lecture3.html

<!DOCTYPE html>
<!--
    Middleware and Web Services, CTU course slides
    (cc) 2010-2023 Tomas Vitvar, http://vitvar.com
    written for Humla, an open source HTML5 presentation environment
-->
<html>

<head>
  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
  <meta name="course" content="Middleware Architectures 1" />
  <meta name="lecture" content="Lecture 3" />
  <meta name="keywords" content="Integration Patterns" />

  <link type="text/css" rel="stylesheet" href="css/meta.css">
  </link>
  <link type="text/css" rel="stylesheet" href="css/ctu-fit.css">
  </link>
  <link type="text/css" rel="stylesheet" href="humla/lib/core/humla.css">
  </link>

  <script type="text/javascript" src="humla/lib/humla.js"></script>
  <title>Communication Protocols</title>
</head>

<body>
  <footer>
    <p><b>#META_LECTURE#: #TITLE#</b>,&nbsp;<span class="meta_semester" />,&nbsp;
      <span class="meta_twitter" />
    </p>
    <p><b>&#8210; #SLIDE_NO# &#8210;</b></p>
  </footer>

  <div class="slide intro">
    <hgroup>
      <h1><span class="meta_course" /></h1>
      <h2>#META_LECTURE#: #TITLE#</h2>
    </hgroup>
    <div class="author">
      <p class="meta_author" />
      <p><span class="meta_email" /> &bull; <span class="meta_twitter" /> &bull;
        <span class="meta_web" />
      </p>
    </div>
    <center>
      <div class="meta_logo"></div>
    </center>
    <div class="org">
      <p class="meta_org" />
      <p><span class="meta_orgfac" /> &bull; <span class="meta_field" />
        &bull; <span class="meta_orgweb" /></p>
    </div>
    <div class="etc">
      <div class="text-info">
        Modified: #LAST_MODIFIED#<br />
        Humla v#HUMLA_VERSION#
      </div>
      <a href="http://creativecommons.org/licenses/by-sa/3.0/">
        <div class="license"></div>
      </a>
      <div class="oppa"></div>
    </div>
  </div>

  <div class="slide outline"></div>

  <section>
    <header>Introduction to Application Protocols</header>

    <div class="slide">
      <hgroup>
        <h1>Application Protocols</h1>
      </hgroup>
      <ul class="x-small">
        <li>Remember this</li>
      </ul>
      <div class="h-drawing" id="19zJkisQOr32yxVeMcXEi7B3fHAtSot0c_ppDJeKl4bc" style="height: 120px; margin-top: -10px">
      </div>
      <ul class="x-small">
        <li>App protocols mostly on top of the TCP Layer</li>
        <ul>
          <li>use TCP socket for communication</li>
        </ul>
        <li>Major protocols</li>
        <ul>
          <li>HTTP &#150; most of the app protocols layered on HTTP</li>
          <ul>
            <li>widely spread</li>
          </ul>
          <li>RMI &#150; Remote Method Invocation</li>
          <ul>
            <li>Java-specific; vendor-interoperability problem</li>
            <li>may use HTTP underneath (among other things)</li>
          </ul>
          <li>XML-RPC and SOAP &#150; Remote Procedure Call and SOAP</li>
          <ul>
            <li>HTTP-based</li>
          </ul>
          <li>WebSocket &#150; new protocol part of HTML5</li>
        </ul>
      </ul>
    </div>

    <div class="slide">
      <hgroup>
        <h1>Anatomy of a Packet</h1>
      </hgroup>
      <img src="img/anatomy-of-a-packet.svg" style="width: 800px; padding: 30px 0px 0px 30px"></img>
    </div>


