{"id":19935806,"url":"https://github.com/alonza0314/ssl-tls-openziti-encryption-study","last_synced_at":"2026-05-14T19:31:41.838Z","repository":{"id":252851521,"uuid":"841649462","full_name":"Alonza0314/SSL-TLS-OpenZiti-Encryption-Study","owner":"Alonza0314","description":"A simple security research focuses on SSL and TLS, and further analyzes the data transmission encryption and decryption process within the OpenZiti architecture.","archived":false,"fork":false,"pushed_at":"2024-08-30T13:37:35.000Z","size":472,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-01-12T02:37:50.575Z","etag":null,"topics":["crypto","golang","openziti","rfc","ssl","tls","ziti"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Alonza0314.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-08-12T20:42:18.000Z","updated_at":"2024-09-09T08:39:54.000Z","dependencies_parsed_at":"2024-11-12T23:25:56.165Z","dependency_job_id":"b2147755-6f11-4748-9cb4-f309c5a7c37e","html_url":"https://github.com/Alonza0314/SSL-TLS-OpenZiti-Encryption-Study","commit_stats":null,"previous_names":["alonza0314/ssl-tls-research","alonza0314/ssl-tls-openziti-encryption-study"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Alonza0314%2FSSL-TLS-OpenZiti-Encryption-Study","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Alonza0314%2FSSL-TLS-OpenZiti-Encryption-Study/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Alonza0314%2FSSL-TLS-OpenZiti-Encryption-Study/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Alonza0314%2FSSL-TLS-OpenZiti-Encryption-Study/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Alonza0314","download_url":"https://codeload.github.com/Alonza0314/SSL-TLS-OpenZiti-Encryption-Study/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":241361749,"owners_count":19950443,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["crypto","golang","openziti","rfc","ssl","tls","ziti"],"created_at":"2024-11-12T23:22:08.665Z","updated_at":"2026-05-14T19:31:41.798Z","avatar_url":"https://github.com/Alonza0314.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# SSL-TLS-OpenZiti-Encryption-Study\n\n## Index\n\n[Abstract](#abstract)\n\n[Basic Concept](#basic-concept)\n\n[Encryption Method](#encryption-method)\n\n[SSL (Secure Sockets Layer)](#ssl-secure-sockets-layer)\n\n[TLS (Transport Layer Security)](#tls-transport-layer-security)\n\n[Ziti's Data Encryption and Decryption](#zitis-data-encryption-and-decryption)\n\n[Reference](#reference)\n\n## Abstract\n\nIn advance, I will give a basic introduction on the historical development of SSL and TLS and their significance in network security.\n\nThen, I will demonstrate a simple ziti's data encryption and decryption simulation.\n\n## Basic Concept\n\n### Introduction\n\n+ SSL (Secure Sockets Layer): An early encryption protocol developed by Netscape, which has now been replaced by TLS.\n+ TLS (Transport Layer Security): The successor to SSL, providing a more secure encryption protocol.\n\n### Core Concepts\n\n+ Encryption: Ensures that data is not intercepted or altered during transmission.\n+ Authentication: Ensures the trustworthiness of the communicating parties.\n+ Data Integrity: Ensures that data is not modified during transmission.\n\n## Encryption Method\n\n### Symmetric and Asymmetric Encryption\n\n+ Symmetric Encryption: Uses the same key for both encryption and decryption (e.g., [DES](https://l2x.gitbooks.io/understanding-cryptography/content/docs/chapter-1/des.html) \\ [AES](https://l2x.gitbooks.io/understanding-cryptography/content/docs/chapter-1/aes.html)).\n  ![symmetricEncryption](static/zitiImg/symmetricEncyrption.avif)\n+ Asymmetric Encryption: Uses a pair of public and private keys for encryption and decryption (e.g., [RSA](https://l2x.gitbooks.io/understanding-cryptography/content/docs/chapter-3/rsa.html)).\n  ![asymmetricEncryption](static/zitiImg/asymmetricEncryption.avif)\n\n### Key Exchange\n\n+ Key Exchange Protocol: Ensure secure exchange of symmtric encryption key (e.g., [Diffie-Hellman](https://developer.aliyun.com/article/952796)).\n\n---\n\n## SSL (Secure Sockets Layer)\n\n### SSL 1.0\n\n+ Description: Never publicly released due to serious security issues.\n\n### SSL 2.0\n\n+ Improvements:\n  + Introduced basic encryption mechanisms.