RFC 4346
The Transport Layer Security (TLS) Protocol Version 1.1
The Transport Layer Security (TLS) Protocol Version 1.1 🎀
Okay bestie, so this is RFC 4346 💖 It's a Standards Track document, which means it's an actual spec people build against, not just a chill opinion piece. It was published in April 2006 by T. Dierks (Independent) and E. Rescorla (RTFM, Inc.), and it's the Network Working Group's work. It obsoletes RFC 2246, which was TLS 1.0, so this is the glow-up version 🦋 It doesn't say it updates anything else.
Status of This Memo ✨
This document is an Internet standards track protocol for the Internet community, and it's literally asking for discussion and suggestions for improvements 🫶 For the current standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited, so share it with everyone 💅
Copyright Notice 🌸
Copyright (C) The Internet Society (2006).
Abstract 🔐
This document specifies Version 1.1 of the Transport Layer Security (TLS) protocol. TLS gives communications security over the Internet 🧚 It lets client/server applications talk to each other in a way that's designed to stop eavesdropping, tampering, or message forgery. Main character security energy, honestly 👑
Table of Contents 📚
1. Introduction ....................................................4
1.1. Differences from TLS 1.0 ...................................5
1.2. Requirements Terminology ...................................5
2. Goals ...........................................................5
3. Goals of This Document ..........................................6
4. Presentation Language ...........................................6
4.1. Basic Block Size ...........................................7
4.2. Miscellaneous ..............................................7
4.3. Vectors ....................................................7
4.4. Numbers ....................................................8
4.5. Enumerateds ................................................8
4.6. Constructed Types ..........................................9
4.6.1. Variants ...........................................10
4.7. Cryptographic Attributes ..................................11
4.8. Constants .................................................12
5. HMAC and the Pseudorandom Function .............................12
6. The TLS Record Protocol ........................................14
6.1. Connection States .........................................15
6.2. Record layer ..............................................17
6.2.1. Fragmentation ......................................17
6.2.2. Record Compression and Decompression ...............19
6.2.3. Record Payload Protection ..........................19
6.2.3.1. Null or Standard Stream Cipher ............20
6.2.3.2. CBC Block Cipher ..........................21
6.3. Key Calculation ...........................................24
7. The TLS Handshaking Protocols ..................................24
7.1. Change Cipher Spec Protocol ...............................25
7.2. Alert Protocol ............................................26
7.2.1. Closure Alerts .....................................27
7.2.2. Error Alerts .......................................28
7.3. Handshake Protocol Overview ...............................31
7.4. Handshake Protocol ........................................34
7.4.1. Hello Messages .....................................35
7.4.1.1. Hello request .............................35
7.4.1.2. Client Hello ..............................36
7.4.1.3. Server Hello ..............................39
7.4.2. Server Certificate .................................40
7.4.3. Server Key Exchange Message ........................42
7.4.4. Certificate request ................................44
7.4.5. Server Hello Done ..................................46
7.4.6. Client certificate .................................46
7.4.7. Client Key Exchange Message ........................47
7.4.7.1. RSA Encrypted Premaster Secret Message ....47
7.4.7.2. Client Diffie-Hellman Public Value ........50
7.4.8. Certificate verify .................................50
7.4.9. Finished ...........................................51
8. Cryptographic Computations .....................................52
8.1. Computing the Master Secret ...............................52
8.1.1. RSA ................................................53
8.1.2. Diffie-Hellman .....................................53
9. Mandatory Cipher Suites ........................................53
10. Application Data Protocol .....................................53
11. Security Considerations .......................................53
12. IANA Considerations ...........................................54
A. Appendix - Protocol constant values ............................55
A.1. Record layer .........................................55
A.2. Change cipher specs message ..........................56
A.3. Alert messages .......................................56
A.4. Handshake protocol ...................................57
A.4.1. Hello messages .....................................57
A.4.2. Server authentication and key exchange messages ....58
A.4.3. Client authentication and key exchange messages ....59
A.4.4.Handshake finalization message ......................60
A.5. The CipherSuite ......................................60
A.6. The Security Parameters ..............................63
B. Appendix - Glossary ............................................64
C. Appendix - CipherSuite definitions .............................68
D. Appendix - Implementation Notes ................................69
D.1 Random Number Generation and Seeding ..................70
D.2 Certificates and authentication .......................70
D.3 CipherSuites ..........................................70
E. Appendix - Backward Compatibility With SSL .....................71
E.1. Version 2 client hello ...............................72
E.2. Avoiding man-in-the-middle version rollback ..........74
F. Appendix - Security analysis ...................................74
F.1. Handshake protocol ...................................74
F.1.1. Authentication and key exchange ....................74
F.1.1.1. Anonymous key exchange ...........................75
F.1.1.2. RSA key exchange and authentication ..............75
F.1.1.3. Diffie-Hellman key exchange with authentication ..76
F.1.2. Version rollback attacks ...........................77
F.1.3. Detecting attacks against the handshake protocol ...77
F.1.4. Resuming sessions ..................................78
F.1.5. MD5 and SHA ........................................78
F.2. Protecting application data ..........................78
F.3. Explicit IVs .........................................79
F.4 Security of Composite Cipher Modes ...................79
F.5 Denial of Service ....................................80
F.6. Final notes ..........................................80
Normative References ..............................................81
Informative References ............................................821. Introduction 🦋
Okay so the big goal of TLS is giving privacy and data integrity between two communicating applications 💜 It's built from two layers: the TLS Record Protocol and the TLS Handshake Protocol. At the very bottom, sitting on top of some reliable transport protocol (for example, TCP[TCP]), is the TLS Record Protocol. It gives connection security with two basic properties:
- The connection is private 🔒 Symmetric cryptography handles the data encryption (for example, DES [DES], RC4 [SCH], etc.). The keys for this symmetric encryption are generated uniquely for each connection, and they're based on a secret negotiated by another protocol (like the TLS Handshake Protocol). The Record Protocol can also be used without encryption.
- The connection is reliable ✨ Every message carries an integrity check using a keyed MAC. Secure hash functions (for example, SHA, MD5, etc.) are used for the MAC computations. The Record Protocol can operate without a MAC, but it's generally only used that way while another protocol is using the Record Protocol as a transport for negotiating security parameters.
The TLS Record Protocol is used to wrap up various higher-level protocols 🎀 One of those wrapped protocols is the TLS Handshake Protocol, which lets the server and client authenticate each other and negotiate an encryption algorithm and cryptographic keys before the application protocol sends or receives its first byte of data. The TLS Handshake Protocol gives connection security with three basic properties:
- The peer's identity can be authenticated using asymmetric, or public key, cryptography (for example, RSA [RSA], DSS [DSS], etc.). This authentication can be made optional, but it's generally required for at least one of the peers 🔑
- The negotiation of a shared secret is secure 🤫 The negotiated secret is unavailable to eavesdroppers, and for any authenticated connection the secret can't be obtained, even by an attacker who can place themselves in the middle of the connection 🙈
- The negotiation is reliable 💅 No attacker can modify the negotiation communication without the parties to the communication detecting it.
One big advantage of TLS is that it's application protocol independent 🌈 Higher level protocols can layer on top of TLS transparently. The TLS standard doesn't specify how protocols add security with TLS, though. The decisions on how to start TLS handshaking, and how to interpret the authentication certificates that get exchanged, are left to the judgment of the designers and implementors of protocols that run on top of TLS. So that's on them, iykyk 😭
1.1. Differences from TLS 1.0 💖
This document is a revision of the TLS 1.0 [TLS1.0] protocol. It has some small security improvements, clarifications, and editorial improvements. The major changes are:
- The implicit Initialization Vector (IV) got replaced with an explicit IV, to protect against CBC attacks [CBCATT] 🛡️
- Handling of padding errors changed to use the
bad_record_macalert instead of thedecryption_failedalert, also to protect against CBC attacks 🙅♀️ - IANA registries are now defined for protocol parameters 📋
- Premature closes no longer cause a session to be nonresumable 🫶
- Additional informational notes were added for various new attacks on TLS 👀
On top of that, a bunch of minor clarifications and editorial improvements were made ✨
1.2. Requirements Terminology 🌸
In this document, the keywords "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT" and "MAY" are to be interpreted as described in RFC 2119 [REQ]. So those words are the official spec vocab, and they keep their RFC 2119 meaning 🍓
2. Goals ✨
okay so the TLS Protocol has a priority list of goals, and the order actually matters 👑 Here they are, most important first:
- Cryptographic security 🔒: TLS should be used to set up a secure connection between two parties.
- Interoperability 🫶: independent programmers should be able to build apps with TLS that swap cryptographic parameters successfully, without ever seeing each other's code. no cap, that's the whole point.
- Extensibility 🧩: TLS is meant to be a framework where new public key and bulk encryption methods can be plugged in whenever needed. this also gets two sub-goals done: nobody has to invent a brand new protocol (which would risk new weaknesses 💀), and nobody has to build a whole new security library from scratch.
- Relative efficiency ⚡: crypto operations are super CPU heavy, especially public key ones, so TLS includes an optional session caching scheme to cut down on how many connections have to be started from zero. the protocol also tries really hard to keep network activity low. it's giving efficiency era 🌸
3. Goals of This Document 📖
this document and the TLS protocol itself are based on the SSL 3.0 Protocol Specification published by Netscape 🦋 the differences from SSL 3.0 aren't dramatic, but they're big enough that TLS 1.1, TLS 1.0, and SSL 3.0 do not interoperate. (each protocol does have a way for an implementation to back down to older versions, though 🙏)
this doc is mainly for people who are going to implement the protocol, and for people doing cryptographic analysis on it. so it's written with those two groups in mind. that's why a lot of the algorithm-dependent data structures and rules live right in the body of the text instead of an appendix, so you can get to them easily 💅
this document is NOT trying to give any details about service definition or interface definition. it does cover some policy areas, but only where they're needed to keep security solid 🔥
4. Presentation Language 🎀
this document is all about how data gets formatted in an external representation. the presentation syntax we're using is very basic and kinda casually defined. it borrows from a few sources. it looks like the programming language "C" and XDR [XDR] in both its syntax and its intent, but it'd be risky to draw too many parallels 🙈 the purpose of this presentation language is to document TLS only. it has no general application beyond that goal, periodt.
4.1. Basic Block Size 🧱
every data item has its representation explicitly specified. the basic data block is one byte (aka 8 bits). multi-byte data items are just bytes glued together, read from left to right, top to bottom. to build a multi-byte item (a numeric, in the example) from the bytestream, you use C notation like this:
value = (byte[0] << 8*(n-1)) | (byte[1] << 8*(n-2)) |
... | byte[n-1];this byte ordering for multi-byte values is the commonplace network byte order, also called big endian format. ✨
4.2. Miscellaneous 🧸
comments start with /* and end with */.
optional components get wrapped in double brackets, [[ ]].
single-byte entities holding uninterpreted data are type opaque.
4.3. Vectors 🌈
a vector (a single dimensional array) is a stream of homogeneous data elements. the size can be set at documentation time or left unspecified until runtime. either way, the length counts bytes, not elements. the syntax for a new type, T', that's a fixed-length vector of type T is:
T T'[n];T' takes up n bytes in the data stream, and n has to be a multiple of the size of T. the length of the vector isn't included in the encoded stream.
in this example, Datum is three consecutive bytes the protocol doesn't interpret, and Data is three consecutive Datum, which adds up to nine bytes total 🦋
opaque Datum[3]; /* three uninterpreted bytes */
Datum Data[9]; /* 3 consecutive 3 byte vectors */variable-length vectors are defined by giving a range of legal lengths, inclusive, using the <floor..ceiling> notation. when they're encoded, the actual length comes before the vector's contents in the byte stream. the length field is as many bytes as it takes to hold the vector's maximum (ceiling) length. a variable-length vector whose actual length field is zero is called an empty vector.
T T'<floor..ceiling>;in this next example, mandatory is an opaque vector that has to hold between 300 and 400 bytes. it can never be empty 😭 its length field is two bytes, a uint16, which is enough to represent 400 (see Section 4.4). longer, on the other hand, can hold up to 800 bytes, which is 400 uint16 elements, and it's allowed to be empty. its encoding has a two-byte actual length field stuck on the front. also, the length of an encoded vector has to be an even multiple of a single element's length. so a 17-byte vector of uint16 would be illegal, sorry bestie 🙅
opaque mandatory<300..400>;
/* length field is 2 bytes, cannot be empty */
uint16 longer<0..800>;
/* zero to 400 16-bit unsigned integers */4.4. Numbers 🔢
the basic numeric data type is an unsigned byte (uint8). all the bigger numeric types are built from fixed-length series of bytes concatenated the way Section 4.1 describes, and they're unsigned too. these numeric types come predefined:
uint8 uint16[2];
uint8 uint24[3];
uint8 uint32[4];
uint8 uint64[8];every value, here and everywhere else in the spec, is stored in "network" or "big-endian" order. so the uint32 with hex bytes 01 02 03 04 is the same as the decimal value 16909060 🍓
4.5. Enumerateds 🎨
there's an extra sparse data type called enum. a field of type enum can only take on the values declared in its definition. every definition is its own type, and you can only assign or compare enumerateds of the same type. every element of an enumerated has to be given a value, like in this example. the elements aren't ordered, so they can be assigned any unique value, in any order.
enum { e1(v1), e2(v2), ... , en(vn) [[, (n)]] } Te;enumerateds take up as much space in the byte stream as their biggest defined ordinal value. this definition would make Color fields use one byte:
enum { red(3), blue(5), white(7) } Color;you can also give a value without a tag, just to force the width without defining a pointless extra element. in this one, Taste eats two bytes in the data stream but can only ever be 1, 2, or 4 🍬
enum { sweet(1), sour(2), bitter(4), (32000) } Taste;the element names of an enumeration are scoped inside the defined type. in the first example, a fully qualified reference to the second element would be Color.blue. you don't need that qualification when the assignment target is already clear 💅
Color color = Color.blue; /* overspecified, legal */
Color color = blue; /* correct, type implicit */for enumerateds that never get converted to an external representation, you can leave out the numerical info.
enum { low, medium, high } Amount;4.6. Constructed Types 🏗️
structure types can be built out of primitive types for convenience. every specification declares a new, unique type. the definition syntax looks a lot like C.
struct {
T1 f1;
T2 f2;
...