    <div class="slide">
      <hgroup>
        <h1>Socket</h1>
      </hgroup>
      <div class="h-drawing" style="height: 140px" id="1Z4OmMLdUPPmmfAsENj7zBb_kjDOWVUzku50WucxpePU"></div>
      <ul class="xx-small">
        <li>Handshaking (connection establishment)</li>
        <ul>
          <li>The server listens at <code>[dst_ip,dsp_port]</code></li>
          <li>Three-way handshake:</li>
          <ul>
            <li>the client sends a connection request with TCP flags (SYN, x=rand)</li>
            <li>the server respons with its own TCP flags (SYN ACK, x+1 y=rand)</li>
            <li>the client acknowledges the response, can send data along (ACK, y+1 x+1)</li>
          </ul>
          <li>Result is a socket (virtual communication channel) with unique identification:<br />
            <code>socket=[src_ip,src_port;dst_ip,dst_port]</code>
          </li>
        </ul>
        <li>Data transfer (resource usage)</li>
        <ul>
          <li>Client/server writes/reads data to/from the socket</li>
          <li>TCP features: reliable delivery, correct order of packets, flow control</li>
        </ul>
        <li>Connection close</li>
      </ul>
    </div>

    <div class="slide">
      <hgroup>
        <h1>New Connection Costs</h1>
      </hgroup>
      <ul class="xx-small">
        <li>Creating a new TCP connection is expensive</li>
        <ul>
          <li>It requires to complete a full roundtrip</li>
          <li>It is limited by a network latency, not bandwidth</li>
        </ul>
        <li>Example</li>
        <ul>
          <li>Distance from London to New York is approx. 5500 km</li>
          <li>Communication over a fibre link will take at least 28ms one way</li>
          <li>Three-way handskake will take a minimum of 56ms</li>
        </ul>
        <li>Connection reuse is critical for any app running over TCP</li>
        <ul>
          <li>HTTP Keep-alive</li>
          <li>HTTP pipelining</li>
        </ul>
        <li>TCP Fast Open (TFO)</li>
        <ul>
          <li>TFO allows to speed up the opening of successfive TCP connections</li>
          <li>TCP cookie stored on the client that was established on initial connection</li>
          <li>The client sends the TCP cookie with SYN packet</li>
          <li>The server verifies the TCP cookie and can send the data without final ACK</li>
          <li>Can reduce network transaction latency by 15%</li>
          <li>TFO is supported by Linux in 3.7+ kernels</li>
        </ul>
      </ul>
    </div>

    <div class="slide">
      <hgroup>
        <h1>Addressing in Application Protocol</h1>
      </hgroup>
      <div class="h-drawing" style="height: 220px" id="1a6OhSNel7-1HC-NaWmmkRfIOyQqlvaoXGyJws1rAuZU"></div>
      <ul class="xx-small">
        <li>IP addressing: IP is an address of a machine interface</li>
        <ul>
          <li>A machine can have multiple interfaces (eth0, eth1, bond0, ...)</li>
        </ul>
        <li>TCP addressing: TCP port is an address of an app running on a machine and listening on a machine interface
        </li>
        <ul>
          <li>Multiple applications with different TCP ports may listen on a machine interface</li>
        </ul>
        <li>Application addressing</li>
        <ul>
          <li>Additional mechanisms to address entities within an application</li>
          <li>They are out of scope of IP/TCP, they are app specific</li>
          <ul>
            <li>for example, Web apps served by a single Web server</li>
          </ul>
        </ul>
      </ul>
    </div>

    <!-- <div class="slide outline"></div>

      <div class="slide">
        <hgroup>
          <h1>Blocking (Synchronous) I/O</h1>
        </hgroup>
        <div id="1QP7gZSS1WS3YquzLekSgdZfcmi4BYArm-K9tuWrULQs" class="h-drawing" style="height: 220px"></div>
        <ul class="x-small">
          <li>Inbound connection</li>
          <ul>
            <li>A server creates a thread for every inbound connection</li>
            <li>For example, 1K connections = 1K threads, big overhead</li>
            <li>A thread is reserved for the entire duration of the request processing</li>
          </ul>
          <li>Outbound connection</li>
          <ul>
            <li>A thread is blocked when outbound connection is made</li>
            <li>When outbound connection is slow, the scalability is poor</li>
          </ul>
        </ul>
      </div>