\nSupported symmetric encryption and digital certificates.\n+ Vulnerabilities:\n  + Several known security vulnerabilities, such as insecure key exchange mechanisms.\n  + Did not support Message Authentication Codes (MACs) to verify data integrity.\n\n### SSL 3.0\n\n+ Improvements:\n  + Addressed multiple security issues from SSL 2.0, improving encryption algorithms and protocol design.\n  + Introduced a more secure handshake process.\n  + Supported Message Authentication Codes (MACs), enhancing data integrity protection.\n+ Vulnerabilities:\n  + Despite improvements in security, SSL 3.0 still had some issues, such as the [POODLE attack](https://www.acunetix.com/blog/web-security-zone/what-is-poodle-attack/).\n\n## TLS (Transport Layer Security)\n\n### TLS 1.0 (RFC 2246)\n\n+ Improvements:\n  + Added support for HMAC (Hash-based Message Authentication Code).\n+ Vulnerabilities:\n  + Still had some security issues, such as the [CRIME and BEAST attacks](https://www.infosecinstitute.com/resources/hacking/beast-vs-crime-attack/).\n\n### TLS 1.1 (RFC 4346)\n\n+ Improvements:\n  + Prevented packet replay attacks by adding IV (Initialization Vector) randomization.\n  + Enhanced security for symmetric encryption modes, supporting AES encryption.\n+ Vulnerabilities:\n  + Improved over TLS 1.0 but still had some known security risks, such as the [Lucky Thirteen attack](https://medium.com/@c0D3M/lucky-13-attack-explained-dd9a9fd42fa6).\n\n### TLS 1.2 (RFC5246)\n\n+ Improvements:\n  + Introduced new message authentication algorithms (e.g., SHA-256).\n  + Supported stronger encryption algorithms (e.g., AES-GCM).\n  + Improved integrity protection mechanisms.\n  + Enhanced compatibility with older versions.\n+ Vulnerabilities:\n  + Although TLS 1.2 provided many security improvements, it still faced some attack threats, such as the [POODLE attack](https://www.acunetix.com/blog/web-security-zone/what-is-poodle-attack/).\n+ Handshake Overview:\n  ![TLS12](static/zitiImg/tls12.png)\n  1. **ClientHello**: TLS version, cipher suite, client random number, compression method.\n  2. **ServerHello**: TLS version, cipher suite, server random number, additional information.\n  3. **ServerCertificate**: Certificate, public key(RSA).\n  4. **ServerKeyExchange**: Public key(DH), parameter(DH).\n  5. **CertificateRequest**: Optional.\n  6. **ServerHelloDone**: Ending mark.\n  7. **ClientCertificate**: Certificate(if requested by server), public key.\n  8. **ClientKeyExchange**: Pre-master secret key(RSA, encrypted by server's public key), public key(DH).\n  9. **CertificateVerify**: Verify possession of the private key in the certificate.\n  10. **ChangeCipherSpec**: Use new encryption method.\n  11. **Finished**: Ending mark.\n\n### TLS 1.3 (RFC8446)\n\n+ Improvements:\n  + Simplified the handshake process, reducing round trips and improving performance.\n  + Defaulted to Perfect Forward Secrecy (PFS).\n  + Removed outdated and insecure encryption algorithms and protocol features (e.g., RC4, MD5, SHA-1).\n  + Enhanced data encryption and authentication, providing stronger security assurances.\n+ Vulnerabilities:\n  + TLS 1.3 was designed with a focus on security, and currently has no major security vulnerabilities, though it continues to be reviewed and improved.\n+ Handshake Overview:\n  ![TLS13](static/zitiImg/tls13.png)\n\n---\n\n## Ziti's Data Encryption and Decryption\n\nClick here: [Model Description](ziti/README.md)\n\nClick here: [Model Simulation](simulation/README.md)\n\n---\n\n## Reference\n\n[Transport Layer Security](https://en.wikipedia.org/wiki/Transport_Layer_Security)\n\n[Secure101](https://simular.co/blog/post/21-%E4%B8%80%E7%AF%87%E6%96%87%E7%AB%A0%E7%9C%8B%E6%87%82%E4%BB%80%E9%BA%BC%E6%98%AFssl)\n\n[SSL/TLS and PKI History](https://www.feistyduck.com/ssl-tls-and-pki-history/)\n\n[RFC5246](https://www.rfc-editor.org/rfc/rfc5246)\n\n[RFC8446](https://www.rfc-editor.org/rfc/rfc8446)\n\n[ChatGPT](https://openai.com/chatgpt/)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falonza0314%2Fssl-tls-openziti-encryption-study","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Falonza0314%2Fssl-tls-openziti-encryption-study","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falonza0314%2Fssl-tls-openziti-encryption-study/lists"}