Tn fn;
} [[T]];you can qualify the fields inside a structure with the type's name, kinda like with enumerateds. for example, T.f2 points to the second field of the previous declaration. structure definitions can also be embedded inside each other 🪆
4.6.1. Variants 🦋
defined structures can have variants based on some knowledge that's available in the environment. the selector has to be an enumerated type that lists the possible variants the structure defines. there has to be a case arm for every element of the enumeration declared in the select. the body of the variant structure can be given a label so you can reference it. how the variant actually gets picked at runtime isn't prescribed by the presentation language, so that part's up to the implementation 🤷♀️
struct {
T1 f1;
T2 f2;
....
Tn fn;
select (E) {
case e1: Te1;
case e2: Te2;
....
case en: Ten;
} [[fv]];
} [[Tv]];for example:
enum { apple, orange } VariantTag;
struct {
uint16 number;
opaque string<0..10>; /* variable length */
} V1;
struct {
uint32 number;
opaque string[10]; /* fixed length */
} V2;
struct {
select (VariantTag) { /* value of selector is implicit */
case apple: V1; /* VariantBody, tag = apple */
case orange: V2; /* VariantBody, tag = orange */
} variant_body; /* optional label on variant */
} VariantRecord;variant structures can be narrowed by giving a value for the selector before the type. so this:
orange VariantRecordis a narrowed type of VariantRecord, where the variant_body is of type V2 ✨
4.7. Cryptographic Attributes ✨
okay so the four big crypto moves are digital signing, stream cipher encryption, block cipher encryption, and public key encryption 🔐. they get the names digitally-signed, stream-ciphered, block-ciphered, and public-key-encrypted, in that order. to say how a field gets processed, you stick the right keyword in front of its type. and the keys? they're implied by the current session state (see Section 6.1) 💅
for digital signing, one-way hash functions feed into a signing algorithm 🦋 a digitally-signed element gets encoded as an opaque vector <0..2^16-1>, and its length depends on the signing algorithm and key.
for RSA signing, the thing being signed is a 36-byte structure with two hashes inside, one SHA and one MD5 🌈 it's encrypted with the private key, and it gets encoded with PKCS #1 block type 1, as described in [PKCS1A].
Note: The standard reference for PKCS#1 is now RFC 3447 [PKCS1B]. However, to minimize differences with TLS 1.0 text, we are using the terminology of RFC 2313 [PKCS1A].
ngl the note is giving "we're keeping it familiar for TLS 1.0 readers" 🎀 the modern PKCS#1 home is RFC 3447 [PKCS1B], but this doc sticks with the RFC 2313 [PKCS1A] wording so nothing feels brand new 🫶
in DSS, the 20 bytes of the SHA hash go straight through the Digital Signing Algorithm with no extra hashing ✨ that spits out two values, r and s. the DSS signature is an opaque vector like before, and its contents are the DER encoding of:
Dss-Sig-Value ::= SEQUENCE {
r INTEGER,
s INTEGER
}for stream cipher encryption, the plaintext gets exclusive-ORed with the same amount of output from a cryptographically secure keyed pseudorandom number generator 🌸 very simple, very iconic.
for block cipher encryption, every block of plaintext turns into a block of ciphertext 💜 all of it runs in CBC (Cipher Block Chaining) mode, and anything that's block-ciphered has to be an exact multiple of the cipher block length 🍓
for public key encryption, a public key algorithm encrypts data so that only the matching private key can decrypt it 🔑 a public-key-encrypted element is encoded as an opaque vector <0..2^16-1>, and its length depends on the signing algorithm and key. yes, the doc really says "signing algorithm" here, and we're keeping it that way 🙈
an RSA-encrypted value gets encoded with PKCS #1 block type 2, as described in [PKCS1A] 💖
check out this example:
stream-ciphered struct {
uint8 field1;
uint8 field2;
digitally-signed opaque hash[20];
} UserType;so the contents of hash feed into the signing algorithm, and then the whole structure gets encrypted with a stream cipher 🦋 the length in bytes is two bytes for field1 and field2, plus two bytes for the signature's length, plus whatever the signing algorithm outputs. that total is knowable because the algorithm and key for signing are already known before anyone encodes or decodes the structure 🧚
4.8. Constants 🎀
you can define typed constants for specification purposes by declaring a symbol of the type you want and assigning it values 🌈 but under-specified types (opaque, variable length vectors, and structures containing opaque) can't be assigned values, and no fields of a multi-element structure or vector can be elided. bestie, don't skip fields 🙅♀️
here's an example:
struct {
uint8 f1;
uint8 f2;
} Example1;
Example1 ex1 = {1, 4}; /* assigns f1 = 1, f2 = 4 */5. HMAC and the Pseudorandom Function 🔐
okay so a bunch of operations in the TLS record and handshake layers need a keyed MAC 💅 that's a secure digest of some data, protected by a secret. forging the MAC is infeasible unless you know the MAC secret. the construction used for this is called HMAC, and it's described in [HMAC] 🫶
HMAC works with lots of hash algorithms 🦋 TLS uses two of them in the handshake, MD5 and SHA-1, and writes them as HMAC_MD5(secret, data) and HMAC_SHA(secret, data). cipher suites can define more hash algorithms to protect record data, but MD5 and SHA-1 are hard-coded into the handshake description for this version of the protocol 💜
we also need a way to expand secrets into blocks of data, for key generation or validation 🌸 that's the pseudo-random function (PRF). it takes a secret, a seed, and an identifying label, and spits out output of arbitrary length ✨
to make the PRF as secure as possible, it uses two hash algorithms in a way that should keep it secure as long as either algorithm stays secure 🌈
first up, we define a data expansion function, P_hash(secret, data). it uses a single hash function to expand a secret and seed into however much output you want 🍓
P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
HMAC_hash(secret, A(2) + seed) +
HMAC_hash(secret, A(3) + seed) + ...where + means concatenation 🎀
A() is defined as:
A(0) = seed
A(i) = HMAC_hash(secret, A(i-1))P_hash can be iterated as many times as needed to get the data you want 🧚 for example, if P_SHA-1 is making 64 bytes of data, it has to iterate 4 times (through A(4)), making 80 bytes of output, and then the last 16 bytes of the final iteration get tossed, leaving 64 bytes 🦋
TLS's PRF splits the secret into two halves 🔑 it uses one half to generate data with P_MD5, uses the other half with P_SHA-1, and then XORs the outputs of those two expansion functions together. iconic teamwork 👑
S1 and S2 are the two halves of the secret, and they're the same length. S1 comes from the first half, S2 from the second half. their length is the overall secret length divided by two, rounded up. so if the secret has an odd number of bytes, the last byte of S1 is the same as the first byte of S2 🙈
L_S = length in bytes of secret;
L_S1 = L_S2 = ceil(L_S / 2);the secret gets partitioned into two halves (with the possibility of one shared byte) like we just said, with S1 taking the first L_S1 bytes and S2 taking the last L_S2 bytes 💖
the PRF is then the result of mixing the two pseudorandom streams by XORing them together ✨
PRF(secret, label, seed) = P_MD5(S1, label + seed) XOR
P_SHA-1(S2, label + seed);the label is an ASCII string 🌈 it should be included in exactly the form given, without a length byte or trailing null character. for example, the label "slithy toves" gets processed by hashing these bytes:
73 6C 69 74 68 79 20 74 6F 76 65 73one thing to clock: MD5 makes 16-byte outputs and SHA-1 makes 20-byte outputs, so the boundaries of their internal iterations won't line up 😭 making an 80-byte output means P_MD5 has to iterate through A(5), while P_SHA-1 only iterates through A(4) 💀
6. The TLS Record Protocol 🦋
okay so the TLS Record Protocol is a layered protocol 🍰 at each layer, messages can include fields for length, description, and content. the Record Protocol takes messages to send, fragments the data into manageable blocks, optionally compresses it, applies a MAC, encrypts it, and transmits the result. on the receiving end, data gets decrypted, verified, decompressed, reassembled, and then delivered to higher-level clients 👑
four record protocol clients are described in this document: the handshake protocol, the alert protocol, the change cipher spec protocol, and the application data protocol 🫶 to allow extending TLS, the record protocol can support additional record types. any new record types SHOULD allocate type values right after the ContentType values for the four record types described here (see Appendix A.1). all such values must be defined by RFC 2434 Standards Action. see Section 11 for IANA Considerations for ContentType values 📋
if a TLS implementation gets a record type it doesn't understand, it SHOULD just ignore it 🙈 any protocol designed for use over TLS MUST be carefully designed to deal with all possible attacks against it. ⚠️ also, because the type and length of a record aren't protected by encryption, care SHOULD be taken to minimize how much traffic analysis of those values is useful 🕵️♀️💀
6.1. Connection States ✨
okay so a TLS connection state is basically the operating environment the TLS Record Protocol lives in 💅 It decides which compression algorithm, encryption algorithm, and MAC algorithm are in play, and it holds the parameters for them too: the MAC secret and the bulk encryption keys for the connection, in both the read and write directions 🔐 Logically there are always four connection states outstanding: the current read and write states, and the pending read and write states. Every record gets processed under the current read and write states ✨
The pending states are where the security parameters get set, through the TLS Handshake Protocol 🤝 Then the Change Cipher Spec can selectively make either pending state current. When that happens, the matching current state gets thrown out and replaced with the pending one, and the pending state gets reset to an empty state 🧹 It's illegal to make a state that hasn't been initialised with security parameters the current state, so don't even try 🙅♀️ The initial current state always says no encryption, no compression, and no MAC, so you start out plain 🌸
The security parameters for a TLS Connection read and write state are set by providing these values:
- connection end: whether this entity is considered the "client" or the "server" in this connection.
- bulk encryption algorithm: the algorithm used for bulk encryption. This spec covers its key size, how much of that key is secret, whether it's a block or stream cipher, and the block size of the cipher (if that applies).
- MAC algorithm: the algorithm used for message authentication. This spec covers the size of the hash the MAC algorithm returns.
- compression algorithm: the algorithm used for data compression. This spec must include all the information the algorithm requires compression.
- master secret: a 48-byte secret shared between the two peers in the connection.
- client random: a 32-byte value provided by the client.
- server random: a 32-byte value provided by the server.
These parameters are defined in the presentation language as:
enum { server, client } ConnectionEnd;
enum { null, rc4, rc2, des, 3des, des40, idea, aes }
BulkCipherAlgorithm;
enum { stream, block } CipherType;
enum { null, md5, sha } MACAlgorithm;
enum { null(0), (255) } CompressionMethod;
/* The algorithms specified in CompressionMethod,
BulkCipherAlgorithm, and MACAlgorithm may be added to. */
struct {
ConnectionEnd entity;
BulkCipherAlgorithm bulk_cipher_algorithm;
CipherType cipher_type;
uint8 key_size;
uint8 key_material_length;
MACAlgorithm mac_algorithm;
uint8 hash_size;
CompressionMethod compression_algorithm;
opaque master_secret[48];
opaque client_random[32];
opaque server_random[32];
} SecurityParameters;The record layer uses those security parameters to generate these four items:
client write MAC secret
server write MAC secret
client write key
server write keyThe client write parameters are used by the server when it's receiving and processing records, and vice-versa 🔄 The algorithm for generating these items from the security parameters is described in Section 6.3 📖
Once the security parameters are set and the keys are generated, you can instantiate the connection states by making them the current states 💖 These current states MUST be updated for each record processed 💅 Each connection state includes these elements:
- compression state: the current state of the compression algorithm.
- cipher state: the current state of the encryption algorithm. This consists of the scheduled key for that connection. For stream ciphers, it also contains whatever state info is needed so the stream can keep encrypting or decrypting data 🌊
- MAC secret: the MAC secret for this connection, as generated above.