      <div class="slide">
        <hgroup>
          <h1>Non-Blocking (Asynchrnous) I/O</h1>
        </hgroup>
        <div id="1kxkFc3Chl4qFXxH_4f2seuNbpBdENMyZWMRUmxd1p28" class="h-drawing" style="height: 220px"></div>
        <ul class="x-small">
          <li>Inbound connections</li>
          <ul>
            <li>The connection is maintained by the OS, not the server app</li>
            <li>The Web app registers events, OS triggers events when they occur</li>
            <li>The app may create working threads and controls their number</li>
          </ul>
          <li>Outound connections</li>
          <ul>
            <li>The app registers a callback that is called when the data is available</li>
            <li>Event loop</li>
          </ul>
        </ul>
      </div>

    </section> -->
  </section>

  <div class="slide outline"></div>

  <section>
    <header>Introduction to HTTP</header>

    <div class="slide">
      <hgroup>
        <h1>Hypertext Transfer Protocol &ndash; HTTP</h1>
      </hgroup>
      <ul class="small">
        <li>Application protocol, basis of Web architecture</li>
        <ul>
          <li>Part of HTTP, URI, and HTML family</li>
          <li>Request-response protocol</li>
        </ul>
        <li>One socket for single request-response</li>
        <ul>
          <li>original specification</li>
          <li>have changed due to performance issues</li>
          <ul>
            <li>many concurrent requests</li>
            <li>overhead when establishing same connections</li>
            <li>HTTP 1.1 offers persistent connection and pipelining</li>
            <li>Domain sharding</li>
          </ul>
        </ul>
        <li>HTTP is stateless</li>
        <ul>
          <li>Multiple HTTP requests cannot be normally related at the server</li>
          <ul>
            <li>"problems" with state management</li>
            <li>REST goes back to the original HTTP idea</li>
          </ul>
        </ul>
      </ul>
    </div>

    <div class="slide">
      <hgroup>
        <h1>HTTP Request and Response</h1>
      </hgroup>
      <ul class="small">
        <li>Request Syntax</li>
        <pre class="brush: plain; gutter: false">
                    method uri http-version &lt;crlf>
                    (header : value &lt;crlf>)*
                    &lt;crlf>
                    [ data ]
                </pre>
        <li>Response Syntax</li>
        <pre class="brush: plain; gutter: false">
                    http-version response-code [ message ]  &lt;crlf>
                    (header : value &lt;crlf>)*
                    &lt;crlf>
                    [ data ]
                </pre>
        <li>Semantics of terms</li>
        <pre class="brush: plain; gutter: false">
                    method         = "GET" | "POST" | "DELETE" | "PUT" | "HEAD" | "OPTIONS"
                    uri            = [ path ] [ ";" params ] [ "?" query ]
                    http-version   = "HTTP/1.0" | "HTTP/1.1"
                    response-code  = valid response code
                    header : value = valid HTTP header and its value
                    data           = resource state representation (hypertext)
                </pre>
      </ul>
    </div>

    <div class="slide">
      <hgroup>
        <h1>Persistent connections</h1>
      </hgroup>
      <ul class="x-small">
        <li>Persistent HTTP connection = HTTP keepalive</li>
        <ul>
          <li>TCP established connection used for multiple requests/responses</li>
          <li>Avoids TCP three-way handshake to be performed on every request</li>
          <li>Reduces latency</li>
          <li>FIFO queuing order on the client (request queuing)</li>
          <ul>
            <li>dispatch first request, get response, dispatch next request</li>
          </ul>
        </ul>
        <li>Example: <code>GET /html</code>, <code>GET /css</code></li>
        <ul>
          <li>server processing time 40ms and 20ms respectivelly</li>
        </ul>
        <li>Without HTTP keepalive</li>
        <ul>
          <li>three-way handshake 84ms before the data is received on the server</li>
          <li>Response received at 152ms and 132ms respectivelly</li>
          <li>The total time is 284ms</li>
        </ul>
        <li>HTTP keepalive</li>
        <ul>
          <li>One TCP connection for both requests</li>
          <li>In our example this will save one RTT, i.e. 56ms</li>
          <li>The total time will be 228ms</li>
        </ul>
      </ul>
    </div>

