Research Of Security Key Vulnerability And Attack Method Based On OpenSSL

In recent years,with the Internet increasingly penetrated into people's life,the network is carrying more and more important information.In particular,with the rapid development of online banking and online shopping,a variety of high-tech crimesare resulting in a larger number of losses.In order to protect the data in the network,Secure Socket Layer(SSL)is widely used to provide secure and reliable environment for online transactions.The protocol is loacted between the transport layer and the application layer,and uses the data encryption technology to ensure the security of the information transmitted in network.Open SSL is the implementation of the SSL protocol.It includes the main cryptographic algorithms,keys,certificate management functions,and SSL protocols.It can be used to guarantee data integrity and confidentiality.Open SSL uses key exchange algorithms such as RSA algorithm or Diffie Herman algorithm for key exchange to encrypt data.Once the security key loophole appeared,it will severely affect the safety of Open SSL.This paper will take the RSA downgrade attack vulnerability—Freak hoophole as an example to study Open SSL security key vulnerabilities.This article expounds the research status of communication encryptio nat home and abroad,and studies the attack characteristicsof man-in-the-middle attack and selectsproxy server attack method to achieve security key vulnerability attack.The paper makes a deep analysis of the Open SSL code and data package,and expounds the reasons for the SSL connection and security key vulnerabilities.According to the Freak design,this paper realizes the security key vulnerability attack based on Open SSL,and carries on the corresponding test,proves the validity of the attack,and puts forward the detection measure and the defense measure of Freak attack.This paper presents a method for defending the security key vulnerabilities of Open SSL,which effectively enhances the security and robustness of Open SSL.