- sequence number: each connection state has a sequence number, maintained separately for the read and write states 🔢 The sequence number MUST be set to zero whenever a connection state is made the active state. Sequence numbers are of type uint64 and may not exceed 2^64-1. Sequence numbers do not wrap. If a TLS implementation would need to wrap a sequence number, it must renegotiate instead 🙈 The sequence number goes up by one after each record. Specifically, the first record transmitted under a particular connection state MUST use sequence number 0 ✨
6.2. Record layer 🎀
The TLS Record Layer gets uninterpreted data from higher layers, in non-empty blocks of any size 🧁
6.2.1. Fragmentation ✂️
The record layer chops information blocks up into TLSPlaintext records, carrying data in chunks of 2^14 bytes or less. Client message boundaries aren't preserved in the record layer, which means multiple client messages of the same ContentType MAY be coalesced into a single TLSPlaintext record, or a single message MAY be fragmented across several records 🦋
struct {
uint8 major, minor;
} ProtocolVersion;
enum {
change_cipher_spec(20), alert(21), handshake(22),
application_data(23), (255)
} ContentType;
struct {
ContentType type;
ProtocolVersion version;
uint16 length;
opaque fragment[TLSPlaintext.length];
} TLSPlaintext;- type: the higher-level protocol used to process the enclosed fragment.
- version: the version of the protocol being used. This document describes TLS Version 1.1, which uses the version { 3, 2 }. The version value 3.2 is historical. TLS version 1.1 is a minor modification to the TLS 1.0 protocol, which was itself a minor modification to the SSL 3.0 protocol, which has the version value 3.0. (See Appendix A.1.) 🕰️
- length: the length (in bytes) of the following TLSPlaintext.fragment. The length should not exceed 2^14.
- fragment: the application data. This data is transparent and is treated as an independent block to be dealt with by the higher-level protocol specified by the type field 🫶
Note: Data of different TLS Record layer content types MAY be interleaved. Application data is generally lower precedence for transmission than other content types. However, records MUST be delivered to the network in the same order as they are protected by the record layer 📬 Recipients MUST receive and process interleaved application layer traffic during handshakes subsequent to the first one on a connection 🤯
6.2.2. Record Compression and Decompression 🗜️
All records are compressed using the compression algorithm defined in the current session state. There's always an active compression algorithm, but initially it's defined as CompressionMethod.null 🫠 The compression algorithm translates a TLSPlaintext structure into a TLSCompressed structure. Compression functions get initialised with default state information whenever a connection state is made active 🔄
Compression must be lossless, and it may not increase the content length by more than 1024 bytes. If the decompression function runs into a TLSCompressed.fragment that would decompress to a length over 2^14 bytes, it should report a fatal decompression failure error 🚨
struct {
ContentType type; /* same as TLSPlaintext.type */
ProtocolVersion version;/* same as TLSPlaintext.version */
uint16 length;
opaque fragment[TLSCompressed.length];
} TLSCompressed;- length: the length (in bytes) of the following TLSCompressed.fragment. The length should not exceed 2^14 + 1024.
- fragment: the compressed form of TLSPlaintext.fragment.
Note: A CompressionMethod.null operation is an identity operation. No fields are altered 😌
Implementation note: Decompression functions are responsible for ensuring that messages cannot cause internal buffer overflows. Bestie, this one matters a LOT 😭💀
6.2.3. Record Payload Protection 🔐
The encryption and MAC functions translate a TLSCompressed structure into a TLSCiphertext, and the decryption functions reverse the process 🔁 The MAC of the record also includes a sequence number, so missing, extra, or repeated messages are detectable 👀
struct {
ContentType type;
ProtocolVersion version;
uint16 length;
select (CipherSpec.cipher_type) {
case stream: GenericStreamCipher;
case block: GenericBlockCipher;
} fragment;
} TLSCiphertext;- type: identical to TLSCompressed.type.
- version: identical to TLSCompressed.version.
- length: the length (in bytes) of the following TLSCiphertext.fragment. The length may not exceed 2^14 + 2048.
- fragment: the encrypted form of TLSCompressed.fragment, with the MAC.
6.2.3.1. Null or Standard Stream Cipher 🌊
Stream ciphers (including BulkCipherAlgorithm.null, see Appendix A.6) convert TLSCompressed.fragment structures to and from stream TLSCiphertext.fragment structures 💫
stream-ciphered struct {
opaque content[TLSCompressed.length];
opaque MAC[CipherSpec.hash_size];
} GenericStreamCipher;The MAC is generated as:
HMAC_hash(MAC_write_secret, seq_num + TLSCompressed.type +
TLSCompressed.version + TLSCompressed.length +
TLSCompressed.fragment));where "+" denotes concatenation ➕
- seq_num: the sequence number for this record.
- hash: the hashing algorithm specified by SecurityParameters.mac_algorithm.
Note that the MAC is computed before encryption. The stream cipher encrypts the entire block, including the MAC 🔒 For stream ciphers that don't use a synchronization vector (like RC4), the stream cipher state from the end of one record is simply used on the subsequent packet 🌸 If the CipherSuite is TLS_NULL_WITH_NULL_NULL, encryption is the identity operation. That means the data isn't encrypted, and the MAC size is zero, which implies no MAC is used 🫥 TLSCiphertext.length is TLSCompressed.length plus CipherSpec.hash_size 🧮
6.2.3.2. CBC Block Cipher 🧁
Okay so for block ciphers (like RC2, DES, or AES), the encryption and MAC functions turn TLSCompressed.fragment structures into TLSCiphertext.fragment structures, and back again. ✨
block-ciphered struct {
opaque IV[CipherSpec.block_length];
opaque content[TLSCompressed.length];
opaque MAC[CipherSpec.hash_size];
uint8 padding[GenericBlockCipher.padding_length];
uint8 padding_length;
} GenericBlockCipher;The MAC is generated as described in Section 6.2.3.1. 💅
IV 🎀 Unlike previous versions of SSL and TLS, TLS 1.1 uses an explicit IV to stop the attacks described in [CBCATT]. We recommend the following equivalently strong procedures. For clarity, we use this notation:
- IV: the transmitted value of the IV field in the
GenericBlockCipherstructure. - CBC residue: the last ciphertext block of the previous record.
- mask: the actual value that the cipher XORs with the plaintext before encrypting the first cipher block of the record.
In prior versions of TLS there was no IV field, and the CBC residue and mask were one and the same. See Sections 6.1, 6.2.3.2, and 6.3, of [TLS1.0] for the details of TLS 1.0 IV handling. 🦋
One of the following two algorithms SHOULD be used to generate the per-record IV. 🌸
(1) Generate a cryptographically strong random string R of length CipherSpec.block_length. Place R in the IV field. Set the mask to R. Thus, the first cipher block will be encrypted as E(R XOR Data).
(2) Generate a cryptographically strong random number R of length CipherSpec.block_length and prepend it to the plaintext before encryption. In this case, either:
- (a) The cipher may use a fixed mask such as zero.
- (b) The CBC residue from the previous record may be used as the mask. This keeps maximum code compatibility with TLS 1.0 and SSL 3. It also has the advantage that it does not require the ability to quickly reset the IV, which is known to be a problem on some systems. 🙈
In either (2)(a) or (2)(b), the data (R || data) is fed into the encryption process. The first cipher block (containing E(mask XOR R) is placed in the IV field. The first block of content contains E(IV XOR data).
The following alternative procedure MAY be used. However, it has not been demonstrated to be as cryptographically strong as the above procedures. 😬 The sender prepends a fixed block F to the plaintext (or, alternatively, a block generated with a weak PRNG). They then encrypt as in (2), above, using the CBC residue from the previous block as the mask for the prepended block. Note that in this case the mask for the first record transmitted by the application (the Finished) MUST be generated using a cryptographically strong PRNG. 🔐
The decryption operation for all three alternatives is the same. The receiver decrypts the entire GenericBlockCipher structure and then discards the first cipher block, which corresponds to the IV component. 🫶
padding 🧺 Padding that is added to force the length of the plaintext to be an integral multiple of the block cipher's block length. The padding MAY be any length up to 255 bytes, as long as it results in the TLSCiphertext.length being an integral multiple of the block length. Lengths longer than necessary might be desirable to frustrate attacks on a protocol that are based on analysis of the lengths of exchanged messages. Each uint8 in the padding data vector MUST be filled with the padding length value. The receiver MUST check this padding and SHOULD use the bad_record_mac alert to indicate padding errors. 🚨
padding_length 🔢 The padding length MUST be such that the total size of the GenericBlockCipher structure is a multiple of the cipher's block length. Legal values range from zero to 255, inclusive. This length specifies the length of the padding field, exclusive of the padding_length field itself.
The encrypted data length (TLSCiphertext.length) is one more than the sum of CipherSpec.block_length, TLSCompressed.length, CipherSpec.hash_size, and padding_length. 🧮
Example: If the block length is 8 bytes, the content length (TLSCompressed.length) is 61 bytes, and the MAC length is 20 bytes, then the length before padding is 82 bytes. (This does not include the IV, which may or may not be encrypted, as discussed above.) Thus, the padding length modulo 8 must be equal to 6 in order to make the total length an even multiple of 8 bytes (the block length). The padding length can be 6, 14, 22, and so on, through 254. If the padding length were the minimum necessary, 6, the padding would be 6 bytes, each containing the value 6. Thus, the last 8 octets of the GenericBlockCipher before block encryption would be xx 06 06 06 06 06 06 06, where xx is the last octet of the MAC. 🍓
Note: With block ciphers in CBC mode (Cipher Block Chaining), it is critical that the entire plaintext of the record be known before any ciphertext is transmitted. Otherwise, it is possible for the attacker to mount the attack described in [CBCATT]. ⚠️
Implementation Note: Canvel et al. [CBCTIME] have demonstrated a timing attack on CBC padding based on the time required to compute the MAC. To defend against this attack, implementations MUST ensure that record processing time is essentially the same whether or not the padding is correct. In general, the best way to do this is to compute the MAC even if the padding is incorrect, and only then reject the packet. For instance, if the pad appears to be incorrect, the implementation might assume a zero-length pad and then compute the MAC. This leaves a small timing channel, since MAC performance depends to some extent on the size of the data fragment, but it is not believed to be large enough to be exploitable, due to the large block size of existing MACs and the small size of the timing signal. 🕵️♀️
6.3. Key Calculation 🔑
The Record Protocol needs an algorithm to generate keys and MAC secrets from the security parameters provided by the handshake protocol. 🧠
The master secret is hashed into a sequence of secure bytes, which are assigned to the MAC secrets and keys required by the current connection state (see Appendix A.6). CipherSpecs require a client write MAC secret, a server write MAC secret, a client write key, and a server write key, each of which is generated from the master secret in that order. Unused values are empty. ✨
When keys and MAC secrets are generated, the master secret is used as an entropy source. 💜
To generate the key material, compute:
key_block = PRF(SecurityParameters.master_secret,
"key expansion",
SecurityParameters.server_random +
SecurityParameters.client_random);until enough output has been generated. Then the key_block is partitioned as follows:
client_write_MAC_secret[SecurityParameters.hash_size]
server_write_MAC_secret[SecurityParameters.hash_size]
client_write_key[SecurityParameters.key_material_length]
server_write_key[SecurityParameters.key_material_length]Implementation note: The currently defined cipher suite that requires the most material is AES_256_CBC_SHA, defined in [TLSAES]. It requires 2 x 32 byte keys, 2 x 20 byte MAC secrets, and 2 x 16 byte Initialization Vectors, for a total of 136 bytes of key material. 📦
7. The TLS Handshaking Protocols 🤝
TLS has three subprotocols that are used to let peers agree upon security parameters for the record layer, authenticate themselves, instantiate negotiated security parameters, and report error conditions to each other. 💬
The Handshake Protocol is responsible for negotiating a session, which consists of the following items: 📋
- session identifier: an arbitrary byte sequence chosen by the server to identify an active or resumable session state.
- peer certificate: X509v3 [X509] certificate of the peer. This element of the state may be null.
- compression method: the algorithm used to compress data prior to encryption.
- cipher spec: specifies the bulk data encryption algorithm (such as null, DES, etc.) and a MAC algorithm (such as MD5 or SHA). It also defines cryptographic attributes such as the hash_size. (See Appendix A.6 for formal definition.)
- master secret: 48-byte secret shared between the client and server.
- is resumable: a flag indicating whether the session can be used to initiate new connections.
