Transport Layer Security

Dr. G. Jaspher W. Kathrine

 Transport Layer Security
• Most widely used security services is Transport
Layer Security (TSL)
• The current version is Version 1.2, defined in RFC
5246.
• TLS is an Internet standard that evolved from a
commercial protocol known as Secure Sockets Layer
(SSL).
 TLS Architecture

• Three higher-layer protocols

are defined as part of TLS:
– the Handshake Protocol;
– the Change Cipher Spec Protocol;
and
– the Alert Protocol.
– A fourth protocol, the Heartbeat
Protocol, is defined in a separate
RFC.
 TLS concepts
• TLS session and the TLS connection.
• Connection: A connection is a transport (in the OSI layering
model definition) that provides a suitable type of service.
– For TLS, such connections are peer-to-peer relationships.
– The connections are transient.
– Every connection is associated with one session.
• Session: A TLS session is an association between a client and a
server.
• Sessions are created by the Handshake Protocol.
• Sessions define a set of cryptographic security parameters,
which can be shared among multiple connections.
– Sessions are used to avoid the expensive negotiation of new security
parameters for each connection.
 Session state
• There are a number of states associated with each session. Once a
session is established, there is a current operating state for both read
and write (i.e., receive and send).
• Session identifier: An arbitrary byte sequence chosen by the server to identify an
active or resumable session state.
• Peer certificate: An X509.v3 certificate of the peer. This element of the state may
be null.
• Compression method: The algorithm used to compress data prior to encryption.
• Cipher spec: Specifies the bulk data encryption algorithm (such as null, AES, etc.)
and a hash algorithm (such as MD5 or SHA-1) used for MAC calculation.
• It also defines cryptographic attributes such as the hash_size.
• Master secret: 48-byte secret shared between the client and server.
• Is resumable: A flag indicating whether the session can be used to initiate new
connections.
 Connection state
• Server and client random: Byte sequences that are chosen by the server and client
for each connection.
• Server write MAC secret: The secret key used in MAC operations on data sent by
the server.
• Client write MAC secret: The symmetric key used in MAC operations on data sent
by the client.
• Server write key: The symmetric encryption key for data encrypted by the server
and decrypted by the client.
• Client write key: The symmetric encryption key for data encrypted by the client
and decrypted by the server.
 Connection state contd..

• Initialization vectors: When a block cipher in CBC mode is used, an

initialization vector (IV) is maintained for each key.
– This field is first initialized by the TLS Handshake Protocol.
– Thereafter, the final ciphertext block from each record is preserved for use as
the IV with the following record.
• Sequence numbers: Each party maintains separate sequence numbers for
transmitted and received messages for each connection.
– When a party sends or receives a “change cipher spec message,” the
appropriate sequence number is set to zero.
– Sequence numbers may not exceed 264 - 1.
 TLS Record Protocol
Provides two services for TLS connections:
•Confidentiality: The Handshake Protocol defines a shared
secret key that is used for conventional encryption of TLS
payloads.
•Message Integrity: The Handshake Protocol also defines a
shared secret key that is used to form a message
authentication code (MAC).
TLS Record Protocol Operation
• The first step is fragmentation. Each upper-layer message is
fragmented into blocks of 2 14 bytes (16,384 bytes) or less.
• Compression must be lossless and may not increase the content
length by more than 1024 bytes.
• The next step in processing is to compute a message
authentication code over the compressed data.
• TLS makes use of the HMAC algorithm defined in RFC 2104.
HMACK(M)= Hash[(K+ XOR opad) ||
Hash[(K+ XOR ipad) || M)] ] where
– H = embedded hash function (for TLS, either MD5 or SHA-1)
– M = message input to HMAC
– K+ = secret key padded with zeros on the left so that the result is equal to the
block length of the hash code (for MD5 and SHA-1, block length = 512 bits)
– ipad = 00110110 (36 in hexadecimal) repeated 64 times (512 bits)
– opad = 01011100 (5C in hexadecimal) repeated 64 times (512 bits)
• The compressed message plus the MAC are encrypted using
symmetric encryption.
• Encryption may not increase the content length by more than
1024 bytes, so that the total length may not exceed 2 14 + 2048.

• For stream encryption, the compressed message plus the MAC

are encrypted.
• For block encryption, padding may be added after the MAC prior
to encryption.
• Content Type (8 bits): The higher-layer protocol used to process
the enclosed fragment.
• The content types that have been defined are change_cipher_spec,
alert, handshake, and application_data.
• Major Version (8 bits): Indicates major version of TLS in use. For
TLSv2, the value is 3.
• Minor Version (8 bits): Indicates minor version in use. For TLSv2,
the value is 1.
• Compressed Length (16 bits): The length in bytes of the plaintext
fragment (or compressed fragment if compression is used).
– The maximum value is 214 + 2048.
Handshake Protocol