3.0", which was released in 1996 (Rescorla 2001). This later served as the basis for TLS version 1.0, an Internet Engineering Task Force (IETF) standard protocol first defined in RFC 2246 in January 1999. '''[5]'''Visa, MasterCard, American Express and many leading financial institutions have endorsed SSL for commerce over the Internet.

Maoy5 at 18:17, 21 April 2009

2009-04-21T18:17:05Z

← Older revision		Revision as of 18:17, 21 April 2009
Line 107:		Line 107:
	# OpenSSL Contributions http://www.openssl.org/contrib/		# OpenSSL Contributions http://www.openssl.org/contrib/
	# Association for Computing Machinery, "ACM: Press Release, March 15, 2005", campus.acm.org, accessed December 26, 2007. (English version).		# Association for Computing Machinery, "ACM: Press Release, March 15, 2005", campus.acm.org, accessed December 26, 2007. (English version).
		+	--[[User:Maoy5\|Maoy5]] 22:57, 12 April 2009 (EDT)

Maoy5: /* See Also */

2009-04-13T02:19:02Z

Maoy5: /* See Also */

2009-04-13T02:17:53Z

Maoy5: /* External Links */

2009-04-13T00:59:29Z

External Links

← Older revision		Revision as of 00:59, 13 April 2009
Line 98:		Line 98:
	* RFC 4492: “[[Elliptic Curve Cryptography]] (ECC) Cipher Suites for Transport Layer Security (TLS)”.		* RFC 4492: “[[Elliptic Curve Cryptography]] (ECC) Cipher Suites for Transport Layer Security (TLS)”.
	* RFC 4507: “Transport Layer Security (TLS) Session Resumption without Server-Side State”.		* RFC 4507: “Transport Layer Security (TLS) Session Resumption without Server-Side State”.
-	* RFC 4680: “TLS Handshake Message for Supplemental Data”.
-	* RFC 4681: “TLS User Mapping Extension”.
	* RFC 4785: “Pre-Shared Key (PSK) Ciphersuites with NULL Encryption for Transport Layer Security (TLS)”.		* RFC 4785: “Pre-Shared Key (PSK) Ciphersuites with NULL Encryption for Transport Layer Security (TLS)”.

Maoy5: /* Client Behavior */

2009-04-13T00:58:49Z

Client Behavior

← Older revision		Revision as of 00:58, 13 April 2009
Line 41:		Line 41:
	* A HTTP response without a Content-Length header. Since data length in this situation is signalled by connection close a premature close generated by the server cannot be distinguished from a spurious close generated by an attacker.'''[1]'''		* A HTTP response without a Content-Length header. Since data length in this situation is signalled by connection close a premature close generated by the server cannot be distinguished from a spurious close generated by an attacker.'''[1]'''

-	* A HTTP response with a valid Content-Length header closed before all data has been read. Because TLS does not provide document oriented protection, it is impossible to determine whether the server has miscomputed the Content-Length or an attacker has truncated the connection.	+	* A HTTP response with a valid Content-Length header closed before all data has been read. Because TLS does not provide document oriented protection, it is impossible to determine whether the server has miscomputed the Content-Length or an attacker has truncated the connection.RFC 4366

-	* There is one exception to the above rule. When encountering a premature close, a client SHOULD treat as completed all requests for which it has received as much data as specified in the Content-Length header.	+	* There is one exception to the above rule. When encountering a premature close, a client SHOULD treat as completed all requests for which it has received as much data as specified in the Content-Length header.RFC 4367

	* A client detecting an incomplete close SHOULD recover gracefully. It MAY resume a TLS session closed in this fashion.		* A client detecting an incomplete close SHOULD recover gracefully. It MAY resume a TLS session closed in this fashion.

Maoy5: /* External Links */

2009-04-13T00:56:57Z

External Links

← Older revision		Revision as of 00:56, 13 April 2009
Line 79:		Line 79:
	== External Links ==		== External Links ==
	'''The current approved version is 1.2, which is specified in:'''		'''The current approved version is 1.2, which is specified in:'''
		+	* RFC 2660: "The Secure HyperText Transfer Protocol".
	* RFC 5246: “The Transport Layer Security (TLS) Protocol Version 1.2”.		* RFC 5246: “The Transport Layer Security (TLS) Protocol Version 1.2”.