These items are then used to create security parameters for use by the Record Layer when protecting application data. Many connections can be instantiated using the same session through the resumption feature of the TLS Handshake Protocol. 🔁
7.1. Change Cipher Spec Protocol 🔄
The change cipher spec protocol exists to signal transitions in ciphering strategies. The protocol consists of a single message, which is encrypted and compressed under the current (not the pending) connection state. The message consists of a single byte of value 1. 🌈
struct {
enum { change_cipher_spec(1), (255) } type;
} ChangeCipherSpec;The change cipher spec message is sent by both the client and the server to notify the receiving party that subsequent records will be protected under the newly negotiated CipherSpec and keys. Reception of this message causes the receiver to instruct the Record Layer to immediately copy the read pending state into the read current state. 👑
Immediately after sending this message, the sender MUST instruct the record layer to make the write pending state the write active state. (See Section 6.1.) The change cipher spec message is sent during the handshake after the security parameters have been agreed upon, but before the verifying finished message is sent (see Section 7.4.9). 🧁
Note: If a rehandshake occurs while data is flowing on a connection, the communicating parties may continue to send data using the old CipherSpec. However, once the ChangeCipherSpec has been sent, the new CipherSpec MUST be used. The first side to send the ChangeCipherSpec does not know that the other side has finished computing the new keying material (e.g., if it has to perform a time consuming public key operation). Thus, a small window of time, during which the recipient must buffer the data, MAY exist. In practice, with modern machines this interval is likely to be fairly short. ⏳
7.2. Alert Protocol ⚠️
okay so one of the content types the TLS Record layer supports is the alert type 🚨 Alerts tell you how serious something is and what went wrong. A fatal alert immediately ends the connection 💀 Other connections in the same session can keep going, but the session identifier MUST be invalidated so the failed session can't be used to make new connections 🙅♀️ Just like everything else, alerts get encrypted and compressed based on the current connection state 🔐
enum { warning(1), fatal(2), (255) } AlertLevel;
enum {
close_notify(0),
unexpected_message(10),
bad_record_mac(20),
decryption_failed(21),
record_overflow(22),
decompression_failure(30),
handshake_failure(40),
no_certificate_RESERVED (41),
bad_certificate(42),
unsupported_certificate(43),
certificate_revoked(44),
certificate_expired(45),
certificate_unknown(46),
illegal_parameter(47),
unknown_ca(48),
access_denied(49),
decode_error(50),
decrypt_error(51),
export_restriction_RESERVED(60),
protocol_version(70),
insufficient_security(71),
internal_error(80),
user_canceled(90),
no_renegotiation(100),
(255)
} AlertDescription;
struct {
AlertLevel level;
AlertDescription description;
} Alert;7.2.1. Closure Alerts 👋
okay this part is so important 🥹 The client and the server have to both know the connection is ending, or you get a truncation attack 😱 Either party can start the goodbye process 💅
close_notify 💌 This tells the other side that the sender won't send any more messages on this connection. Heads up: starting in TLS 1.1, failing to close a connection properly no longer means the session can't be resumed. That's a change from TLS 1.0 so it matches what implementations were already doing in the wild 🌈
Either party can start a close by sending a close_notify. Any data that shows up after a closure alert gets ignored 🙈
Unless some other fatal alert was already sent, each party is required to send a close_notify before it closes the write side of the connection. The other party MUST respond with its own close_notify and then shut the connection down right away, throwing out any pending writes 🗑️ The one who started the close doesn't have to wait for that response before closing the read side ✨
If the application protocol says data can still travel over the underlying transport after the TLS connection closes, the TLS implementation must receive the responding close_notify before it tells the application layer that the TLS connection is over 🫶 If the application won't send anything else and is only closing the transport, the implementation MAY close the transport without waiting for the responding close_notify 🦋 Nothing in this standard tells a usage profile how to manage its data transport, including when connections get opened or closed. That's their call 💜
Note: It is assumed that closing a connection reliably delivers pending data before destroying the transport. 🧠
7.2.2. Error Alerts 🚩
error handling in the TLS Handshake protocol is honestly so simple 😌 When something goes wrong, the party that noticed sends an alert to the other side. As soon as a fatal alert gets sent or received, both parties close the connection immediately 💨 Servers and clients MUST forget any session-identifiers, keys, and secrets tied to a failed connection 🧹 So a connection that ended with a fatal alert MUST NOT be resumed 🚫 Here are the error alerts that are defined:
unexpected_message 🙃 An inappropriate message showed up. This one is always fatal, and proper implementations should never see it when they're talking to each other.
bad_record_mac 🔑 This alert comes back if a record arrives with a wrong MAC. It also MUST be returned if an alert is being sent because a TLSCiphertext got decrypted in an invalid way, like when it wasn't an even multiple of the block length or its padding values were wrong when checked. This one is always fatal.
decryption_failed 🔓 This alert MAY be returned if a TLSCiphertext got decrypted in an invalid way, meaning it wasn't an even multiple of the block length or its padding values were wrong when checked. This one is always fatal too.
Note: Tellingbad_record_macanddecryption_failedapart may allow certain attacks against CBC mode as used in TLS [CBCATT]. It's better to always usebad_record_macso the specific kind of error stays hidden 🤫
record_overflow 📦💥 A TLSCiphertext record came in with a length over 2^14+2048 bytes, or a record decrypted into a TLSCompressed record with more than 2^14+1024 bytes. Always fatal.
decompression_failure 🗜️ The decompression function got bad input, like data that would expand to an excessive length. Always fatal.
handshake_failure 🤝❌ Getting this alert means the sender couldn't agree on an acceptable set of security parameters from the options it had. It's a fatal error.
no_certificate_RESERVED 🪦 This alert was used in SSLv3 but not in TLS. Compliant implementations should not send it.
bad_certificate 📜 A certificate was corrupt, had signatures that didn't verify correctly, and so on.
unsupported_certificate 🙅 The certificate was of a type that isn't supported.
certificate_revoked ❌ The signer revoked the certificate.
certificate_expired ⏰ The certificate has expired or isn't valid right now.
certificate_unknown ❓ Something else went wrong while processing the certificate, unspecified, and it made the certificate unacceptable.
illegal_parameter 🚫 A field in the handshake was out of range or didn't match other fields. Always fatal.
unknown_ca 🕵️ A valid certificate chain or partial chain came in, but it wasn't accepted because the CA certificate couldn't be found or matched to a known, trusted CA. Always fatal.
access_denied 🛑 A valid certificate was received, but after access control was applied, the sender chose not to continue the negotiation. Always fatal.
decode_error 🧩 A message couldn't be decoded because a field was out of the specified range or the message length was wrong. Always fatal.
decrypt_error 🔐 A handshake cryptographic operation failed. That includes not being able to verify a signature, decrypt a key exchange, or validate a finished message.
export_restriction_RESERVED 🪦 This alert was used in TLS 1.0 but not in TLS 1.1.
protocol_version 🕰️ The client tried to negotiate a protocol version that's recognized but not supported. For example, old versions might be avoided for security reasons. Always fatal.
insufficient_security 🔒 This gets returned instead of handshake_failure when a negotiation failed specifically because the server needs ciphers more secure than what the client supports. Always fatal.
internal_error 🛠️ An internal error that has nothing to do with the peer or with protocol correctness, like a memory allocation failure, makes it impossible to continue. Always fatal.
user_canceled ✋ The handshake is being canceled for a reason that isn't a protocol failure. If the user cancels something after the handshake is already done, just closing the connection with a close_notify is the better move. This alert should be followed by a close_notify. It's usually a warning 💛
no_renegotiation 🔁🚫 The client sends this in response to a hello request, or the server sends it in response to a client hello after the initial handshake. Either of those would normally lead to renegotiation, so when that isn't appropriate, the recipient should respond with this alert. Then the original requester can decide whether to keep going with the connection. One example where this makes sense is when a server has spawned a process to handle a request. That process might get its security parameters (key length, authentication, and so on) at startup, and changing them after that point could be really hard to communicate 🧵 This message is always a warning.
For all errors where an alert level isn't explicitly specified, the sending party MAY decide for itself whether the error is fatal or not. If an alert with a level of warning comes in, the receiving party MAY decide whether to treat it as fatal or not. However, every message that's sent with a level of fatal MUST be treated as fatal ⚡
New alert values MUST be defined by RFC 2434 Standards Action. See Section 11 for IANA Considerations for alert values 📋
7.3. Handshake Protocol Overview 🎀
okay so the cryptographic parameters of the session state are cooked up by the TLS Handshake Protocol, which runs right on top of the TLS Record Layer 🧁 when a TLS client and server first start talking, they agree on a protocol version, pick their cryptographic algorithms, optionally authenticate each other, and use public-key encryption to generate shared secrets 🔐
the TLS Handshake Protocol has these steps:
- Exchange hello messages to agree on algorithms, exchange random values, and check for session resumption.
- Exchange the necessary cryptographic parameters so the client and server can agree on a premaster secret.
- Exchange certificates and cryptographic information so the client and server can authenticate themselves.
- Generate a master secret from the premaster secret and the exchanged random values.
- Provide security parameters to the record layer.
- Let the client and server verify that their peer calculated the same security parameters and that the handshake happened without an attacker tampering with it 🕵️♀️
ngl this next bit is so important bestie 🫶 higher layers should not be overly reliant on whether TLS always negotiates the strongest possible connection between two peers. a man-in-the-middle attacker has a bunch of ways to try to make two entities drop down to the least secure method they support 😤 the protocol was designed to minimize this risk, but attacks are still possible. for example, an attacker could block access to the port a secure service runs on, or try to get the peers to negotiate an unauthenticated connection. the fundamental rule is that higher levels must be cognizant of their own security requirements and never transmit information over a channel less secure than what they require 💅 TLS is secure in the sense that any cipher suite offers its promised level of security: if you negotiate 3DES with a 1024 bit RSA key exchange with a host whose certificate you have verified, you can expect to be that secure ✨
However, one SHOULD never send data over a link encrypted with 40-bit security unless one feels that data is worth no more than the effort required to break that encryption. 🙈
so the handshake protocol is how all these goals get achieved 🦋 the client sends a client hello message, and the server MUST respond with a server hello message, or else a fatal error happens and the connection fails 💀 the client hello and server hello are used to set up security enhancement capabilities between client and server. they establish the Protocol Version, Session ID, Cipher Suite, and Compression Method. on top of that, two random values get generated and exchanged: ClientHello.random and ServerHello.random 🌸
the actual key exchange uses up to four messages: the server certificate, the server key exchange, the client certificate, and the client key exchange. new key exchange methods can be made by specifying a format for these messages and defining how they're used so the client and server agree on a shared secret. this secret MUST be quite long 🔥 the key exchange methods defined so far exchange secrets that are 48 to 128 bytes long.
after the hello messages, the server sends its certificate if it's going to be authenticated. a server key exchange message may also be sent, if it's required (for example, if the server has no certificate, or if its certificate is for signing only) ✨ if the server is authenticated, it MAY request a certificate from the client, if that fits the cipher suite that was selected. next, the server sends the server hello done message, which says the hello-message phase is finished. then the server waits for a client response 👀 if the server sent a certificate request message, the client MUST send the certificate message. the client key exchange message comes next, and what's in it depends on the public key algorithm selected between the client hello and the server hello. if the client has sent a certificate with signing ability, a digitally-signed certificate verify message is sent to explicitly verify the certificate 🧚
then it's time for the change cipher spec message 💖 the client sends it, and the client copies the pending Cipher Spec into the current Cipher Spec. the client then immediately sends the finished message under the new algorithms, keys, and secrets. the server responds with its own change cipher spec message, moves the pending Cipher Spec to the current one, and sends its finished message under the new Cipher Spec. and just like that, the handshake is complete, and client and server MAY begin to exchange application layer data 🎉 (check the flow chart below, it's giving clarity.) Application data MUST NOT be sent before the first handshake is complete (before a cipher suite other than TLS_NULL_WITH_NULL_NULL is established).
Client Server
ClientHello -------->
ServerHello
Certificate*
ServerKeyExchange*
CertificateRequest*
<-------- ServerHelloDone
Certificate*
ClientKeyExchange
CertificateVerify*
[ChangeCipherSpec]
Finished -------->
[ChangeCipherSpec]
<-------- Finished
Application Data <-------> Application Data
Fig. 1. Message flow for a full handshake
* Indicates optional or situation-dependent messages that are not
always sent.Note: To help avoid pipeline stalls, ChangeCipherSpec is an independent TLS Protocol content type, and is not actually a TLS handshake message. 🧠
now when the client and server decide to resume a previous session or duplicate an existing one (instead of negotiating new security parameters), the flow looks different 💜 the client sends a ClientHello using the Session ID of the session it wants to resume. then the server checks its session cache for a match.
if a match is found and the server is willing to re-establish the connection under that session state, it sends a ServerHello with the same Session ID value. at this point, both client and server MUST send change cipher spec messages and go straight to finished messages 🏃♀️ once the re-establishment is complete, client and server MAY begin to exchange application layer data. (see the flow chart below, periodt.) if no Session ID match is found, the server generates a new session ID and the TLS client and server do a full handshake instead 🙌
Client Server
ClientHello -------->
ServerHello
[ChangeCipherSpec]
<-------- Finished
[ChangeCipherSpec]
Finished -------->
Application Data <-------> Application Data
Fig. 2. Message flow for an abbreviated handshakethe contents and meaning of each message get the full breakdown in the sections that come next 📚
7.4. Handshake Protocol 🧁
the TLS Handshake Protocol is one of the defined higher-level clients of the TLS Record Protocol 💅 it's the thing that negotiates the secure attributes of a session. handshake messages get handed to the TLS Record Layer, where they're wrapped up in one or more TLSPlaintext structures, which are processed and sent as specified by the current active session state.
enum {
hello_request(0), client_hello(1), server_hello(2),
certificate(11), server_key_exchange (12),
certificate_request(13), server_hello_done(14),
certificate_verify(15), client_key_exchange(16),
finished(20), (255)
} HandshakeType;
struct {
HandshakeType msg_type; /* handshake type */
uint24 length; /* bytes in message */
select (HandshakeType) {
case hello_request: HelloRequest;
case client_hello: ClientHello;
case server_hello: ServerHello;
case certificate: Certificate;
case server_key_exchange: ServerKeyExchange;
case certificate_request: CertificateRequest;
case server_hello_done: ServerHelloDone;
case certificate_verify: CertificateVerify;
case client_key_exchange: ClientKeyExchange;
case finished: Finished;
} body;
} Handshake;the handshake protocol messages are listed below in the order they MUST be sent 📋 sending handshake messages in an unexpected order results in a fatal error. unneeded handshake messages can be left out, though 🙆♀️ there's one exception to the ordering: the Certificate message gets used twice in the handshake (from server to client, then from client to server), but it's only described in its first position. the one message that isn't bound by these ordering rules is the Hello Request message, which can be sent at any time, but which should be ignored by the client if it shows up in the middle of a handshake 🙈
New Handshake message type values MUST be defined via RFC 2434 Standards Action. see Section 11 for IANA Considerations for these values 📝
7.4.1. Hello Messages 👋
the hello phase messages are used to exchange security enhancement capabilities between the client and server 💖 when a new session begins, the Record Layer's connection state encryption, hash, and compression algorithms are initialized to null. the current connection state is used for renegotiation messages.