    <div class="slide">
      <hgroup>
        <h1>Persistent connections savings</h1>
      </hgroup>
      <ul class="xx-small">
        <li>Each request needs</li>
        <ul>
          <li>Without keepalive, 2 RTT of latency</li>
          <li>With keepalive, the first request needs 2 RTT, a following request needs 1 RTT</li>
        </ul>
        <li>Savings for <code>N</code> requests: <code>(N-1) x RTT</code></li>
        <li>Average value of <code>N</code> is 90 requests for a Web app</li>
        <ul>
          <li>Measured by HTTP Archive (http://httparchive.org) as of 2013</li>
          <li>Average Web application is composed of 90 requests fetched from 15 hosts</li>
          <ul>
            <li>HTML: 10 reuqests</li>
            <li>Images: 55 requests</li>
            <li>Javascript: 15 requests</li>
            <li>CSS: 5 requests</li>
            <li>Other: 5 requests</li>
          </ul>
        </ul>
      </ul>
    </div>

    <div class="slide">
      <hgroup>
        <h1>HTTP pipelining</h1>
      </hgroup>
      <ul class="xx-small">
        <li>Important optimization &ndash; response queuing</li>
        <ul>
          <li>Allows to relecote FIFO queue from the client to the server</li>
        </ul>
        <li>Requests are pipelined one after another</li>
        <ul>
          <li>This allows the server to process requests immediatelly one after another</li>
          <li>This saves one request and response propagation latency</li>
          <li>In our example, the total time will be 172ms</li>
        </ul>
        <li>Parallel processing of requests</li>
        <ul>
          <li>In our example this saves another 20ms of latency</li>
          <li><b>Head of line blocking</b></li>
          <ul>
            <li>Slower response (css with processing time 20ms) must be buffered until
              the first response is generated and sent (no interleaving of responses)</li>
          </ul>
        </ul>
        <li>Issues</li>
        <ul>
          <li>A single slow response blocks all requests behind it</li>
          <li>Buffered (large or many) responses may exhaust server resources</li>
          <li>A failed response may terminate TCP connection</li>
          <ul>
            <li>A client must request all sub-sequent resources again (dupplicate processing)
          </ul>
          <li>Some intermediaries may not support pipelining and abort connection</li>
        </ul>
        <li>HTTP pipelining support today is limited</li>
      </ul>
    </div>

    <div class="slide">
      <hgroup>
        <h1>Multiple TCP connections</h1>
      </hgroup>
      <ul class="xx-small">
        <li>Using only one TCP connection is slow</li>
        <ul>
          <li>Client must queue HTTP requests and process one after another</li>
        </ul>
        <li>Multiple TCP connections work in parallel</li>
        <li><b>There are 6 connections per host</b></li>
        <ul>
          <li>The client can dispatch up to 6 requests in parallel</li>
          <li>The server can process up to 6 requests in parallel</li>
          <li>This is a trade-off between higher request paralellism and the client and server overhead</li>
        </ul>
        <li>The maximum number of connections prevents from DoS attacks</li>
        <ul>
          <li>The client could exhaust server resources</li>
        </ul>
        <li>Domain sharding</li>
        <ul>
          <li>The connection limit as per host (origin)</li>
          <li>There can be multiple origins used in a page</li>
          <ul>
            <li>Each origin has 6 maximum connection limit</li>
          </ul>
          <li>A domain can be sharded</li>
          <ul>
            <li><code>www.example.com</code> &rarr; <code>shard1.example.com</code>, <code>shard2.example.com</code>
            </li>
            <li>Each shard can resolve to the same IP or different IP, it does not matter</li>
          </ul>
          <li>How many shards?</li>
        </ul>
      </ul>
    </div>

