The recent explosive growth of the Internet and the World Wild Web has brought a need to securely protect sensitive communication over the open network. Making sure that communications remain secure between clients and Web servers is a critical issue. Secure Socket Layer (SSL) is a separate layer that is added to Internet's protocol architecture just for security between the application layer and TCP layer. Upon today multiple versions of SSL and its capabilities have been published and its different implementations have been made. Analysis of SSL based sessions is an important problem that attracted much attention of cryptanalysts. Different attacks are proposed against this protocol; in some of them, the specifications of protocol and in the others, application conditions have resulted in vulnerability. Main attacks that SSL designers have not considered, are Denial of Service attack and Traffic Analysis attack. Implementers or users, who concerned with these attacks, should use other protections beside SSL. In this thesis, SSL protocol along with its specifications in different versions is explained and the security of SSL based sessions is analyzed. This analysis consists of all the reported attacks. At the end of thesis, several suggestions are made for improving SSL protocol such as a 3-stage handshake that reduces the number of round trips and results in fast negotiation. Also some counter-attacks are proposed against some attacks that are preferred to existing methods in SSL.