7.4.1.1. Hello request 🌈
When this message will be sent:
The hello request message MAY be sent by the server at any time.
Meaning of this message:
Hello request is a simple notification that the client should begin the negotiation process anew by sending a client hello message when convenient. this message will be ignored by the client if the client is currently negotiating a session. this message may be ignored by the client if it does not wish to renegotiate a session, or the client may, if it wishes, respond with a no_renegotiation alert. since handshake messages are intended to have transmission precedence over application data, the negotiation is expected to begin before no more than a few records are received from the client. if the server sends a hello request but does not receive a client hello in response, it may close the connection with a fatal alert. after sending a hello request, servers SHOULD not repeat the request until the subsequent handshake negotiation is complete. 🙃
Structure of this message:
struct { } HelloRequest;Note: This message MUST NOT be included in the message hashes that are maintained throughout the handshake and used in the finished messages and the certificate verify message. 🫣
7.4.1.2. Client Hello 🎀
When this message will be sent:
Okay bestie, when a client first connects to a server it is required to send the client hello as its first message 💖 The client can also send one in response to a hello request, or on its own initiative, to renegotiate the security parameters of an existing connection ✨
Structure of this message:
The client hello message includes a random structure that gets used later in the protocol 🦋
struct {
uint32 gmt_unix_time;
opaque random_bytes[28];
} Random;gmt_unix_time: the current time and date in standard UNIX 32-bit format (seconds since the midnight starting Jan 1, 1970, GMT, ignoring leap seconds), according to the sender's internal clock. Clocks are not required to be set correctly by the basic TLS Protocol, though higher-level or application protocols may define additional requirements 🕰️random_bytes: 28 bytes generated by a secure random number generator 🎲
The client hello message includes a variable-length session identifier 🧚 If it isn't empty, the value identifies a session between the same client and server whose security parameters the client wants to reuse. The session identifier MAY be from an earlier connection, from this connection, or from another currently active connection. The second option is useful if the client only wants to update the random structures and derived values of a connection. The third option lets you set up several independent secure connections without repeating the full handshake protocol, and those connections may happen sequentially or simultaneously 🌈 A SessionID becomes valid when the handshake negotiating it completes with the exchange of Finished messages, and it sticks around until it's removed due to aging or because a fatal error was encountered on a connection associated with the session. The actual contents of the SessionID are defined by the server 👑
opaque SessionID<0..32>;Warning: Because the SessionID is transmitted without encryption or immediate MAC protection, servers MUST not place confidential information in session identifiers or let the contents of fake session identifiers cause any breach of security. (Note that the content of the handshake as a whole, including the SessionID, is protected by the Finished messages exchanged at the end of the handshake.) 🙈💀
The CipherSuite list, passed from the client to the server in the client hello message, contains the combinations of cryptographic algorithms the client supports, in order of the client's preference (favorite choice first) 🍓 Each CipherSuite defines a key exchange algorithm, a bulk encryption algorithm (including secret key length), and a MAC algorithm. The server will select a cipher suite or, if no acceptable choices are presented, return a handshake failure alert and close the connection 🔥
uint8 CipherSuite[2]; /* Cryptographic suite selector */The client hello also includes a list of compression algorithms the client supports, ordered according to its preference 🌸
enum { null(0), (255) } CompressionMethod;
struct {
ProtocolVersion client_version;
Random random;
SessionID session_id;
CipherSuite cipher_suites<2..2^16-1>;
CompressionMethod compression_methods<1..2^8-1>;
} ClientHello;client_version: the version of the TLS protocol the client wants to communicate with during this session. This SHOULD be the latest (highest valued) version the client supports. For this version of the specification, the version will be 3.2. (See Appendix E for details about backward compatibility.) 📌random: a client-generated random structure 🎲session_id: the ID of a session the client wants to use for this connection. This field should be empty if no session_id is available or if the client wants to generate new security parameters 💫cipher_suites: a list of the cryptographic options the client supports, with the client's first preference first. If the session_id field is not empty (implying a session resumption request), this vector MUST include at least the cipher_suite from that session. Values are defined in Appendix A.5. 🧁compression_methods: a list of the compression methods the client supports, sorted by client preference. If the session_id field is not empty (implying a session resumption request), it MUST include the compression_method from that session. This vector MUST contain, and all implementations MUST support, CompressionMethod.null. That way, a client and server will always be able to agree on a compression method 🤝
After sending the client hello message, the client waits for a server hello message. Any other handshake message returned by the server, except for a hello request, is treated as a fatal error 🚨
Forward compatibility note: for forward compatibility, a client hello message is permitted to include extra data after the compression methods. This data MUST be included in the handshake hashes, but must otherwise be ignored. This is the only handshake message for which this is legal; for all other messages, the amount of data in the message MUST match the description of the message precisely 🔮
Note: For the intended use of trailing data in the ClientHello, see RFC 3546 [TLSEXT].
7.4.1.3. Server Hello 🌷
The server will send this message in response to a client hello message when it was able to find an acceptable set of algorithms. If it cannot find such a match, it will respond with a handshake failure alert 🙅♀️
Structure of this message:
struct {
ProtocolVersion server_version;
Random random;
SessionID session_id;
CipherSuite cipher_suite;
CompressionMethod compression_method;
} ServerHello;server_version: this field will contain the lower of the version suggested by the client in the client hello and the highest version supported by the server. For this version of the specification, the version is 3.2. (See Appendix E for details about backward compatibility.) 🎀random: this structure is generated by the server and MUST be independently generated from the ClientHello.random. 🎲session_id: this is the identity of the session corresponding to this connection. If the ClientHello.session_id was non-empty, the server will look in its session cache for a match. If a match is found and the server is willing to establish the new connection using the specified session state, the server will respond with the same value the client supplied. This indicates a resumed session and dictates that the parties must proceed directly to the finished messages. Otherwise, this field will contain a different value identifying the new session. The server may return an empty session_id to indicate that the session will not be cached and therefore cannot be resumed. If a session is resumed, it must be resumed using the same cipher suite it was originally negotiated with 🧚cipher_suite: the single cipher suite selected by the server from the list in ClientHello.cipher_suites. For resumed sessions, this field is the value from the state of the session being resumed. 🍓compression_method: the single compression algorithm selected by the server from the list in ClientHello.compression_methods. For resumed sessions, this field is the value from the resumed session state. 🌸
7.4.2. Server Certificate 🦋
When this message will be sent:
The server MUST send a certificate whenever the agreed-upon key exchange method is not an anonymous one. This message will always immediately follow the server hello message 🔐
Meaning of this message:
The certificate type MUST be appropriate for the selected cipher suite's key exchange algorithm, and is generally an X.509v3 certificate. It MUST contain a key that matches the key exchange method, as follows. Unless otherwise specified, the signing algorithm for the certificate MUST be the same as the algorithm for the certificate key. Unless otherwise specified, the public key MAY be of any length 💅
Key Exchange Algorithm Certificate Key Type
RSA RSA public key; the certificate MUST
allow the key to be used for encryption.
DHE_DSS DSS public key.
DHE_RSA RSA public key that can be used for
signing.
DH_DSS Diffie-Hellman key. The algorithm used
to sign the certificate MUST be DSS.
DH_RSA Diffie-Hellman key. The algorithm used
to sign the certificate MUST be RSA.All certificate profiles and key and cryptographic formats are defined by the IETF PKIX working group [PKIX]. When a key usage extension is present, the digitalSignature bit MUST be set for the key to be eligible for signing, as described above, and the keyEncipherment bit MUST be present to allow encryption, as described above. The keyAgreement bit must be set on Diffie-Hellman certificates 📜
As CipherSuites that specify new key exchange methods are specified for the TLS Protocol, they will imply certificate format and the required encoded keying information ✨
Structure of this message:
opaque ASN.1Cert<1..2^24-1>;
struct {
ASN.1Cert certificate_list<0..2^24-1>;
} Certificate;certificate_list: this is a sequence (chain) of X.509v3 certificates. The sender's certificate must come first in the list. Each following certificate must directly certify the one preceding it. Because certificate validation requires that root keys be distributed independently, the self-signed certificate that specifies the root certificate authority may optionally be omitted from the chain, under the assumption that the remote end must already possess it in order to validate it in any case 🌈
The same message type and structure will be used for the client's response to a certificate request message. Note that a client MAY send no certificates if it does not have an appropriate certificate to send in response to the server's authentication request 🫶
Note: PKCS #7 [PKCS7] is not used as the format for the certificate vector because PKCS #6 [PKCS6] extended certificates are not used. Also, PKCS #7 defines a SET rather than a SEQUENCE, making the task of parsing the list more difficult. 💜
7.4.3. Server Key Exchange Message ✨
When this message will be sent 💅
Okay bestie, this message goes out immediately after the server certificate message, or right after the server hello message if this is an anonymous negotiation 🫶
The server only sends the server key exchange message when the server certificate message (if sent) doesn't have enough data for the client to exchange a premaster secret. That's true for these key exchange methods:
DHE_DSSDHE_RSADH_anon
It is not legal to send the server key exchange message for these ones, so don't even try 🙈
RSADH_DSSDH_RSA
Meaning of this message 🔥
This message carries the crypto info the client needs to communicate the premaster secret. That's either an RSA public key to encrypt the premaster secret with, or a Diffie-Hellman public key so the client can finish a key exchange and end up with the premaster secret. Iconic. 👑
As more CipherSuites get defined for TLS with new key exchange algorithms, the server key exchange message will be sent if and only if the certificate type tied to that key exchange algorithm doesn't give the client enough info to exchange a premaster secret. Main character energy for the protocol 💖
Structure of this message ✨
enum { rsa, diffie_hellman } KeyExchangeAlgorithm;
struct {
opaque rsa_modulus<1..2^16-1>;
opaque rsa_exponent<1..2^16-1>;
} ServerRSAParams;rsa_modulus: the modulus of the server's temporary RSA key.rsa_exponent: the public exponent of the server's temporary RSA key.
struct {
opaque dh_p<1..2^16-1>;
opaque dh_g<1..2^16-1>;
opaque dh_Ys<1..2^16-1>;
} ServerDHParams; /* Ephemeral DH parameters */dh_p: the prime modulus used for the Diffie-Hellman operation.dh_g: the generator used for the Diffie-Hellman operation.dh_Ys: the server's Diffie-Hellman public value (g^X mod p).
struct {
select (KeyExchangeAlgorithm) {
case diffie_hellman:
ServerDHParams params;
Signature signed_params;
case rsa:
ServerRSAParams params;
Signature signed_params;
};
} ServerKeyExchange;
struct {
select (KeyExchangeAlgorithm) {
case diffie_hellman:
ServerDHParams params;
case rsa:
ServerRSAParams params;
};
} ServerParams;params: the server's key exchange parameters.signed_params: for non-anonymous key exchanges, a hash of the correspondingparamsvalue, with the signature appropriate to that hash applied.md5_hash:MD5(ClientHello.random + ServerHello.random + ServerParams);sha_hash:SHA(ClientHello.random + ServerHello.random + ServerParams);
enum { anonymous, rsa, dsa } SignatureAlgorithm;
struct {
select (SignatureAlgorithm) {
case anonymous: struct { };
case rsa:
digitally-signed struct {
opaque md5_hash[16];
opaque sha_hash[20];
};
case dsa:
digitally-signed struct {
opaque sha_hash[20];
};
};
} Signature;7.4.4. Certificate request
When this message will be sent 🎀
A non-anonymous server can optionally request a certificate from the client, if that's appropriate for the selected cipher suite 🦋
If this message gets sent, it comes right after the Server Key Exchange message (if that one is sent; otherwise, it comes after the Server Certificate message).
Structure of this message 🧚
enum {
rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
rsa_ephemeral_dh_RESERVED(5), dss_ephemeral_dh_RESERVED(6),
fortezza_dms_RESERVED(20),
(255)
} ClientCertificateType;
opaque DistinguishedName<1..2^16-1>;
struct {
ClientCertificateType certificate_types<1..2^8-1>;
DistinguishedName certificate_authorities<0..2^16-1>;
} CertificateRequest;certificate_types: a list of the types of certificates requested, sorted in order of the server's preference.certificate_authorities: a list of the distinguished names of acceptable certificate authorities. These distinguished names may specify a desired distinguished name for a root CA or for a subordinate CA, so this message can be used to describe both known roots and a desired authorization space 🌈 If thecertificate_authoritieslist is empty, then the client MAY send any certificate of the appropriateClientCertificateType, unless there is some external arrangement to the contrary.
