What is SSL?

Original Source http://www.tldp.org/HOWTO/SSL-Certificates-HOWTO/x64.html This has exact information at the mentioned site and includes some extra detail for my understanding. This is personal note.
............................................................................................................
The Secure Socket Layer protocol was created to ensure secure transactions between web servers and browsers. The protocol uses a third party, a Certificate Authority (CA), to identify one end or both end of the transactions. This is in short how it works.

1. A browser requests a secure page (usually https://).
2.The web server sends its public key with its certificate.
3.The browser checks that the certificate was issued by a trusted party (usually a trusted root CA),    that the certificate is still valid and that the certificate is related to the site contacted.
4.The browser then uses the public key, to encrypt a random symmetric encryption key and sends it to the server with the encrypted URL required as well as other encrypted http data.
 5.The web server decrypts the symmetric encryption key using its private key and uses the symmetric key to decrypt the URL and http data.
  6.The web server sends back the requested html document and http data encrypted with the symmetric key.
  7.The browser decrypts the http data and html document using the symmetric key and displays the information.

Several concepts have to be understood here.

Private Key/Public Key:

The encryption using a private key/public key pair ensures that the data can be encrypted by one key but can only be decrypted by the other key pair. This is sometime hard to understand, but believe me it works. The keys are similar in nature and can be used alternatively: what one key encrypts, the other key pair can decrypt. The key pair is based on prime numbers and their length in terms of bits ensures the difficulty of being able to decrypt the message without the key pairs. The trick in a key pair is to keep one key secret (the private key) and to distribute the other key (the public key) to everybody. Anybody can send you an encrypted message, that only you will be able to decrypt. You are the only one to have the other key pair, right? In the opposite , you can certify that a message is only coming from you, because you have encrypted it with you private key, and only the associated public key will decrypt it correctly. Beware, in this case the message is not secured you have only signed it. Everybody has the public key, remember!
One of the problem left is to know the public key of your correspondent. Usually you will ask him to send you a non confidential signed message that will contains his publick key as well as a certificate.

Message-->[Public Key]-->Encrypted Message-->[Private Key]-->Message
and

Message-->[Private Key]-->Encrypted Message-->[Public Key]-->Message

The Certificate:

How do you know that you are dealing with the right person or rather the right web site. Well, someone has taken great length (if they are serious) to ensure that the web site owners are who they claim to be. This someone, you have to implicitly trust: you have his/her certificate loaded in your browser (a root Certificate). A certificate, contains information about the owner of the certificate, like e-mail address, owner's name, certificate usage, duration of validity, resource location or Distinguished Name (DN) which includes the Common Name (CN) (web site address or e-mail address depending of the usage) and the certificate ID of the person who certifies (signs) this information. It contains also the public key and finally a hash to ensure that the certificate has not been tampered with. As you made the choice to trust the person who signs this certificate, therefore you also trust this certificate. This is a certificate trust tree or certificate path. Usually your browser or application has already loaded the root certificate of well known Certification Authorities (CA) or root CA Certificates. The CA maintains a list of all signed certificates as well as a list of revoked certificates. A certificate is insecure until it is signed, as only a signed certificate cannot be modified. You can sign a certificate using itself, it is called a self signed certificate. All root CA certificates are self signed.
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        Signature Algorithm: md5WithRSAEncryption
        Issuer: C=FJ, ST=Fiji, L=Suva, O=SOPAC, OU=ICT, CN=SOPAC Root CA/Email=administrator@example.org
        Validity
            Not Before: Nov 20 05:47:44 2001 GMT
            Not After : Nov 20 05:47:44 2002 GMT
        Subject: C=FJ, ST=Fiji, L=Suva, O=SOPAC, OU=ICT, CN=www.example.org/Email=administrator@example.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption 
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
                    00:ba:54:2c:ab:88:74:aa:6b:35:a5:a9:c1:d0:5a:
                    9b:fb:6b:b5:71:bc:ef:d3:ab:15:cc:5b:75:73:36:
                    b8:01:d1:59:3f:c1:88:c0:33:91:04:f1:bf:1a:b4:
                    7a:c8:39:c2:89:1f:87:0f:91:19:81:09:46:0c:86:
                    08:d8:75:c4:6f:5a:98:4a:f9:f8:f7:38:24:fc:bd:
                    94:24:37:ab:f1:1c:d8:91:ee:fb:1b:9f:88:ba:25:
                    da:f6:21:7f:04:32:35:17:3d:36:1c:fb:b7:32:9e:
                    42:af:77:b6:25:1c:59:69:af:be:00:a1:f8:b0:1a:
                    6c:14:e2:ae:62:e7:6b:30:e9
                Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints:
                 CA:FALSE
             Netscape Comment:
                 OpenSSL Generated Certificate
             X509v3 Subject Key Identifier:
                 FE:04:46:ED:A0:15:BE:C1:4B:59:03:F8:2D:0D:ED:2A:E0:ED:F9:2F
             X509v3 Authority Key Identifier:
                 keyid:E6:12:7C:3D:A1:02:E5:BA:1F:DA:9E:37:BE:E3:45:3E:9B:AE:E5:A6
                 DirName:/C=FJ/ST=Fiji/L=Suva/O=SOPAC/OU=ICT/CN=SOPAC Root CA/Email=administrator@example.org
                 serial:00
    Signature Algorithm: md5WithRSAEncryption
        34:8d:fb:65:0b:85:5b:e2:44:09:f0:55:31:3b:29:2b:f4:fd:
        aa:5f:db:b8:11:1a:c6:ab:33:67:59:c1:04:de:34:df:08:57:
        2e:c6:60:dc:f7:d4:e2:f1:73:97:57:23:50:02:63:fc:78:96:
        34:b3:ca:c4:1b:c5:4c:c8:16:69:bb:9c:4a:7e:00:19:48:62:
        e2:51:ab:3a:fa:fd:88:cd:e0:9d:ef:67:50:da:fe:4b:13:c5:
        0c:8c:fc:ad:6e:b5:ee:40:e3:fd:34:10:9f:ad:34:bd:db:06:
        ed:09:3d:f2:a6:81:22:63:16:dc:ae:33:0c:70:fd:0a:6c:af:
        bc:5a
-----BEGIN CERTIFICATE-----
MIIDoTCCAwqgAwIBAgIBATANBgkqhkiG9w0BAQQFADCBiTELMAkGA1UEBhMCRkox
DTALBgNVBAgTBEZpamkxDTALBgNVBAcTBFN1dmExDjAMBgNVBAoTBVNPUEFDMQww
CgYDVQQLEwNJQ1QxFjAUBgNVBAMTDVNPUEFDIFJvb3QgQ0ExJjAkBgkqhkiG9w0B
CQEWF2FkbWluaXN0cmF0b3JAc29wYWMub3JnMB4XDTAxMTEyMDA1NDc0NFoXDTAy
MTEyMDA1NDc0NFowgYkxCzAJBgNVBAYTAkZKMQ0wCwYDVQQIEwRGaWppMQ0wCwYD
VQQHEwRTdXZhMQ4wDAYDVQQKEwVTT1BBQzEMMAoGA1UECxMDSUNUMRYwFAYDVQQD
Ew13d3cuc29wYWMub3JnMSYwJAYJKoZIhvcNAQkBFhdhZG1pbmlzdHJhdG9yQHNv
cGFjLm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAulQsq4h0qms1panB
0Fqb+2u1cbzv06sVzFt1cza4AdFZP8GIwDORBPG/GrR6yDnCiR+HD5EZgQlGDIYI
2HXEb1qYSvn49zgk/L2UJDer8RzYke77G5+IuiXa9iF/BDI1Fz02HPu3Mp5Cr3e2
JRxZaa++AKH4sBpsFOKuYudrMOkCAwEAAaOCARUwggERMAkGA1UdEwQCMAAwLAYJ
YIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1Ud
DgQWBBT+BEbtoBW+wUtZA/gtDe0q4O35LzCBtgYDVR0jBIGuMIGrgBTmEnw9oQLl
uh/anje+40U+m67lpqGBj6SBjDCBiTELMAkGA1UEBhMCRkoxDTALBgNVBAgTBEZp
amkxDTALBgNVBAcTBFN1dmExDjAMBgNVBAoTBVNPUEFDMQwwCgYDVQQLEwNJQ1Qx
FjAUBgNVBAMTDVNPUEFDIFJvb3QgQ0ExJjAkBgkqhkiG9w0BCQEWF2FkbWluaXN0
cmF0b3JAc29wYWMub3JnggEAMA0GCSqGSIb3DQEBBAUAA4GBADSN+2ULhVviRAnw
VTE7KSv0/apf27gRGsarM2dZwQTeNN8IVy7GYNz31OLxc5dXI1ACY/x4ljSzysQb
xUzIFmm7nEp+ABlIYuJRqzr6/YjN4J3vZ1Da/ksTxQyM/K1ute5A4/00EJ+tNL3b
Bu0JPfKmgSJjFtyuMwxw/Qpsr7xa
-----END CERTIFICATE-----


As You may have noticed, the certificate contains the reference to the
issuer, the public key of the owner of this certificate, the dates of
validity of this certificate and the signature of the certificate to
ensure this certificate hasen't been tampered with. The certificate does not
contain the private key as it should never be transmitted in any form whatsoever.
This certificate has all the elements to send an encrypted message to the owner
(using the public key) or to verify a message signed by the author of this certificate.