    <div class="slide" id="http-request">
      <hgroup>
        <h1>Serving HTTP Request</h1>
      </hgroup>
      <div class="h-drawing" style="height: 180px" id="1c1oNNZgurIxOEDHbnZuPHKR9I-H1VhoeOpTWa6-vslI"></div>
      <ul class="xx-small">
        <li>Serving HTTP request</li>
        <ol>
          <li>User enters URL <code>http://shard1.example.com/orders</code> to the browser</li>
          <li>DNS resolution: browser gets an IP address for <code>shard1.example.com</code></li>
          <li>Three-way handshake: browser and Web Server creates a socket</li>
          <li>Browser sends ACK and HTTP request:</li>
          <pre class="brush: plain; class-name: 'tight'">
                    GET /orders HTTP/1.1
                    Host: shard1.example.com
                    </pre>
          <li>Web server passes the request to the web application <code>shard1.example.com</code> which serves
            <code>GET orders</code> and that writes a response back to the socket.
          </li>
        </ol>
      </ul>
    </div>

    <div class="slide">
      <hgroup>
        <h1>Virtual Host</h1>
      </hgroup>
      <ul class="x-small">
        <li>Virtual host</li>
        <ul>
          <li>Configuration of a named virtual host in a Web server</li>
          <li>Web server uses host request header to distinguish among multiple virtual
            hosts on a single physical host.</li>
        </ul>
        <li>Apache virtual host configuration</li>
        <ul class="x-small">
          <li>Two virtual hosts in a single Web server</li>
          <pre class="brush:plain; class-name: 'tight'">
          # all IP addresses will be used for named virtual hosts
          NameVirtualHost *:80

          &lt;VirtualHost *:80>
                  ServerName www.example.com
                  ServerAlias shard1.example.com shard2.example.com
                  ServerAdmin admin@example.com
                  DocumentRoot /var/www/apache/example.com
          &lt;/VirtualHost>

          &lt;VirtualHost *:80>
                  ServerName company.cz
                  ServerAdmin admin@firm.cz
                  DocumentRoot /var/www/apache/company.cz
          &lt;/VirtualHost></pre>
        </ul>
      </ul>
    </div>

    <div class="slide" id="curl">
      <hgroup>
        <h1>Better Support for HTTP Testing</h1>
      </hgroup>
      <ul class="x-small">
        <li>Use <code>curl</code> to test HTTP protocol</li>
        <pre class="brush: plain; class-name: 'tight'">
                    Usage: curl [options...] &lt;url>

                    -X/--request &ltcommand>          Specify request command to use
                    -H/--header &lt;line>              Custom header to pass to server
                    -d/--data &lt;data>                HTTP POST data
                    -b/--cookie &lt;name=string/file>  Cookie string or file to read cookies from
                    -v/--verbose                    Make the operation more talkative
                </pre>
        <li>Example</li>
        <pre class="brush: plain; class-name: 'tight'">
                    curl -v -H "Host: company.cz"  127.0.0.1:8080

                    * About to connect() to 127.0.0.1 port 8080
                    *   Trying 127.0.0.1... connected
                    * Connected to 127.0.0.1 port 8080
                    &gt; GET / HTTP/1.1
                    &gt; User-Agent: curl/7.20.0 (i386-apple-darwin10.3.2) libcurl/7.20.0 OpenSSL/0.9.8n
                    &gt; Accept: */*
                    &gt; Host: company.cz
                    &gt;
                    &lt; HTTP/1.1 201 OK
                    &lt; Connection: keep-alive
                    &lt; Content-Type: plain/text
                    &lt;
                    &lt; This is the response...
                </pre>
      </ul>
    </div>

