Web security:

SSL and TLS

What are SSL and TLS?

SSL Secure Socket Layer
TLS Transport Layer Security
both provide a secure transport connection between
applications (e.g., a web server and a browser)
SSL was developed by Netscape
SSL version 3.0 has been implemented in many web browsers
(e.g., Netscape Navigator and MS Internet Explorer) and web
servers and widely used on the Internet
SSL v3.0 was specified in an Internet Draft (1996)
it evolved into TLS specified in RFC 2246
TLS can be viewed as SSL v3.1

SSL architecture

SSL
SSL
Handshake
Handshake
Protocol
Protocol

SSL
SSLChange
Change
Cipher
CipherSpec
Spec
Protocol
Protocol

SSL
SSL
Alert
Alert
Protocol
Protocol

applications
applications
(e.g.,
(e.g.,HTTP)
HTTP)

SSL
SSLRecord
RecordProtocol
Protocol

TCP
TCP

IP
IP

SSL components
SSL Handshake Protocol
negotiation of security algorithms and parameters
key exchange
server authentication and optionally client authentication

SSL Record Protocol

fragmentation
compression
message authentication and integrity protection
encryption

SSL Alert Protocol

error messages (fatal alerts and warnings)

SSL Change Cipher Spec Protocol

a single message that indicates the end of the SSL handshake
4

Sessions and connections

Sessions and connections

an SSL session is an association between a client and a server
sessions are stateful; the session state includes security
algorithms and parameters
a session may include multiple secure connections between
the same client and server
connections of the same session share the session state
sessions are used to avoid expensive negotiation of new
security parameters for each connection
there may be multiple simultaneous sessions between the
same two parties, but this feature is not used in practice

Session and connection states

session state
session identifier
arbitrary byte sequence chosen by the server to identify the session

peer certificate
X509 certificate of the peer
may be null

Sessions and connections

compression method
cipher spec
bulk data encryption algorithm (e.g., null, DES, 3DES, )
MAC algorithm (e.g., MD5, SHA-1)
cryptographic attributes (e.g., hash size, IV size, )

master secret
48-byte secret shared between the client and the server

is resumable
a flag indicating whether the session can be used to initiate new connections

connection states
6

Session and connection states contd

connection state
server and client random
random byte sequences chosen by the server and the client for every connection

server write MAC secret

secret key used in MAC operations on data sent by the server

client write MAC secret

secret key used in MAC operations on data sent by the client

server write key

secret encryption key for data encrypted by the server

Sessions and connections

client write key

secret encryption key for data encrypted by the client

initialization vectors
an IV is maintained for each encryption key if CBC mode is used
initialized by the SSL Handshake Protocol
final ciphertext block from each record is used as IV with the following record

sending and receiving sequence numbers

sequence numbers are 64 bits long
reset to zero after each Change Cipher Spec message
7

State changes
operating state
currently used state

pending state
state to be used
built using the current state

operating state pending state

Sessions and connections

at the transmission and reception of a Change Cipher Spec message

party A
(client or server)
the sending part of the
pending state is copied
into the sending part
of the operating state

party B
(server or client)

Chan

g e Ci
p her

Sp e c

the receiving part of the

pending state is copied
into the receiving part
of the operating state

SSL Record Protocol processing overview

application data

fragmentation
SSLPlaintext
type version length

compression
SSLCompressed

SSL Record Protocol

type version length

msg authentication and
encryption (with padding if necessary)
SSLCiphertext
type version length

MAC padding

Header
type
the higher level protocol used to process the enclosed fragment
possible types:

change_cipher_spec
alert
handshake
application_data

version
SSL Record Protocol

SSL version, currently 3.0

length
length (in bytes) of the enclosed fragment or compressed fragment
max value is 214 + 2048

10

MAC
MAC = hash( MAC_write_secret | pad_2 |
hash( MAC_write_secret | pad_1 | seq_num | type | length | fragment ) )

similar to HMAC but the pads are concatenated

supported hash functions:
MD5
SHA-1

SSL Record Protocol

pad_1 is 0x36 repeated 48 times (MD5) or 40 times (SHA-1)

pad_2 is 0x5C repeated 48 times (MD5) or 40 times (SHA-1)

11

Encryption
supported algorithms
block ciphers (in CBC mode)

RC2_40
DES_40
DES_56
3DES_168
IDEA_128
Fortezza_80

SSL Record Protocol

stream ciphers
RC4_40
RC4_128

if a block cipher is used, than padding is applied

last byte of the padding is the padding length

12

SSL Alert Protocol

each alert message consists of 2 fields (bytes)

first field (byte): warning or fatal
second field (byte):
fatal

unexpected_message
bad_record_MAC
decompression_failure
handshake_failure
illegal_parameter

SSL Alert Protocol

warning

close_notify
no_certificate
bad_certificate
unsupported_certificate
certificate_revoked
certificate_expired
certificate_unknown

in case of a fatal alert

connection is terminated
session ID is invalidated no new connection can be established within this session
13

SSL Handshake Protocol overview

client

server
client_hello
server_hello

Phase 1: Negotiation of the session ID, key exchange

algorithm, MAC algorithm, encryption algorithm, and
exchange of initial random numbers

certificate
server_key_exchange
certificate_request
server_hello_done

Phase 2: Server may send its certificate and key

exchange message, and it may request the client
to send a certificate. Server signals end of hello
phase.