The Symmetric key:

Well, Private Key/Public Key encryption algorithms are great, but they are not usually practical. It is asymmetric because you need the other key pair to decrypt. You can't use the same key to encrypt and decrypt. An algorithm using the same key to decrypt and encrypt is deemed to have a symmetric key. A symmetric algorithm is much faster in doing its job than an asymmetric algorithm. But a symmetric key is potentially highly insecure. If the enemy gets hold of the key then you have no more secret information. You must therefore transmit the key to the other party without the enemy getting its hands on it. As you know, nothing is secure on the Internet. The solution is to encapsulate the symmetric key inside a message encrypted with an asymmetric algorithm. You have never transmitted your private key to anybody, then the message encrypted with the public key is secure (relatively secure, nothing is certain except death and taxes). The symmetric key is also chosen randomly, so that if the symmetric secret key is discovered then the next transaction will be totally different.

Symetric Key-->[Public Key]-->Encrypted Symetric Key-->[Private Key]-->Symetric Key

Encryption algorithm:

There are several encryption algorithms available, using symmetric or asymmetric methods, with keys of various lengths.

 

The Hash:

A hash is a number given by a hash function from a message. This is a one way function, it means that it is impossible to get the original message knowing the hash. However the hash will drastically change even for the slightest modification in the message. It is therefore extremely difficult to modify a message while keeping its original hash. It is also called a message digest. Hash functions are used in password mechanisms, in certifying that applications are original (MD5 sum), and in general in ensuring that any message has not been tampered with.

Signing:

Signing a message, means authenticating that you have yourself assured the authenticity of the message (most of the time it means you are the author, but not necessarily). The message can be a text message, or someone else's certificate. To sign a message, you create its hash, and then encrypt the hash with your private key, you then add the encrypted hash and your signed certificate with the message. The recipient will recreate the message hash, decrypts the encrypted hash using your well known public key stored in your signed certificate, check that both hash are equals and finally check the certificate.
The other advantage of signing your messages is that you transmit your public key and certificate automatically to all your recipients.
There are usually 2 ways to sign, encapsulating the text message inside the signature (with delimiters), or encoding the message altogether with the signature. This later form is a very simple encryption form as any software can decrypt it if it can read the embedded public key. The advantage of the first form is that the message is human readable allowing any non complaint client to pass the message as is for the user to read, while the second form does not even allow to read part of the message if it has been tampered with.

PassPhrase:

“A pass phrase is like a password except it is longer”. In the early days passwords on Unix system were limited to 8 characters, so the term pass phrase for longer passwords. Longer is the password harder it is to guess. Nowadays Unix systems use MD5 hashes which have no limitation in length of the password.

SSL and HTTPS

What are checked and Un checked Exceptions?

coming soon.

What is method overriding?

Method Overriding: It basically means providing a new implementation of a method in sub-class/child class. That means you are defining a behavior of a method that is more specific to subclass/child class.
The following example demonstrate a Horse  subclass of Animal Overriding the Animal version of eat method.

public class Animal {
    public void eat(){
        System.out.println("Generic Animal Eating");
    }
}

public class Horse extends Animal{

     public void eat(){
        System.out.println("Horse eating hey.");
    }
}

For abstract methods you inherit from a super class you have no choice, you must implement the method in subclass unless the subclass is also abstract. Abstract methods must be implemented by concrete subclass. So you could think of abstract method as method you are forced to override.  

For details refer http://java-auth.blogspot.in/2014/10/all-about-abstract-class-and-abstract.html.

The rules of overriding method are as follows:

1. The argument list must exactly match that of the overridden method, if they don't match you end up with an overloaded method which you didn't intend.

2. The return type must be same as or sub type(important) of , the return type declared in the original overridden method in the super class(Check co variant return).

3. The access level can't be more restrictive than the overridden method's.

4. The access level CAN be less restrictive than that of the overridden method.

5. Instance methods can be overridden only if they are inherited by the subclass.
  e.g.  A subclass within the same package as the instance's super class can override any super class method that is not marked private or final. A subclass in a
 different package can override only those non-final methods marked public or protected(since protected methods are inherited by the subclass).

6. The overriding method CAN throw any unchecked (run time) exception, regardless of whether the overridden method declares the exception(for more detail check).

7. The overriding method must NOT throw checked exceptions that are new or broader than those declared by the overridden method. For example, a method that declares a    FileNotFoundException cannot be overridden by a method that declares a SQLException, Exception, or any other non-run time exception unless it's a subclass of FileNotFoundException.