ClientCertificateType values are split into three groups, and it's giving organization 📋
- Values from 0 (zero) through 63 decimal (0x3F) inclusive are reserved for IETF Standards Track protocols.
- Values from 64 decimal (0x40) through 223 decimal (0xDF) inclusive are reserved for assignment for non-Standards Track methods.
- Values from 224 decimal (0xE0) through 255 decimal (0xFF) inclusive are reserved for private use.
Extra info about IANA's role in handing out ClientCertificateType code points is in Section 11 🌸
Note: Values listed as RESERVED may not be used. They were used in SSLv3.
Note: DistinguishedName is derived from [X501]. DistinguishedNames are represented in DER-encoded format.
Note: It is a fatal handshake_failure alert for an anonymous server to request client authentication. 💀
7.4.5. Server Hello Done
When this message will be sent 🌈
The server hello done message is sent by the server to say it's finished with the server hello and its associated messages. After sending it, the server waits for a client response 🫶
Meaning of this message 💜
This message means the server is done sending the messages needed to support the key exchange, so the client can move on with its part of the key exchange ✨
When the client gets the server hello done message, the client SHOULD verify that the server provided a valid certificate (if one is required) and check that the server hello parameters are acceptable. Double-check before you proceed, bestie 🔍
Structure of this message 🍓
struct { } ServerHelloDone;7.4.6. Client certificate
When this message will be sent 🦋
This is the first message the client can send after receiving a server hello done message. It only gets sent if the server requests a certificate. If no suitable certificate is available, the client SHOULD send a certificate message containing no certificates, meaning the certificate_list structure has a length of zero 🙈 If the server requires client authentication for the handshake to continue, it may respond with a fatal handshake failure alert 💀 Client certificates are sent using the Certificate structure defined in Section 7.4.2.
Note: When using a static Diffie-Hellman based key exchange method (DH_DSS or DH_RSA), if client authentication is requested, the Diffie-Hellman group and generator encoded in the client's certificate MUST match the server specified Diffie-Hellman parameters if the client's parameters are to be used for the key exchange. This one is serious, no cap. 🚨
7.4.7. Client Key Exchange Message
When this message will be sent 💖
This message is always sent by the client. It MUST immediately follow the client certificate message, if one is sent. Otherwise, it MUST be the first message the client sends after receiving the server hello done message ✨
Meaning of this message 🔥
This message sets the premaster secret, either by directly transmitting the RSA-encrypted secret or by transmitting Diffie-Hellman parameters that let each side agree on the same premaster secret. When the key exchange method is DH_RSA or DH_DSS, client certification was requested, and the client responded with a certificate containing a Diffie-Hellman public key whose parameters (group and generator) matched the ones the server specified in its certificate, this message MUST not contain any data. Stop, it's so precise 😭
Structure of this message 🧚
The message you send depends on which key exchange method was selected. See Section 7.4.3 for the KeyExchangeAlgorithm definition.
struct {
select (KeyExchangeAlgorithm) {
case rsa: EncryptedPreMasterSecret;
case diffie_hellman: ClientDiffieHellmanPublic;
} exchange_keys;
} ClientKeyExchange;7.4.7.1. RSA Encrypted Premaster Secret Message ✨
Meaning of this message: okay so if RSA is handling both key agreement and authentication 🔐, the client makes a 48-byte premaster secret, encrypts it with the public key from the server's certificate (or the temporary RSA key from a server key exchange message), and sends the result in an encrypted premaster secret message. This one isn't really its own message. It's a variant of the client key exchange message, so it's not a message in itself 💅
Structure of this message:
struct {
ProtocolVersion client_version;
opaque random[46];
} PreMasterSecret;
client_version The latest (newest) version supported by the
client. This is used to detect version roll-back attacks.
Upon receiving the premaster secret, the server SHOULD check
that this value matches the value transmitted by the client in
the client hello message.
random
46 securely-generated random bytes.
struct {
public-key-encrypted PreMasterSecret pre_master_secret;
} EncryptedPreMasterSecret;
pre_master_secret
This random value is generated by the client and is used to
generate the master secret, as specified in Section 8.1.The client_version is the newest version the client supports, and it's how the server catches version roll-back attacks 🕵️♀️. When the server gets the premaster secret, it SHOULD check that this value matches what the client sent in the client hello. The random part is 46 securely-generated random bytes 🎲. The pre_master_secret is the random value the client generates to build the master secret, as covered in Section 8.1.
Note: An attack discovered by Daniel Bleichenbacher [BLEI] can be used to attack a TLS server that is using PKCS#1 v 1.5 encoded RSA. The attack takes advantage of the fact that, by failing in different ways, a TLS server can be coerced into revealing whether a particular message, when decrypted, is properly PKCS#1 v1.5 formatted or not.
Honestly this one is scary 😭. The best way to avoid it is to treat incorrectly formatted messages in a manner indistinguishable from correctly formatted RSA blocks. So when a server gets an incorrectly formatted RSA block, it should generate a random 48-byte value and proceed using it as the premaster secret. That way the server acts exactly the same whether the RSA block was encoded correctly or not 🛡️.
[PKCS1B] defines a newer version of PKCS#1 encoding that is more secure against the Bleichenbacher attack. However, for maximal compatibility with TLS 1.0, TLS 1.1 keeps the original encoding 🍓. No variants of the Bleichenbacher attack are known to exist provided that the above recommendations are followed ✨.
Implementation Note: Public-key-encrypted data is represented as an opaque vector <0..2^16-1> (see Section 4.7). So the RSA-encrypted PreMasterSecret in a ClientKeyExchange is preceded by two length bytes. These bytes are redundant in the case of RSA, because the EncryptedPreMasterSecret is the only data in the ClientKeyExchange and its length can therefore be unambiguously determined. The SSLv3 specification was not clear about the encoding of public-key-encrypted data, so many SSLv3 implementations do not include the length bytes, encoding the RSA encrypted data directly in the ClientKeyExchange message 🤷♀️.
This specification requires correct encoding of the EncryptedPreMasterSecret complete with length bytes. The resulting PDU is incompatible with many SSLv3 implementations. Implementors upgrading from SSLv3 must modify their implementations to generate and accept the correct encoding. Implementors who wish to be compatible with both SSLv3 and TLS should make their implementation's behavior dependent on the protocol version 🧚.
Implementation Note: It is now known that remote timing-based attacks on SSL are possible, at least when the client and server are on the same LAN. Accordingly, implementations that use static RSA keys SHOULD use RSA blinding or some other anti-timing technique, as described in [TIMING] ⏱️.
Note: The version number in the PreMasterSecret MUST be the version offered by the client in the ClientHello, not the version negotiated for the connection. This feature is designed to prevent rollback attacks. Unfortunately, many implementations use the negotiated version instead, and therefore checking the version number may lead to failure to interoperate with such incorrect client implementations. Client implementations, MUST and Server implementations MAY, check the version number. In practice, since the TLS handshake MACs prevent downgrade and no good attacks are known on those MACs, ambiguity is not considered a serious security risk. Note that if servers choose to check the version number, they should randomize the PreMasterSecret in case of error, rather than generate an alert, in order to avoid variants on the Bleichenbacher attack. [KPR03]
7.4.7.2. Client Diffie-Hellman Public Value 🌸
Meaning of this message: this structure carries the client's Diffie-Hellman public value (Yc), but only if it wasn't already included in the client's certificate. The encoding for Yc is picked by the enumerated PublicValueEncoding. Again, this is a variant of the client key exchange message and not a message in itself 🦋.
Structure of this message:
enum { implicit, explicit } PublicValueEncoding;
implicit
If the client certificate already contains a suitable Diffie-
Hellman key, then Yc is implicit and does not need to be sent
again. In this case, the client key exchange message will be
sent, but it MUST be empty.
explicit
Yc needs to be sent.
struct {
select (PublicValueEncoding) {
case implicit: struct { };
case explicit: opaque dh_Yc<1..2^16-1>;
} dh_public;
} ClientDiffieHellmanPublic;
dh_Yc
The client's Diffie-Hellman public value (Yc).So if the client cert already has a usable Diffie-Hellman key, Yc is implicit and doesn't get sent again. The client key exchange message still gets sent, but it MUST be empty 🫥. If the cert doesn't have one, Yc is explicit and it needs to be sent 📨.
7.4.8. Certificate verify 🔏
When this message will be sent: this message gives explicit verification of a client certificate. It's only sent after a client certificate that has signing capability (basically every certificate except the ones with fixed Diffie-Hellman parameters). When it's sent, it MUST immediately follow the client key exchange message 💖.
Structure of this message:
struct {
Signature signature;
} CertificateVerify;The Signature type is defined in 7.4.3.
CertificateVerify.signature.md5_hash
MD5(handshake_messages);
CertificateVerify.signature.sha_hash
SHA(handshake_messages);Here handshake_messages refers to all handshake messages sent or received starting at client hello up to but not including this message, including the type and length fields of the handshake messages. This is the concatenation of all the Handshake structures, as defined in 7.4, exchanged thus far 🧩.
7.4.9. Finished 🎀
When this message will be sent: a Finished message is always sent right after a change cipher spec message, to verify that the key exchange and authentication processes were successful ✅. It is essential that a change cipher spec message be received between the other handshake messages and the Finished message 🚨.
Meaning of this message: the Finished message is the first one protected with the just-negotiated algorithms, keys, and secrets 🔒. Recipients of Finished messages MUST verify that the contents are correct. Once a side has sent its Finished message and has received and validated the Finished message from its peer, it may begin to send and receive application data over the connection 🎉.
struct {
opaque verify_data[12];
} Finished;
verify_data
PRF(master_secret, finished_label, MD5(handshake_messages) +
SHA-1(handshake_messages)) [0..11];
finished_label
For Finished messages sent by the client, the string "client
finished". For Finished messages sent by the server, the
string "server finished".
handshake_messages
All of the data from all messages in this handshake (not
including any HelloRequest messages) up to but not including
this message. This is only data visible at the handshake
layer and does not include record layer headers. This is the
concatenation of all the Handshake structures, as defined in
7.4, exchanged thus far.It is a fatal error if a Finished message is not preceded by a change cipher spec message at the appropriate point in the handshake 💀.
The handshake_messages value includes all handshake messages starting at client hello up to, but not including, this Finished message. This may be different from handshake_messages in Section 7.4.8, because it would include the certificate verify message (if sent). Also, the handshake_messages for the Finished message sent by the client will be different from the one sent by the server, because the one that gets sent second will include the prior one 🙈.
Note: Change cipher spec messages, alerts, and any other record types are not handshake messages and are not included in the hash computations. Also, Hello Request messages are omitted from handshake hashes 🍓.
8. Cryptographic Computations ✨
In order to begin connection protection, the TLS Record Protocol needs a specific suite of algorithms, a master secret, and the client and server random values 🔑. The authentication, encryption, and MAC algorithms are determined by the cipher_suite the server selects and reveals in the server hello message. The compression algorithm is negotiated in the hello messages, and the random values are exchanged in the hello messages too 👯. All that's left is to calculate the master secret 🧁.
8.1. Computing the Master Secret 👑
For all key exchange methods, the same algorithm is used to convert the pre_master_secret into the master_secret. The pre_master_secret should be deleted from memory once the master_secret has been computed 🧹.
master_secret = PRF(pre_master_secret, "master secret",
ClientHello.random + ServerHello.random)
[0..47];The master secret is always exactly 48 bytes long. The length of the premaster secret varies depending on the key exchange method 📏.
8.1.1. RSA 🔐
When RSA is used for server authentication and key exchange, a 48-byte pre_master_secret is generated by the client, encrypted under the server's public key, and sent to the server. The server uses its private key to decrypt the pre_master_secret. Both parties then convert the pre_master_secret into the master_secret, as specified above 💅.
RSA digital signatures are performed using PKCS #1 [PKCS1] block type 1. RSA public key encryption is performed using PKCS #1 block type 2 🦋.
8.1.2. Diffie-Hellman 💖
okay so for Diffie-Hellman, you just do a normal, conventional DH computation 🧮✨. The negotiated key (Z) gets used as the pre_master_secret, and then it gets turned into the master_secret the same way we did above 🔁. Before it's used as the pre_master_secret, any leading bytes of Z that are all zero bits get stripped off 🫧.
Note: the server is the one who specifies the Diffie-Hellman parameters, and those parameters can be ephemeral or can live inside the server's certificate 🎀.
9. Mandatory Cipher Suites 🔐
unless an application profile standard says otherwise, a TLS compliant application MUST implement the cipher suite TLS_RSA_WITH_3DES_EDE_CBC_SHA 💅.
10. Application Data Protocol 📦
application data messages ride along on the Record Layer 🛤️. On the way they get fragmented, compressed, and encrypted, all depending on the current connection state 🔒. To the record layer, these messages are just transparent data, no judgment 🫶.
