Network Security Basics: SSL, TLS, and Cryptography Fundamentals

 Network Security kya hai? (What is Network Security?)

• Jab internet par data ek computer se doosre computer tak travel karta hai, toh wo darjano public routers, undersea cables aur Wi-Fi access points se hokar guzarta hai.

• Agar transmission secure na ho, toh koi bhi malicious attacker packet sniffing karke data read kar sakta hai (Confidentiality loss), data ko modify kar sakta hai (Integrity loss), ya fake identity create karke attack kar sakta hai (Authentication failure).

• Network Security policies, protocols, aur cryptographic techniques ka wo set hai jo data aur network resources ko unauthorized access, misuse, aur attacks se protect karta hai.

 1. The CIA Triad of Security

Information security teen core principles par khadi hai jise CIA Triad kehte hain:

   +------------------------+
   | The CIA Security Triad |
   +------------------------+
               |
  +----------------------+--------------------+
  |                      |                    |
[ Confidentiality ]   [ Integrity ]         [ Availability ]
(Only authorized read) (No unauthorized edit) (System is always accessible)

1. Confidentiality (Gopniyata): Sirf intended receiver hi message ko read kar sake. Iske liye Encryption (Cryptography) use hoti hai.
2. Integrity (Akhandata): Transmission ke dauran data mein koi unauthorized change ya alteration na hua ho. Iske liye Cryptographic Hashes (SHA-256) use hote hain.
3. Availability (Uplabdhata): Network services authorized users ke liye hamesha accessible aur operational rahein (DDoS attacks se protect karke).
(Saath hi Non-Repudiation ensure karta hai ki sender baad mein mukar na sake ki usne message bheja tha, using Digital Signatures).

 2. Cryptography Fundamentals: Symmetric vs Asymmetric

 3. SSL and TLS Protocols (Secure Sockets Layer & Transport Layer Security)

• SSL (Secure Sockets Layer) 1990s mein Netscape ne banaya tha. SSL ke puraane versions (SSL 2.0, 3.0) mein security vulnerabilities aane ke baad IETF ne ise standardize karke naya naam diya: TLS (Transport Layer Security).

• Modern internet par sirf TLS 1.2 aur TLS 1.3 use hote hain (SSL ab officially obsolete ho chuka hai, lekin log bolchal mein abhi bhi SSL/TLS bolte hain).

• TLS OSI Model mein Application Layer aur Transport Layer ke beech baithta hai.

The TLS Handshake Protocol:

HTTPS connection shuru hone se pehle TLS Handshake perform hota hai:

Client (Browser) Server (Website)
| |
|====== 1. ClientHello (TLS version, Cipher suites supported) =====>|
| |
|<===== 2. ServerHello (Chosen cipher suite) =======================|
|<===== 3. Certificate (Server's Public Key signed by CA) ==========|
|<===== 4. ServerKeyExchange + ServerHelloDone =====================| | | | (Client verifies Certificate with trusted Root CA) | | | |====== 5. ClientKeyExchange (Pre-master secret encrypted) =========>|
|====== 6. ChangeCipherSpec + Finished =============================>|
| |
|<===== 7. ChangeCipherSpec + Finished =============================|
| |
<================ Secure Encrypted Symmetric Session Active =========>

Best of Both Worlds (Hybrid Cryptography):
TLS dono cryptographic types ko combine karta hai: Handshake ke dauran authentication aur key exchange ke liye Asymmetric (RSA/ECC) use karta hai, aur ek baar secret session key tay hone ke baad actual bulk data transmission ke liye super-fast Symmetric (AES) encryption use karta hai!

 Summary Table