# HTTPS  --- ## Why do we want security anyway?  --- ### Privacy  --- ### Integrity  --- ### Identification  --- ## Certificate Authority  --- - CA are third party companies that: - Issue certificates - Confirm identities of certificate owners - Prove validiity of certificates. - Root store is a database of trusted CAS. Microsoft, apple, and mozilla have their own that they pre-install for their browsers --- ## HTTPS  --- ## HTTP (no S)  --- ## How is HTTPS different? It's still the same conversation between a browser and server! But now it's got **T**ransport **L**ayer **S**ecurity... --- ## What is TLS? TLS = Transport Layer Security - Encrypts the communication between web applications and servers - HTTPS is an implementation of TLS encryption (any site using HTTPS is employing TLS encryption) - TLS helps protect against attacks --- ## Keys  - Symmetric vs asymmetric - Private and public (asymmetric) keys are used to encrypt the pre-master key meaning nobody will be able to intercept it - Pre-master key + master key (both symmetric) --- ### How does TLS work? - Encryption: Hides data from third parties - Authentication: Ensures parties are who they claim to be - Data encrypted with the public key can only be decrypted with a private key and vice versa - Integrity: Is the data free from tampering? - Data is signed with a Message Authentication Code (MAC) and verifies the integrity of the data --- ### TLS Handshake - Before exchanging data the browser and server need to agree first on a common set of algorithms to secure the connection  ---  --- ## Any Questions?