SSL Handshake Protocol

certificate
client_key_exchange
certificate_verify

Phase 3: Client sends certificate if requested and may

send an explicit certificate verification message.
Client always sends its key exchange message.

change_cipher_spec
finished

Phase 4: Change cipher spec and finish handshake

change_cipher_spec
finished
14

Hello messages
client_hello
client_version
the highest version supported by the client

client_random
current time (4 bytes) + pseudo random bytes (28 bytes)

SSL Handshake Protocol / Phase 1

session_id
empty if the client wants to create a new session, or
the session ID of an old session within which the client wants to create the new
connection

cipher_suites
list of cryptographic options supported by the client ordered by preference
a cipher suite contains the specification of the
key exchange method, the encryption and the MAC algorithm
the algorithms implicitly specify the hash_size, IV_size, and key_material parameters (part
of the Cipher Spec of the session state)

exmaple: SSL_RSA_with_3DES_EDE_CBC_SHA

compression_methods
list of compression methods supported by the client
15

Hello messages contd

server_hello
server_version
min( highest version supported by client, highest version supported by server )

server_random

SSL Handshake Protocol / Phase 1

current time + random bytes

random bytes must be independent of the client random

session_id
session ID chosen by the server
if the client wanted to resume an old session:
server checks if the session is resumable
if so, it responds with the session ID and the parties proceed to the finished messages

if the client wanted a new session

server generates a new session ID

cipher_suite
single cipher suite selected by the server from the list given by the client

compression_method
single compression method selected by the server
16

Supported key exchange methods

SSL Handshake Protocol / Phase 1

RSA based (SSL_RSA_with...)

the secret key (pre-master secret) is encrypted with the servers public RSA key
the servers public key is made available to the client during the exchange
fixed Diffie-Hellman (SSL_DH_RSA_with or SSL_DH_DSS_with)
the server has fix DH parameters contained in a certificate signed by a CA
the client may have fix DH parameters certified by a CA or it may send an
unauthenticated one-time DH public value in the client_key_exchange message
ephemeral Diffie-Hellman (SSL_DHE_RSA_with or SSL_DHE_DSS_with)
both the server and the client generate one-time DH parameters
the server signs its DH parameters with its private RSA or DSS key
the client may authenticate itself (if requested by the server) by signing the hash
of the handshake messages with its private RSA or DSS key

anonymous Diffie-Hellman
both the server and the client generate one-time DH parameters
they send their parameters to the peer without authentication

Fortezza
Fortezza proprietary key exchange scheme
17

Server certificate and key exchange messages

certificate
required for every key exchange method except for anonymous DH
contains one or a chain of X.509 certificates (up to a known root CA)
may contain

SSL Handshake Protocol / Phase 2

public RSA key suitable for encryption, or

public RSA or DSS key suitable for signing only, or
fix DH parameters

server_key_exchange
sent only if the certificate does not contain enough information to complete the
key exchange (e.g., the certificate contains an RSA signing key only)
may contain
public RSA key (exponent and modulus), or
DH parameters (p, g, public DH value), or
Fortezza parameters

digitally signed
if DSS: SHA-1 hash of (client_random | server_random | server_params) is signed
if RSA: MD5 hash and SHA-1 hash of (client_random | server_random |
server_params) are concatenated and encrypted with the private RSA key
18

Certificate request and server hello done msgs

certificate_request
sent if the client needs to authenticate itself
specifies which type of certificate is requested (rsa_sign, dss_sign,
rsa_fixed_dh, dss_fixed_dh, )

SSL Handshake Protocol / Phase 2

server_hello_done
sent to indicate that the server is finished its part of the key exchange
after sending this message the server waits for client response
the client should verify that the server provided a valid certificate and
the server parameters are acceptable

19

Client authentication and key exchange

certificate
sent only if requested by the server
may contain
public RSA or DSS key suitable for signing only, or
fix DH parameters

SSL Handshake Protocol / Phase 3

client_key_exchange
always sent (but it is empty if the key exchange method is fix DH)
may contain
RSA encrypted pre-master secret, or
client one-time public DH value, or
Fortezza key exchange parameters

certificate_verify
sent only if the client sent a certificate
provides client authentication
contains signed hash of all the previous handshake messages
if DSS: SHA-1 hash is signed
if RSA: MD5 and SHA-1 hash is concatenated and encrypted with the private key
MD5( master_secret | pad_2 | MD5( handshake_messages | master_secret | pad_1 ) )
SHA( master_secret | pad_2 | SHA( handshake_messages | master_secret | pad_1 ) )
20