11. Security Considerations 💀
ok this part is SERIOUS 😭. Security issues come up all over this memo, but the big ones are in Appendices D, E, and F 🚨. Go read those, bestie, no skipping 🙈.
12. IANA Considerations 🦋
this document creates a bunch of new registries that IANA set up 🗂️. The suggestion is to put each of them as its own registry item under one shared TLS category 🌸.
Section 7.4.3 describes a TLS ClientCertificateType Registry that IANA maintains, and it holds a bunch of code point identifiers 🧚. ClientCertificateType identifiers in the range 0-63 (decimal) inclusive get assigned through RFC 2434 Standards Action 📜. Values from 64-223 (decimal) inclusive get assigned through [RFC2434] Specification Required 📝. Identifier values from 224-255 (decimal) inclusive are reserved for RFC 2434 Private Use 🔒. The registry starts out populated with the values in this document, plus Section 7.4.4 🌈.
Section A.5 describes a TLS Cipher Suite Registry that IANA maintains, and it defines a bunch of cipher suite identifiers 🎀. Cipher suite values whose first byte is in the range 0-191 (decimal) inclusive get assigned through RFC 2434 Standards Action ⭐. Values whose first byte is in the range 192-254 (decimal) get assigned through RFC 2434 Specification Required 📝. Values whose first byte is 255 (decimal) are reserved for RFC 2434 Private Use 🔐. The registry starts out populated with the values from Section A.5 of this document, [TLSAES], and Section 3 of [TLSKRB] 💜.
Section 6 says that every ContentType value has to be defined by RFC 2434 Standards Action 🎯. IANA made a TLS ContentType registry, which starts out populated with the values from Section 6.2.1 of this document 🗃️. Future values MUST be allocated via Standards Action as described in [RFC2434] 👑.
Section 7.2.2 says that every Alert value has to be defined by RFC 2434 Standards Action 🚨. IANA made a TLS Alert registry, which starts out populated with the values from Section 7.2 of this document and from Section 4 of [TLSEXT] 🦋. Future values MUST be allocated via Standards Action as described in [RFC2434] 💅.
Section 7.4 says that every HandshakeType value has to be defined by RFC 2434 Standards Action 🍓. IANA made a TLS HandshakeType registry, which starts out populated with the values from Section 7.4 of this document and from Section 2.4 of [TLSEXT] ✨. Future values MUST be allocated via Standards Action as described in [RFC2434] 🫶.
Appendix A. Protocol Constant Values 🎀
this section is all about protocol types and constants 🧩.
A.1. Record Layer 📼
struct {
uint8 major, minor;
} ProtocolVersion;
ProtocolVersion version = { 3, 2 }; /* TLS v1.1 */
enum {
change_cipher_spec(20), alert(21), handshake(22),
application_data(23), (255)
} ContentType;
struct {
ContentType type;
ProtocolVersion version;
uint16 length;
opaque fragment[TLSPlaintext.length];
} TLSPlaintext;
struct {
ContentType type;
ProtocolVersion version;
uint16 length;
opaque fragment[TLSCompressed.length];
} TLSCompressed;
struct {
ContentType type;
ProtocolVersion version;
uint16 length;
select (CipherSpec.cipher_type) {
case stream: GenericStreamCipher;
case block: GenericBlockCipher;
} fragment;
} TLSCiphertext;
stream-ciphered struct {
opaque content[TLSCompressed.length];
opaque MAC[CipherSpec.hash_size];
} GenericStreamCipher;
block-ciphered struct {
opaque IV[CipherSpec.block_length];
opaque content[TLSCompressed.length];
opaque MAC[CipherSpec.hash_size];
uint8 padding[GenericBlockCipher.padding_length];
uint8 padding_length;
} GenericBlockCipher;A.2. Change Cipher Specs Message 🦢
struct {
enum { change_cipher_spec(1), (255) } type;
} ChangeCipherSpec;A.3. Alert Messages 🚨
enum { warning(1), fatal(2), (255) } AlertLevel;
enum {
close_notify(0),
unexpected_message(10),
bad_record_mac(20),
decryption_failed(21),
record_overflow(22),
decompression_failure(30),
handshake_failure(40),
no_certificate_RESERVED (41),
bad_certificate(42),
unsupported_certificate(43),
certificate_revoked(44),
certificate_expired(45),
certificate_unknown(46),
illegal_parameter(47),
unknown_ca(48),
access_denied(49),
decode_error(50),
decrypt_error(51),
export_restriction_RESERVED(60),
protocol_version(70),
insufficient_security(71),
internal_error(80),
user_canceled(90),
no_renegotiation(100),
(255)
} AlertDescription;
struct {
AlertLevel level;
AlertDescription description;
} Alert;A.4. Handshake Protocol 🤝
enum {
hello_request(0), client_hello(1), server_hello(2),
certificate(11), server_key_exchange (12),
certificate_request(13), server_hello_done(14),
certificate_verify(15), client_key_exchange(16),
finished(20), (255)
} HandshakeType;
struct {
HandshakeType msg_type;
uint24 length;
select (HandshakeType) {
case hello_request: HelloRequest;
case client_hello: ClientHello;
case server_hello: ServerHello;
case certificate: Certificate;
case server_key_exchange: ServerKeyExchange;
case certificate_request: CertificateRequest;
case server_hello_done: ServerHelloDone;
case certificate_verify: CertificateVerify;
case client_key_exchange: ClientKeyExchange;
case finished: Finished;
} body;
} Handshake;A.4.1. Hello messages 👋
struct { } HelloRequest;
struct {
uint32 gmt_unix_time;
opaque random_bytes[28];
} Random;
opaque SessionID<0..32>;
uint8 CipherSuite[2];
enum { null(0), (255) } CompressionMethod;
struct {
ProtocolVersion client_version;
Random random;
SessionID session_id;
CipherSuite cipher_suites<2..2^16-1>;
CompressionMethod compression_methods<1..2^8-1>;
} ClientHello;
struct {
ProtocolVersion server_version;
Random random;
SessionID session_id;
CipherSuite cipher_suite;
CompressionMethod compression_method;
} ServerHello;A.4.2. Server Authentication and Key Exchange Messages 🔑
opaque ASN.1Cert<2^24-1>;
struct {
ASN.1Cert certificate_list<0..2^24-1>;
} Certificate;
enum { rsa, diffie_hellman } KeyExchangeAlgorithm;
struct {
opaque rsa_modulus<1..2^16-1>;
opaque rsa_exponent<1..2^16-1>;
} ServerRSAParams;
struct {
opaque dh_p<1..2^16-1>;
opaque dh_g<1..2^16-1>;
opaque dh_Ys<1..2^16-1>;
} ServerDHParams;
struct {
select (KeyExchangeAlgorithm) {
case diffie_hellman:
ServerDHParams params;
Signature signed_params;
case rsa:
ServerRSAParams params;
Signature signed_params;
};
} ServerKeyExchange;
enum { anonymous, rsa, dsa } SignatureAlgorithm;
struct {
select (KeyExchangeAlgorithm) {
case diffie_hellman:
ServerDHParams params;
case rsa:
ServerRSAParams params;
};
} ServerParams;
struct {
select (SignatureAlgorithm) {
case anonymous: struct { };
case rsa:
digitally-signed struct {
opaque md5_hash[16];
opaque sha_hash[20];
};
case dsa:
digitally-signed struct {
opaque sha_hash[20];
};
};
};
} Signature;
enum {
rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
rsa_ephemeral_dh_RESERVED(5), dss_ephemeral_dh_RESERVED(6),
fortezza_dms_RESERVED(20),
(255)
} ClientCertificateType;
opaque DistinguishedName<1..2^16-1>;
struct {
ClientCertificateType certificate_types<1..2^8-1>;
DistinguishedName certificate_authorities<0..2^16-1>;
} CertificateRequest;
struct { } ServerHelloDone;A.4.3. Client Authentication and Key Exchange Messages 🫧
struct {
select (KeyExchangeAlgorithm) {
case rsa: EncryptedPreMasterSecret;
case diffie_hellman: ClientDiffieHellmanPublic;
} exchange_keys;
} ClientKeyExchange;
struct {
ProtocolVersion client_version;
opaque random[46];
}
PreMasterSecret;
struct {
public-key-encrypted PreMasterSecret pre_master_secret;
} EncryptedPreMasterSecret;
enum { implicit, explicit } PublicValueEncoding;
struct {
select (PublicValueEncoding) {
case implicit: struct {};
case explicit: opaque DH_Yc<1..2^16-1>;
} dh_public;
} ClientDiffieHellmanPublic;
struct {
Signature signature;
} CertificateVerify;A.4.4. Handshake Finalization Message 🎉
struct {
opaque verify_data[12];
} Finished;A.5. The CipherSuite ✨
okay so this is the cipher suite list, aka the menu of crypto combos the client and server can pick from 💅 the values in these codes are what show up in the client hello and server hello messages 🫶
a CipherSuite is basically a cipher spec that's supported in TLS Version 1.1 🎀
TLS_NULL_WITH_NULL_NULL is real, and it's the starting state of a TLS connection during the first handshake on that channel 🙈 but it must not be negotiated, bestie, because it gives you zero more protection than just not being secured at all 💀
CipherSuite TLS_NULL_WITH_NULL_NULL = { 0x00,0x00 };the next group needs the server to have an RSA certificate that can be used for key exchange 🔐 the server may ask for either an RSA or a DSS signature-capable certificate in the certificate request message 🌸
CipherSuite TLS_RSA_WITH_NULL_MD5 = { 0x00,0x01 };
CipherSuite TLS_RSA_WITH_NULL_SHA = { 0x00,0x02 };
CipherSuite TLS_RSA_WITH_RC4_128_MD5 = { 0x00,0x04 };
CipherSuite TLS_RSA_WITH_RC4_128_SHA = { 0x00,0x05 };
CipherSuite TLS_RSA_WITH_IDEA_CBC_SHA = { 0x00,0x07 };
CipherSuite TLS_RSA_WITH_DES_CBC_SHA = { 0x00,0x09 };
CipherSuite TLS_RSA_WITH_3DES_EDE_CBC_SHA = { 0x00,0x0A };next up are the Diffie-Hellman ones, used for server-authenticated (and optionally client-authenticated) Diffie-Hellman 🦋 so DH means the server's certificate holds the Diffie-Hellman parameters, signed by the certificate authority (CA) ✨ and DHE means ephemeral Diffie-Hellman, where those parameters get signed by a DSS or RSA certificate that the CA signed 🧚 the signing algorithm gets named right after the DH or DHE part, which is very organized of them 🍓
the server can ask the client for an RSA or DSS signature-capable certificate for client authentication, or it can ask for a Diffie-Hellman certificate instead 💜 and any Diffie-Hellman certificate the client sends has to use the parameters (group and generator) the server described 👑
CipherSuite TLS_DH_DSS_WITH_DES_CBC_SHA = { 0x00,0x0C };
CipherSuite TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA = { 0x00,0x0D };
CipherSuite TLS_DH_RSA_WITH_DES_CBC_SHA = { 0x00,0x0F };
CipherSuite TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA = { 0x00,0x10 };
CipherSuite TLS_DHE_DSS_WITH_DES_CBC_SHA = { 0x00,0x12 };
CipherSuite TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA = { 0x00,0x13 };
CipherSuite TLS_DHE_RSA_WITH_DES_CBC_SHA = { 0x00,0x15 };
CipherSuite TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA = { 0x00,0x16 };these are the completely anonymous Diffie-Hellman suites, where neither party gets authenticated 🙃 heads up: this mode is vulnerable to man-in-the-middle attacks, so it's deprecated 💀
⚠️ anon suites are a no-go for real security, babe. a man-in-the-middle can totally slide in, so it's been deprecated 💀
CipherSuite TLS_DH_anon_WITH_RC4_128_MD5 = { 0x00,0x18 };
CipherSuite TLS_DH_anon_WITH_DES_CBC_SHA = { 0x00,0x1A };
CipherSuite TLS_DH_anon_WITH_3DES_EDE_CBC_SHA = { 0x00,0x1B };okay, history moment 📜 back when SSLv3 and TLS 1.0 were being designed, the United States restricted export of crypto software with certain strong encryption algorithms 🌍 so a bunch of cipher suites were made to run at reduced key lengths just to comply with those rules 😤 but computers got way faster, so those algorithms are now unacceptably weak, and the export restrictions have since loosened 🫠
TLS 1.1 implementations MUST NOT negotiate these cipher suites in TLS 1.1 mode 🚫 they can still be offered in the ClientHello for use with TLS 1.0 or SSLv3-only servers, for backward compatibility 🎀 and TLS 1.1 clients MUST check that the server did not choose one of these cipher suites during the handshake 🔍 they're listed below purely for informational purposes and to reserve the numbers 📌
CipherSuite TLS_RSA_EXPORT_WITH_RC4_40_MD5 = { 0x00,0x03 };
CipherSuite TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 = { 0x00,0x06 };
CipherSuite TLS_RSA_EXPORT_WITH_DES40_CBC_SHA = { 0x00,0x08 };
CipherSuite TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA = { 0x00,0x0B };
CipherSuite TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA = { 0x00,0x0E };
CipherSuite TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA = { 0x00,0x11 };
CipherSuite TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA = { 0x00,0x14 };