Maoy5: /* History and development */

2009-04-11T18:20:52Z

History and development

← Older revision		Revision as of 18:20, 11 April 2009
Line 12:		Line 12:

	== History and development ==		== History and development ==
-	Early research efforts toward transport layer security included the Secure Network Programming (SNP) API, which in 1993 explored the approach of having a secure transport layer API closely resembling sockets, to facilitate retrofitting preexisting network applications with security measures. The SNP project received the 2004 ACM Software System Award.[5]	+	Early research efforts toward transport layer security included the Secure Network Programming (SNP) API, which in 1993 explored the approach of having a secure transport layer API closely resembling sockets, to facilitate retrofitting preexisting network applications with security measures. The SNP project received the 2004 ACM Software System Award.'''[5]'''

-	The SSL protocol was originally developed by Netscape. Version 1.0 was never publicly released; version 2.0 was released in February 1995 but "contained a number of security flaws which ultimately led to the design of SSL version 3.0", which was released in 1996 (Rescorla 2001). This later served as the basis for TLS version 1.0, an Internet Engineering Task Force (IETF) standard protocol first defined in RFC 2246 in January 1999. [5]Visa, MasterCard, American Express and many leading financial institutions have endorsed SSL for commerce over the Internet.	+	The SSL protocol was originally developed by Netscape. Version 1.0 was never publicly released; version 2.0 was released in February 1995 but "contained a number of security flaws which ultimately led to the design of SSL version 3.0", which was released in 1996 (Rescorla 2001). This later served as the basis for TLS version 1.0, an Internet Engineering Task Force (IETF) standard protocol first defined in RFC 2246 in January 1999. '''[5]'''Visa, MasterCard, American Express and many leading financial institutions have endorsed SSL for commerce over the Internet.

	SSL operates in modular fashion. It is extensible by design, with support for forward and backward compatibility and negotiation between peers.		SSL operates in modular fashion. It is extensible by design, with support for forward and backward compatibility and negotiation between peers.

Maoy5: /* History and development */

2009-04-11T18:20:40Z

History and development

← Older revision		Revision as of 18:20, 11 April 2009
Line 12:		Line 12:

	== History and development ==		== History and development ==
-	Early research efforts toward transport layer security included the Secure Network Programming (SNP) API, which in 1993 explored the approach of having a secure transport layer API closely resembling sockets, to facilitate retrofitting preexisting network applications with security measures. The SNP project received the 2004 ACM Software System Award.	+	Early research efforts toward transport layer security included the Secure Network Programming (SNP) API, which in 1993 explored the approach of having a secure transport layer API closely resembling sockets, to facilitate retrofitting preexisting network applications with security measures. The SNP project received the 2004 ACM Software System Award.[5]

-	The SSL protocol was originally developed by Netscape. Version 1.0 was never publicly released; version 2.0 was released in February 1995 but "contained a number of security flaws which ultimately led to the design of SSL version 3.0", which was released in 1996 (Rescorla 2001). This later served as the basis for TLS version 1.0, an Internet Engineering Task Force (IETF) standard protocol first defined in RFC 2246 in January 1999. Visa, MasterCard, American Express and many leading financial institutions have endorsed SSL for commerce over the Internet.	+	The SSL protocol was originally developed by Netscape. Version 1.0 was never publicly released; version 2.0 was released in February 1995 but "contained a number of security flaws which ultimately led to the design of SSL version 3.0", which was released in 1996 (Rescorla 2001). This later served as the basis for TLS version 1.0, an Internet Engineering Task Force (IETF) standard protocol first defined in RFC 2246 in January 1999. [5]Visa, MasterCard, American Express and many leading financial institutions have endorsed SSL for commerce over the Internet.

	SSL operates in modular fashion. It is extensible by design, with support for forward and backward compatibility and negotiation between peers.		SSL operates in modular fashion. It is extensible by design, with support for forward and backward compatibility and negotiation between peers.
-
-

	== Applications ==		== Applications ==

Maoy5: /* References */

2009-04-11T18:20:18Z

References

← Older revision		Revision as of 18:20, 11 April 2009
Line 109:		Line 109:
	# Microsoft (2009-02-27/). "MS-TLSP Appendix A". http://msdn.microsoft.com/en-us/library/dd208005%28PROT.13%29.aspx.		# Microsoft (2009-02-27/). "MS-TLSP Appendix A". http://msdn.microsoft.com/en-us/library/dd208005%28PROT.13%29.aspx.
	# OpenSSL Contributions http://www.openssl.org/contrib/		# OpenSSL Contributions http://www.openssl.org/contrib/
		+	# Association for Computing Machinery, "ACM: Press Release, March 15, 2005", campus.acm.org, accessed December 26, 2007. (English version).

← Older revision		Revision as of 02:19, 13 April 2009
Line 76:		Line 76:
	==See Also==		==See Also==
	[[Transport Layer Security]]		[[Transport Layer Security]]
-	~~[[Web services]]~~

	== External Links ==		== External Links ==

← Older revision		Revision as of 02:17, 13 April 2009
Line 76:		Line 76:
	==See Also==		==See Also==
	[[Transport Layer Security]]		[[Transport Layer Security]]
		+	[[Web services]]

	== External Links ==		== External Links ==