Java Security, 2nd Edition

An Overview of SSL and JSSE

On the Internet, data encryption is often performed using the Secure Sockets Layer protocol. This protocol was originally designed by Netscape for use in its browsers and secure servers; its most popular implementation is SSL 3.0. As SSL became a key technology on the Internet, its development and maintenance were taken over by the Internet Engineering Task Force (IETF), which made some slight modifications to SSL 3.0 and established the Transport Layer Security (TLS) Internet standard (presently version 1.0). Don’t be confused by the names here: SSL and TLS are essentially the same protocol; TLS 1.0 is really just SSL version 3.1 (which has very few changes from version 3.0). TLS 1.0 is backward-compatible with SSL 3.0, so a program that uses the TLS protocol will be able to talk to other programs that use SSL 3.0.

SSL 3.0 is used by most browsers, including Netscape 4.x and 6, Internet Explorer 4.x and 5.x, the AOL browser, and the Opera browser. Some earlier versions of these browsers used SSL 2.0. SSL servers almost universally use 3.0 or later, partly because they are expected to talk to the newest browsers and partly because SSL 3.0 is considered more secure than SSL 2.0.

JSSE defines an API for SSL sockets. Sun provides a default implementation of that API in the reference implementation of JSSE. In theory, you can obtain third-party implementations of JSSE that plug into the JSSE framework, although as we’ll see later in this chapter, you must ...