    <div class="slide outline"></div>

    <section>
      <header>State Management</header>

      <div class="slide" id="state-management">
        <hgroup>
          <h1>State Management</h1>
        </hgroup>
        <ul class="small">
          <li>HTTP is a stateless protocol &#150; original design</li>
          <ul>
            <li>No information to relate multiple interactions at server-side</li>
            <ul>
              <li>Except <code>Authorization</code> header is copied in every request</li>
              <li>IP addresses do not work, one public IP can be shared by multiple clients</li>
            </ul>
          </ul>
          <li>Solutions to check for a valid state at server-side</li>
          <ul>
            <li><b>Cookies</b> &ndash; obvious and the most common workaround</li>
            <ul>
              <li><span class="h-ref" id="rfc-2109">RFC 2109 &ndash; HTTP State Management Mechanism</span></li>
              <li>Allow clients and servers to talk in a context called <b>sessions</b></li>
            </ul>
            <li><b>Hypertext</b> &ndash; original HTTP design principle</li>
            <ul>
              <li>App states represented by resources (hypermedia), links define transitions between states</li>
              <li>Adopted by the REST principle <b>statelessness</b></li>
            </ul>
          </ul>
        </ul>
      </div>

      <div class="slide">
        <hgroup>
          <h1>Interaction with Cookies</h1>
        </hgroup>
        <ul class="small">
          <li>Request-response interaction with cookies</li>
          <ul>
            <li>Session is a logical channel maintained by the server</li>
          </ul>
          <div class="h-drawing" style="height: 250px" id="1mVCe8EtqVApZVRV_RHYQKtqDNELKdo84qzCqGvAs7iA"></div>
          <li>Stateful Server</li>
          <ul>
            <li>Server remembers the session information in a server memory</li>
            <li>Server memory is a non-persistent storage, when server restarts the memory content is lost!</li>
          </ul>
        </ul>
      </div>

      <div class="slide">
        <hgroup>
          <h1>Set-Cookie and Cookie Headers</h1>
        </hgroup>
        <ul class="xx-small">
          <li><code>Set-Cookie</code> response header</li>
          <pre class="brush: plain; ">
                        set-cookie = "Set-Cookie:" cookie ("," cookie)*
                          cookie    = NAME "=" VALUE (";" cookie-av)*
                          cookie-av = "Comment" "=" value
                                    | "Domain" "=" value
                                    | "Max-Age" "=" value
                                    | "Path" "=" value
                    </pre>
          <ul>
            <li><code>domain</code> &ndash; a domain for which the cookie is applied</li>
            <li><code>Max-Age</code> &ndash; number of seconds the cookie is valid</li>
            <li><code>Path</code> &ndash; URL path for which the cookie is applied</li>
          </ul>
          <li><code>Cookie</code> request header. A client sends the cookie in a request if:</li>
          <ul>
            <li><code>domain</code> matches the origin server's fully-qualified host name</li>
            <li><code>path</code> matches a prefix of the request-URI</li>
            <li><code>Max-Age</code> has not expired</li>
          </ul>
          <pre class="brush: plain;">
                        cookie  = "Cookie:" cookie-value (";" cookie-value)*
                          cookie-value    = NAME "=" VALUE [";" path] [";" domain]
                          path            = "$Path" "=" value
                          domain          = "$Domain" "=" value
                    </pre>
          <ul>
            <li><code>domain</code>, and <code>path</code> are values from corresponding attributes of
              the <code>Set-Cookie</code> header</li>
          </ul>

        </ul>
      </div>

    </section>
  </section>

  <div class="slide outline"></div>

  <section>
    <header>Security</header>

    <div class="slide">
      <hgroup>
        <h1>Web Service Security Concepts</h1>
      </hgroup>
      <ul class="x-small">
        <li>Securing the client-server communcation</li>
        <ul>
          <li>Message-level security</li>
          <li>Transport-level security</li>
        </ul>
        <li>Ensure</li>
        <ul>
          <li>Authentication &ndash; verify a client's identity</li>
          <li>Authorizaton &ndash; rights to access resources</li>
          <li>Message Confidentiality &ndash; keep message content secret</li>
          <li>Message Integrity &ndash; message content does not change during transmission</li>
          <li>Non-repudiation &ndash; proof of integrity and origin of data</li>
        </ul>
        <div class="h-drawing" style="height: 190px; margin-top: 30px"
          id="1JhEX5OGpHhQY49mxA4-r7taripW6bkWwLCu94BU9QFI"></div>
      </ul>
    </div>

