Secure socket layer (SSL) protocol

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What does SSL do to data sent between a browser and a web server?

A It encrypts the data so it cannot be understood if intercepted

B It deletes the data after it has been sent

2. Which web address shows that a site is using an SSL/TLS secure connection?

A http://www.mybank.com

B https://www.mybank.com

3. SSL creates an encrypted session between which two devices?

A A keyboard and a monitor

B A browser and a web server

4. Which activity should always use SSL to protect the data?

A Entering card details to pay online

B Reading a printed timetable at school

5. What is the relationship between SSL and TLS?

A TLS is the newer successor to SSL

B TLS is a type of malware that attacks SSL

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1https://www.myschool.com/login		ASSL encrypts the data, so intercepted data is scrambled and cannot be understood without the decryption key
2SSL -> TLS		BThe https:// at the start shows the page uses SSL/TLS, so data sent between the browser and the server is encrypted
3SSL encrypts data sent between a browser and a web server, so intercepted data cannot be understood		CSent: password123 -> Intercepted: x9Fq#2LpZ8
4SSL is used where sensitive data is sent, such as logins and online payments		DSSL has been replaced by its newer, more secure successor, TLS, though people still say SSL
5A hacker intercepts SSL data and reads the password easily		Ehttp:// does not use SSL, so the data is not encrypted. A secure SSL page should start with https://
6http://mybank.com/login (secure SSL page)		Fhttps://shop.com/checkout?card=enter

Definitions

SSL

Fill in the Blanks

Complete each line of code by filling in the missing parts.

_____://www.mybank.com/login

SSL stands for Secure ______ Layer

SSL ________ data between browser and server

SSL was replaced by its successor, ___

Data is sent in an encrypted _______

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A url ← "https://bank.com"

B prefix ← LEFT(url, 5)

C IF prefix = "https://" THEN

D OUTPUT "SSL is protecting you"

Question 2

A OUTPUT "Enter card number"

B INPUT card

C encrypted ← SSL_ENCRYPT(card)

D SEND card TO server

Question 3

A session ← START_SSL(server)

B key ← session.KEY

C data ← DECRYPT(msg, key)

D SEND data TO server

Question 4

A IF url STARTS "http://" THEN

B OUTPUT "SSL in use"

C ELSE

D OUTPUT "Data not encrypted"

Question 5

A old ← "SSL"

B successor ← "DNS"

C OUTPUT old, "replaced by", successor

D OUTPUT "Both encrypt data"

Answer Key

Secure socket layer (SSL) protocol

Section A: Quick Questions

A — It encrypts the data so it cannot be understood if intercepted

B — https://www.mybank.com

B — A browser and a web server

A — Entering card details to pay online

A — TLS is the newer successor to SSL

Section B: Match the Pairs

https://www.myschool.com/login → The https:// at the start shows the page uses SSL/TLS, so data sent between the browser and the server is encrypted

SSL -> TLS → SSL has been replaced by its newer, more secure successor, TLS, though people still say SSL

SSL encrypts data sent between a browser and a web server, so intercepted data cannot be understood → Sent: password123 -> Intercepted: x9Fq#2LpZ8

SSL is used where sensitive data is sent, such as logins and online payments → https://shop.com/checkout?card=enter

A hacker intercepts SSL data and reads the password easily → SSL encrypts the data, so intercepted data is scrambled and cannot be understood without the decryption key

http://mybank.com/login (secure SSL page) → http:// does not use SSL, so the data is not encrypted. A secure SSL page should start with https://

Section C: Definitions

SSL — Secure Socket Layer: a security protocol that encrypts data between a browser and web server, so intercepted data cannot be read. Used for logins and payments. TLS is its successor.

Section D: Fill in the Blanks

https://www.mybank.com/login

SSL stands for Secure Socket Layer

SSL encrypts data between browser and server

SSL was replaced by its successor, TLS

Data is sent in an encrypted session

Section E: Spot the Error

B — "https://" is 8 characters long. Taking only 5 gives "https", which never equals "https://", so the SSL check fails. It should be LEFT(url, 8).

D — The card number was encrypted on the previous line but the plain text is sent instead. Anyone intercepting it could read it. It should send the encrypted value: SEND encrypted TO server.

C — Data must be encrypted before it is sent. DECRYPT would try to unscramble a plain message. It should be ENCRYPT(msg, key).

A — A URL starting with http:// is not protected by SSL/TLS. The SSL check must test for "https://", where the s means secure.

B — The successor to SSL is TLS (Transport Layer Security). DNS translates domain names to IP addresses and is not an encryption protocol. It should be successor ← "TLS".