HTTPS, TLS and certificates
Cyber security Lesson 12 2:05 English narration · English + 中文 subtitles burned in
Chapters
Transcript
Start with something you look at every day.
先从你天天都在看的东西说起。
When the address begins with H T T P S and a padlock appears, your connection to that site is encrypted — nobody sitting in between can read it.
当网址以 HTTPS 开头、旁边出现一把小锁时， 你和那个网站之间的连接是加密的—— 夹在中间的人读不到任何东西。
The S stands for Secure, and the protocol doing the work is called T L S, the modern version of S S L.
S 代表 Secure，也就是安全， 而在背后干活的协议叫 TLS，是 SSL 的现代版本。
Without the S, every word travels readable.
少了那个 S，每一个字都是明文在路上跑。
Here is the sequence the exam asks for, and it uses both kinds of encryption you have learned.
这就是考试要考的那串顺序， 而且它把你学过的两种加密都用上了。
One: the server sends its certificate.
第一：服务器发来它的证书。
Two: your browser checks the signature on it.
第二：你的浏览器核对证书上的签名。
Three: the two sides use asymmetric encryption to agree a shared secret key.
第三：双方用非对称加密协商出一把共享的密钥。
Four: they switch to fast symmetric encryption for the rest of the conversation.
第四：之后的对话改用快速的对称加密来承载。
All of it finishes before any page loads.
这一切都在页面开始加载之前就跑完了。
But encryption alone is useless if you are talking to an impostor — you would simply be whispering your password to the wrong person very securely.
但只有加密是不够的，如果你对话的对象根本是个冒牌货—— 那你不过是很安全地把密码悄悄告诉了错的人。
That is what certificates solve.
证书解决的就是这件事。
A trusted Certificate Authority signs the website's certificate; the site presents it; your browser checks the signature.
一个受信任的证书颁发机构给网站的证书签名； 网站把它出示给你；你的浏览器核对那个签名。
If it is valid, the site is who it claims to be.
签名有效，就说明这个网站确实是它自称的那个。
So the padlock answers two questions at once.
所以那把小锁一次回答了两个问题。
The certificate proves WHO you are talking to.
证书证明"你在跟谁说话"。
T L S keeps WHAT you say secret.
TLS 保证"你说的内容"是保密的。
You need both — either one alone leaves a hole.
两者缺一不可——少哪一个都留着窟窿。
And the practical rule that follows: no padlock on a login page?
由此得出的实用规则是： 登录页上没有那把锁？
Walk away.
走人。
Four things to take with you.
带走四点。
One: H T T P S encrypts the traffic using T L S.
第一：HTTPS 用 TLS 把流量加密。
Two: the handshake agrees a key, then goes symmetric.
第二：握手先协商出密钥，然后转成对称加密。
Three: the certificate proves the site's identity.
第三：证书证明的是网站的身份。
Four: never click through a certificate warning.
第四：绝不要点掉证书警告继续访问。
Now put the handshake in order in the task below.
现在去下面的题里把握手步骤排好顺序。