    <div class="slide">
      <hgroup>
        <h1>Basic Access Authentication</h1>
      </hgroup>
      <div class="h-drawing" style="height: 280px" id="1OYyQduAQYodoiQ48uYTCB1iVn6UHcCcdDocjLOA9b9Y"></div>
      <ul class="x-small">
        <li>Realm</li>
        <ul>
          <li>an identifier of the space on the server (~ a collection of resources and their sub-resources)</li>
          <li>A client may associate a valid credentials with realms such that it copies authorization information
            in requests for which server requires authentication (by <code>WWW-Authenticate</code> header)</li>
        </ul>
    </div>

    <div class="slide">
      <hgroup>
        <h1>Basic Access Authentication &ndash; Credentials</h1>
      </hgroup>
      <ul class="small">
        <li>Credentials</li>
        <ul>
          <li>credentials are base64 encoded</li>
          <li>the format is: <code>username:password</code></li>
        </ul>
        <pre class="brush: bash">
						# to encode in linux
						echo "novak:heslo" | base64
						> bm92YWs6aGVzbG8K

						# and to decode
						echo "bm92YWs6aGVzbG8K" | base64 -d # use capital "D" in OS X
						> novak:heslo</pre>

        <li>Comments</li>
        <ul class="x-small">
          <li>When TLS is not used, the password can be read</li>
          <li>An attacker can repeat interactions</li>
        </ul>
      </ul>

    </div>

    <div class="slide">
      <hgroup>
        <h1>Digest Access Authentication</h1>
      </hgroup>
      <ul class="xx-small">
        <li>RFC 2617 &ndash; Basic and Digest Access Authentication</li>
        <ul>
          <li>No password between a client and a server but a hash value</li>
          <li>Simple and advanced mechanisms (only server-generated nonce value &ndash; replay-attacks or
            with client-generated nonce value)</li>
        </ul>
        <li>Basic Steps</li>
        <ol>
          <li>Client accesses a protected area</li>
          <pre class="brush:bash; class-name: 'tight'">
							> GET / HTTP/1.1</pre>
          <li>Server requests authentication with <code>WWW-Authenticate</code></li>
          <pre class="brush:bash; class-name: 'tight'">
								&lt; HTTP/1.1 401 Unauthorized
								&lt; WWW-Authenticate: Digest realm="ProtectedArea",
								  nonce="BbdQof3DBAA=a293ff3d724989371610f03015f2d23f3cd2c045",
								  algorithm=MD5, domain="/", qop="auth"</pre>
          <li>Client calculates a response hash by using the realm, his/her username, the password, and the
            quality of protection (QoP) and requests the resource with <code>authorization</code> header</li>
          <pre class="brush:bash; class-name: 'tight'">
								> GET / HTTP/1.1
								> Authorization: Digest username="novak", realm="ProtectedArea",
								  nonce="BbdQof3DBAA=a293ff3d724989371610f03015f2d23f3cd2c045", uri="/",
								  algorithm=MD5, response="c4ea2293aeb318826d1e533f363efd90", qop=auth,
								  nc=00000001, cnonce="531ee8ba7f2a8fd1"</pre>
        </ol>
      </ul>
    </div>

    <div class="slide">
      <hgroup>
        <h1>Transport Level Security</h1>
      </hgroup>
      <ul class="x-small">
        <li>SSL and TLS</li>
        <ul>
          <li>SSL and TLS is used interchangeably</li>
          <li>SSL 3.0 developed by Netscape</li>
          <li>IETF standardization of SSL 3.0 is TLS 1.0</li>
          <ul>
            <li>TLS 1.0 is upgrade of SSL 3.0</li>
          </ul>
          <li>Due to security flaws in TLS 1.0, TLS 1.1 and TLS 1.2 were created</li>
        </ul>
        <li>TLS layer</li>
        <img src="img/TLS.png" style="height: 250px" />
      </ul>
    </div>