8. The overriding method can throw narrower or fewer exceptions. Just because an overridden method "takes risks" doesn't mean that the overriding subclass' exception takes the same risks. Bottom line: an overriding method doesn't have to declare any exceptions that it will never throw, regardless of what the overridden method declares.

9.You cannot override a method marked final.

10. You cannot override a method marked static.

11. If a method can't be inherited, you cannot override it. Remember that overriding implies that you're re implementing a method you inherited! For example, the following code is not legal, and even if you added an eat() method to Horse, it wouldn't be an override of Animal's eat()method as it is private.

public class TestAnimals {
public static void main (String [] args) {
Horse h = new Horse();
h.eat(); // Not legal because Horse didn't inherit eat()
}
}

class Animal {
private void eat() {
System.out.println("Generic Animal Eating Generically");
}
}
class Horse extends Animal { }


Invoking a Super Class version of an Overridden Method:

You can do it using the keyword super as follows:

public class Animal {
    public void eat() { }
        public void printYourself() {
        // Useful printing code goes here
    }
}

class Horse extends Animal {
    public void printYourself() {
        // Take advantage of Animal code, then add some more
        super.printYourself();// Invoke the superclass (Animal) code Then do
        //Horse-specific  print work here
    }
}

Examples of Legal and Illegal Method Overrides:
Let's take a look at overriding the eat()method of Animal:
public class Animal {
    public void eat() { }
}

Method overriding vs Method overloading!!

coming soon...

What is method overloading?

coming soon

Polymorphism and Method overriding!!

coming soon. 108 page example.

All about abstract class and abstract method in Java!!

coming soon.

104 of scjp book.

Polymorphism

coming soon!!

Inheritance Part 1

What Is Inheritance?

Coming soon.

Inheritance Part 2

coming soon.

What is Encapsulation and Why it is usefull?

Definition: Encapsulation is the ability to package data, related behavior in an object bundle and control/restrict access to them (both data and function) from other objects. It is all about packaging related stuff together and hide them from external elements. 

Details: Imagine you made your class with the public instance variable and there are other programmers who are using your class and setting the instance variable directly as the below code demonstrate.

public class BadOO{

     public int size;

     public int weight;

     ......//other stuffs;

     .......//setters and getter 

}

//Some one using the class as below

public class ExploitBadOO{

    public static void main(String args...){

        BadOO = b = new BadOO();

        b.size = -5; //Legal but bad

    }

}

Now you are in trouble.How?

Suppose you wanted only  positive value to be assigned to the the size .And you have setter method for that which does the validation.like below.

public void setSize(int value){

    if(value<0){

        //throw error value can not be negative

     }else{

     //do your work.

      this.size = value;

     }

}

That is not possible now because people can directly set the value of size as you made that public they don't need to call your setter method and set the value of size.

How are you going to control what value can be assigned to size?

You need to make one change in your class. You need to change the access modifier of your instance variable to restrict the access directly. You do this by changing access to private.

public class GoodOO{

     private int size;

     private int weight;

     ......//other stuffs;

     .......//setters and getter 

}

Now once you change the access modifier you break people's code who were using direct way to access you instance variable.

Now what you do? 

Don't worry you have OO(Object Oriented) concept that is called encapsulation that comes to your rescue. If you would had followed the correct way of designing you class you would have not faced this issue.

So how you do achieve Encapsulation?

Encapsulation is achieved by following the below steps: 

 

1. Keep restricted access to instance variable (with an access modifier, ofter private)

2. Make public getter and setter method to access your instance variable.

And suppose you want to change the implementation of setter method to something else?

Its easy now you just go ahead and change the implementation and this will not break any ones code as they are using setters and getter.

public void setSize(int value){

    if(value<0){

        //throw error value can not be negative

     }else{

     //do your work.

      this.size = 5*value; //setting value as five time the original.

     }

}

This ability to make change in your code without breaking the code of others who use your class is key benefit of Encapsulation.

Basically what you have done is  you have hidden the implementation details behind the public programing interface.

So your final class will look like below

public class GoodOO{

     private int size;

     private int weight;

   

  

public void setSize(int value){

    if(value<0){

        //throw error value can not be negative

     }else{

     //do your work.

      this.size = 5*value; //setting value as five time the original.

     }

}

public int getSize(){

  return this.size;

}

//getter and setter for weight.

}

Taken from SCJP  Book.

PS: If you want to add more point please drop me a mail or write in comments below i will update the article.

Introduction

The purpose of this blog is to share java concepts and question related to that.
This will contain details discussion on interview questions and experiences.


If you want to write your own post please drop me a mail at javaauth [at] gmail [dot] com.