Finished messages
finished

SSL Handshake Protocol / Phase 4

sent immediately after the change_cipher_spec message

first message that uses the newly negotiated algorithms, keys, IVs, etc.
used to verify that the key exchange and authentication was successful
contains the MD5 and SHA-1 hash of all the previous handshake
messages:
MD5( master_secret | pad_2 | MD5( handshake_messages | sender | master_secret | pad_1 ) ) |
SHA( master_secret | pad_2 | SHA( handshake_messages | sender | master_secret | pad_1 ) )

where sender is a code that identifies that the sender is the client or the
server (client: 0x434C4E54; server: 0x53525652)

21

Cryptographic computations
pre-master secret
if key exchange is RSA based:
generated by the client
sent to the server encrypted with the servers public RSA key

if key exchange is Diffie-Hellman based:

pre_master_secret = gxy mod p

master secret (48 bytes)

SSL Handshake Protocol

master_secret = MD5( pre_master_secret | SHA( A | pre_master_secret | client_random | server_random )) |

MD5( pre_master_secret | SHA( BB | pre_master_secret | client_random | server_random )) |
MD5( pre_master_secret | SHA( CCC | pre_master_secret | client_random | server_random ))

keys, MAC secrets, IVs

MD5( master_secret | SHA( A | master_secret | client_random | server_random )) |
MD5( master_secret | SHA( BB | master_secret | client_random | server_random )) |
MD5( master_secret | SHA( CCC | master_secret | client_random | server_random )) |

key block :
client write MAC secret server write MAC secret

client write key

server write key

22

Key exchange alternatives

SSL Handshake Protocol

RSA / no client authentication

or

server sends its encryption capable RSA public key in server_certificate

server_key_exchange is not sent
client sends encrypted pre-master secret in client_key_exchange
client_certificate and certificate_verify are not sent
server sends its RSA or DSS public signature key in server_certificate
server sends a temporary RSA public key in server_key_exchange
client sends encrypted pre-master secret in client_key_exchange
client_certificate and certificate_verify are not sent

23

Key exchange alternatives contd

RSA / client is authenticated

SSL Handshake Protocol

or

server sends its encryption capable RSA public key in server_certificate

server_key_exchange is not sent
client sends its RSA or DSS public signature key in client_certificate
client sends encrypted pre-master secret in client_key_exchange
client sends signature on all previous handshake messages in
certificate_verify
server sends its RSA or DSS public signature key in server_certificate
server sends a one-time RSA public key in server_key_exchange
client sends its RSA or DSS public signature key in client_certificate
client sends encrypted pre-master secret in client_key_exchange
client sends signature on all previous handshake messages in
certificate_verify
24

Key exchange alternatives contd

fix DH / no client authentication

server sends its fix DH parameters in server_certificate

server_key_exchange is not sent
client sends its one-time DH public value in client_key_exchange
client_ certificate and certificate_verify are not sent

SSL Handshake Protocol

fix DH / client is authenticated

server sends its fix DH parameters in server_certificate

server_key_exchange is not sent
client sends its fix DH parameters in client_certificate
client_key_exchange is sent but empty
certificate_verify is not sent

25

Key exchange alternatives contd

ephemeral DH / no client authentication

server sends its RSA or DSS public signature key in server_certificate

server sends signed one-time DH parameters in server_key_exchange
client sends one-time DH public value in client_key_exchange
client_certificate and certificate_verify are not sent

SSL Handshake Protocol

ephemeral DH / client is authenticated

server sends its RSA or DSS public signature key in server_certificate

server sends signed one-time DH parameters in server_key_exchange
client sends its RSA or DSS public signature key in client_certificate
client sends one-time DH public value in client_key_exchange
client sends signature on all previous handshake messages in
certificate_verify
26

Key exchange alternatives contd

anonymous DH / no client authentication

server_certificate is not sent

server sends (unsigned) one-time DH parameters in server_key_exchange
client sends one-time DH public value in client_key_exchange
client_certificate and certificate_verify are not sent

anonymous DH / client is authenticated

SSL Handshake Protocol

not allowed

27

TLS vs. SSL

version number
for TLS the current version number is 3.1

MAC
TLS uses HMAC
the MAC covers the version field of the record header too

more alert codes

cipher suites
TLS doesnt support Fortezza key exchange and Fortezza encryption

TLS vs. SSL

certificate_verify message
the hash is computed only over the handshake messages
in SSL the hash contained the master_secret and pads

28

TLS vs. SSL contd

pseudorandom function PRF
P_hash(secret, seed) = HMAC_hash( secret, A(1) | seed ) |
HMAC_hash( secret, A(2) | seed ) |
HMAC_hash( secret, A(3) | seed ) |
where
A(0) = seed
A(i) = HMAC_hash(secret, A(i-1))

TLS vs. SSL

PRF(secret, label, seed) =

P_MD5(secret_left, label | seed) P_SHA(secret_right, label | seed)

29

TLS vs. SSL contd

finished message
PRF( master_secret,
client finished,
MD5(handshake_messages) | SHA(handshake_messages) )

cryptographic computations
pre-master secret is calculated in the same way as in SSL
master secret:
PRF( pre_master_secret,
master secret,
client_random | server_random )

key block:

TLS vs. SSL

PRF( master_secret,
key expansion,
server_random | client_random )

padding before block cipher encryption

variable length padding is allowed (max 255 padding bytes)
30

31