    <div class="slide">
      <hgroup>
        <h1>TLS Services</h1>
      </hgroup>
      <ul class="xx-small">
        <li>Encryption</li>
        <ul>
          <li>Peers must agree on ciphersuite and keys</li>
          <li>This is achieved by <b>TLS handshake</b></li>
        </ul>
        <li>Authentication</li>
        <ul>
          <li>Peers can authenticate their identity</li>
          <ul>
            <li>The client can verify that the server is who it is claimed to be</li>
            <li>Achieved by "Chain of Trust and Certificate Authoritites"</li>
            <li>The server can also verify the client</li>
          </ul>
        </ul>
        <li>Integrity</li>
        <ul>
          <li>TLS provives message framing mechanism</li>
          <li>Every message is signed with Message Authentication Code (MAC)</li>
          <ul>
            <li>MAC hashes data in a message and combines the resulting hash with a key (negotiated during the TLS
              handshake)</li>
            <li>The result is a message authentication code sent with the message</li>
          </ul>
        </ul>
      </ul>
    </div>

    <div class="slide">
      <hgroup>
        <h1>TLS Handshake Protocol</h1>
      </hgroup>
      <img src="img/tls-handshake.png" style="padding-top: 10px; padding-left: 20px; height: 300px" />
      <ul class="xx-small">
        <li>TLS Handshake</li>
        <ul>
          <li class="no-bullet">56 ms: ClientHello, TLS protocol version, list of ciphersuites, TLS options</li>
          <li class="no-bullet">84 ms: ServerHello, TLS protocol version, ciphersuite, certificate</li>
          <li class="no-bullet">112 ms: RSA or Diffie-Hellman key exchange</li>
          <li class="no-bullet">140 ms: Message integrity checks, sends encrypted "Finished" message</li>
          <li class="no-bullet">168 ms: Decrypts the message, app data can be sent</li>
        </ul>
      </ul>
    </div>

    <div class="slide">
      <hgroup>
        <h1>Key Exchange</h1>
      </hgroup>
      <ul class="xx-small">
        <li>RSA key exhange(Rivest–Shamir–Adleman)</li>
        <ul>
          <li>The client generates a symetric key</li>
          <li>The client encrypts the key with the server's public key</li>
          <li>The client sends the encrpyed key to the server</li>
          <li>The server uses its private key to decrypt the symetric key</li>
        </ul>
        <li>RSA critical weekness</li>
        <ul>
          <li>The same public-private key pair is used to:</li>
          <ul>
            <li>authenticate the server (the server's private key is used to sign and verify the handshake)</li>
            <li>encrypt the symetric key</li>
          </ul>
          <li>When an attacker gets hold of the server private key</li>
          <ul>
            <li>It can decrypt the entire session</li>
          </ul>
        </ul>
        <li>Diffie-Hellman key exhange</li>
        <ul>
          <li>Client and server can negoriate shared secret without its explicit communication</li>
          <ul>
            <li>Attacker cannot get the key</li>
          </ul>
          <li>Reduction of risk of compromising of the past communications</li>
          <ul>
            <li>New key can be generated as part of every key exchange</li>
            <li>Old keys can be discarded</li>
          </ul>
        </ul>
      </ul>
    </div>

    <div class="slide">
      <hgroup>
        <h1>TLS and Proxy Servers</h1>
      </hgroup>
      <ul class="xx-small">
        <li>TLS Offloading</li>
        <ul>
          <li>Inbound TLS connection, plain outbound connection</li>
          <li>Proxy can inspect messages</li>
        </ul>
        <li>TLS Bridging</li>
        <ul>
          <li>Inbound TLS connection, new outbound TLS connection</li>
          <li>Proxy can inspect messages</li>
        </ul>
        <li>End-to-End TLS (TLS pass-through)</li>
        <ul>
          <li>TLS connection is passed-through the proxy</li>
          <li>Proxy cannot inspect messages</li>
        </ul>
        <li>Load balancer</li>
        <ul>
          <li>Can use TLS offloading or TLS bridging</li>
          <li>Can use TLS pass-through with help of Server Name Indication (SNI)</li>
        </ul>
      </ul>
    </div>


  </section>


</body>