CipherSuite TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 = { 0x00,0x17 };
CipherSuite TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA = { 0x00,0x19 };next, the Kerberos ones, which were defined in [TLSKRB] and are included here for completeness 🧸 check [TLSKRB] for the details:
CipherSuite TLS_KRB5_WITH_DES_CBC_SHA = { 0x00,0x1E }:
CipherSuite TLS_KRB5_WITH_3DES_EDE_CBC_SHA = { 0x00,0x1F };
CipherSuite TLS_KRB5_WITH_RC4_128_SHA = { 0x00,0x20 };
CipherSuite TLS_KRB5_WITH_IDEA_CBC_SHA = { 0x00,0x21 };
CipherSuite TLS_KRB5_WITH_DES_CBC_MD5 = { 0x00,0x22 };
CipherSuite TLS_KRB5_WITH_3DES_EDE_CBC_MD5 = { 0x00,0x23 };
CipherSuite TLS_KRB5_WITH_RC4_128_MD5 = { 0x00,0x24 };
CipherSuite TLS_KRB5_WITH_IDEA_CBC_MD5 = { 0x00,0x25 };the exportable Kerberos suites come from [TLSKRB] too, and they're here for completeness as well 🎀 TLS 1.1 implementations MUST NOT negotiate these cipher suites 🚫
CipherSuite TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA = { 0x00,0x26};
CipherSuite TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA = { 0x00,0x27};
CipherSuite TLS_KRB5_EXPORT_WITH_RC4_40_SHA = { 0x00,0x28};
CipherSuite TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5 = { 0x00,0x29};
CipherSuite TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5 = { 0x00,0x2A};
CipherSuite TLS_KRB5_EXPORT_WITH_RC4_40_MD5 = { 0x00,0x2B};then the AES ones, which were defined in [TLSAES] and are included for completeness too ✨ see [TLSAES] for details 🦋
CipherSuite TLS_RSA_WITH_AES_128_CBC_SHA = { 0x00, 0x2F };
CipherSuite TLS_DH_DSS_WITH_AES_128_CBC_SHA = { 0x00, 0x30 };
CipherSuite TLS_DH_RSA_WITH_AES_128_CBC_SHA = { 0x00, 0x31 };
CipherSuite TLS_DHE_DSS_WITH_AES_128_CBC_SHA = { 0x00, 0x32 };
CipherSuite TLS_DHE_RSA_WITH_AES_128_CBC_SHA = { 0x00, 0x33 };
CipherSuite TLS_DH_anon_WITH_AES_128_CBC_SHA = { 0x00, 0x34 };
CipherSuite TLS_RSA_WITH_AES_256_CBC_SHA = { 0x00, 0x35 };
CipherSuite TLS_DH_DSS_WITH_AES_256_CBC_SHA = { 0x00, 0x36 };
CipherSuite TLS_DH_RSA_WITH_AES_256_CBC_SHA = { 0x00, 0x37 };
CipherSuite TLS_DHE_DSS_WITH_AES_256_CBC_SHA = { 0x00, 0x38 };
CipherSuite TLS_DHE_RSA_WITH_AES_256_CBC_SHA = { 0x00, 0x39 };
CipherSuite TLS_DH_anon_WITH_AES_256_CBC_SHA = { 0x00, 0x3A };now the cipher suite space gets split into three regions, so the codes are sorted by who gets to use them 🗂️
- first byte 0x00 (zero) through decimal 191 (0xBF) inclusive is reserved for the IETF Standards Track protocols 👑
- first byte decimal 192 (0xC0) through decimal 254 (0xFE) inclusive is reserved for assignment for non-Standards Track methods 🌈
- first byte 0xFF is reserved for private use 🔒
for how IANA handles allocating cipher suite code points, check out Section 11 🫶
📝 the values { 0x00, 0x1C } and { 0x00, 0x1D } are reserved so they don't collide with the Fortezza-based cipher suites in SSL 3. don't touch them, periodt 🙅♀️
A.6. The Security Parameters 🔐
these security parameters are determined by the TLS Handshake Protocol, and then handed to the TLS Record Layer as parameters so it can set up a connection state 🧚 SecurityParameters includes the following:
enum { null(0), (255) } CompressionMethod;
enum { server, client } ConnectionEnd;
enum { null, rc4, rc2, des, 3des, des40, aes, idea }
BulkCipherAlgorithm;
enum { stream, block } CipherType;
enum { null, md5, sha } MACAlgorithm;
/* The algorithms specified in CompressionMethod,
BulkCipherAlgorithm, and MACAlgorithm may be added to. */
struct {
ConnectionEnd entity;
BulkCipherAlgorithm bulk_cipher_algorithm;
CipherType cipher_type;
uint8 key_size;
uint8 key_material_length;
MACAlgorithm mac_algorithm;
uint8 hash_size;
CompressionMethod compression_algorithm;
opaque master_secret[48];
opaque client_random[32];
opaque server_random[32];
} SecurityParameters;💖 that's the full struct, and the main takeaway is that all of those little fields are what the record layer needs to get a connection going 🦋
Appendix B. Glossary ✨
okay bestie, this is the glossary, aka the cheat sheet for all the terms that keep popping up 💅📚
Advanced Encryption Standard (AES)
AES is a super popular symmetric encryption algorithm 🔐. It's a block cipher that uses 128, 192, or 256 bit keys and has a 16 byte block size. [AES] Fun fact: TLS currently only supports the 128 and 256 bit key sizes 💖.
application protocol
An application protocol is one that normally sits directly on top of the transport layer (think TCP/IP) 🌸. Examples are HTTP, TELNET, FTP, and SMTP.
asymmetric cipher
See public key cryptography 🗝️.
authentication
Authentication is when one entity can figure out who another entity is 🫶.
block cipher
A block cipher is an algorithm that works on plaintext in chunks of bits called blocks 🧩. 64 bits is a common block size.
bulk cipher
A symmetric encryption algorithm that's used to encrypt big piles of data 📦.
cipher block chaining (CBC)
CBC is a mode where every plaintext block that gets encrypted with a block cipher is first exclusive-ORed with the previous ciphertext block 🔗. For the first block, it gets exclusive-ORed with the initialization vector instead. For decryption, every block is decrypted first, and then exclusive-ORed with the previous ciphertext block (or IV). It's giving chain reaction energy 🧚.
certificate
As part of the X.509 protocol (a.k.a. the ISO Authentication framework), certificates are assigned by a trusted Certificate Authority 🎀. They provide a strong binding between a party's identity (or some other attributes) and its public key.
client
The application entity that starts a TLS connection to a server 🙋♀️. This might or might not mean the client also started the underlying transport connection. The main difference between server and client is that the server is generally authenticated, while the client is only optionally authenticated. Main character server energy 👑.
client write key
The key used to encrypt data that the client writes 🔑.
client write MAC secret
The secret data used to authenticate data that the client writes 🕵️♀️.
connection
A connection is a transport (in the OSI layering model) that gives you a suitable type of service 🚇. For TLS, connections are peer-to-peer relationships. They're transient, and every connection is associated with one session 🦋.
Data Encryption Standard
DES is a very widely used symmetric encryption algorithm 🍓. It's a block cipher with a 56 bit key and an 8 byte block size. Here's the tea: in TLS, for key generation purposes, DES is treated as having an 8 byte key length (64 bits), but it still only provides 56 bits of protection 🙈. (The low bit of each key byte is presumed to be set to produce odd parity in that key byte.) DES can also run in a mode where three independent keys and three encryptions are used for each block of data. This uses 168 bits of key (24 bytes in the TLS key generation method) and provides the equivalent of 112 bits of security. [DES], [3DES]
Digital Signature Standard (DSS)
A standard for digital signing, including the Digital Signing Algorithm. It was approved by the National Institute of Standards and Technology and defined in NIST FIPS PUB 186, "Digital Signature Standard," published May 1994 by the U.S. Dept. of Commerce 📜. [DSS]
digital signatures
Digital signatures use public key cryptography and one-way hash functions to produce a signature of the data. That signature can be authenticated, and it's difficult to forge or repudiate ✍️✨.
handshake
An initial negotiation between client and server that establishes the parameters of their transactions 🤝.
Initialization Vector (IV)
When a block cipher is used in CBC mode, the initialization vector gets exclusive-ORed with the first plaintext block before encryption 🌈.
IDEA
A 64-bit block cipher designed by Xuejia Lai and James Massey. [IDEA] 🧠
Message Authentication Code (MAC)
A Message Authentication Code is a one-way hash computed from a message and some secret data 🔏. It's difficult to forge without knowing the secret data. Its purpose is to detect whether the message has been altered.
master secret
Secure secret data used for generating encryption keys, MAC secrets, and IVs 👑🗝️.
MD5
MD5 is a secure hashing function that turns an arbitrarily long data stream into a digest of fixed size (16 bytes). [MD5] 💫
public key cryptography
A class of cryptographic techniques that use two-key ciphers 🎟️. Messages encrypted with the public key can only be decrypted with the associated private key. Conversely, messages signed with the private key can be verified with the public key. Iconic two-key energy 🔑🔓.
one-way hash function
A one-way transformation that turns an arbitrary amount of data into a fixed-length hash 🫧. It's computationally hard to reverse the transformation or to find collisions. MD5 and SHA are examples of one-way hash functions.
RC2
A block cipher developed by Ron Rivest at RSA Data Security, Inc. [RSADSI], described in [RC2] 💅.
RC4
A stream cipher invented by Ron Rivest. A compatible cipher is described in [SCH] 🌊.
RSA
A very widely used public-key algorithm that can be used for either encryption or digital signing. [RSA] 🔐💜
server
The server is the application entity that responds to requests for connections from clients 🏠. See also under client.
session
A TLS session is an association between a client and a server 🧸. Sessions are created by the handshake protocol. They define a set of cryptographic security parameters that can be shared among multiple connections. Sessions exist so nobody has to do the expensive negotiation of new security parameters for every single connection. Efficiency is a whole mood ⭐.
session identifier
A session identifier is a value generated by a server that identifies a particular session 🪪.
server write key
The key used to encrypt data that the server writes 🔑.
server write MAC secret
The secret data used to authenticate data that the server writes 🕵️.
SHA
The Secure Hash Algorithm is defined in FIPS PUB 180-2. It produces a 20-byte output. Note that all references to SHA actually use the modified SHA-1 algorithm 🧾. [SHA]
SSL
Netscape's Secure Socket Layer protocol [SSL3]. TLS is based on SSL Version 3.0 🌸.
stream cipher
An encryption algorithm that converts a key into a cryptographically strong keystream, which is then exclusive-ORed with the plaintext 🌊.
symmetric cipher
See bulk cipher 🔁.
Transport Layer Security (TLS)
This protocol! It's also the Transport Layer Security working group of the Internet Engineering Task Force (IETF). See "Comments" at the end of this document 🎀✨.
Appendix C. CipherSuite Definitions 🦋
Here's the big cipher suite lineup, the full menu of combos 🍱. Every suite is a bundle of key exchange, cipher, and hash 💅.
CipherSuite Key Exchange Cipher Hash
TLS_NULL_WITH_NULL_NULL NULL NULL NULL
TLS_RSA_WITH_NULL_MD5 RSA NULL MD5
TLS_RSA_WITH_NULL_SHA RSA NULL SHA
TLS_RSA_WITH_RC4_128_MD5 RSA RC4_128 MD5
TLS_RSA_WITH_RC4_128_SHA RSA RC4_128 SHA
TLS_RSA_WITH_IDEA_CBC_SHA RSA IDEA_CBC SHA
TLS_RSA_WITH_DES_CBC_SHA RSA DES_CBC SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA RSA 3DES_EDE_CBC SHA
TLS_DH_DSS_WITH_DES_CBC_SHA DH_DSS DES_CBC SHA
TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA DH_DSS 3DES_EDE_CBC SHA
TLS_DH_RSA_WITH_DES_CBC_SHA DH_RSA DES_CBC SHA
TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA DH_RSA 3DES_EDE_CBC SHA
TLS_DHE_DSS_WITH_DES_CBC_SHA DHE_DSS DES_CBC SHA
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA DHE_DSS 3DES_EDE_CBC SHA
TLS_DHE_RSA_WITH_DES_CBC_SHA DHE_RSA DES_CBC SHA
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA DHE_RSA 3DES_EDE_CBC SHA
TLS_DH_anon_WITH_RC4_128_MD5 DH_anon RC4_128 MD5
TLS_DH_anon_WITH_DES_CBC_SHA DH_anon DES_CBC SHA
TLS_DH_anon_WITH_3DES_EDE_CBC_SHA DH_anon 3DES_EDE_CBC SHANow the key exchange algorithms, and what each one is all about 🔐:
Key
Exchange
Algorithm Description Key size limit
DHE_DSS Ephemeral DH with DSS signatures None
DHE_RSA Ephemeral DH with RSA signatures None
DH_anon Anonymous DH, no signatures None
DH_DSS DH with DSS-based certificates None
DH_RSA DH with RSA-based certificates None
RSA = none
NULL No key exchange N/A
RSA RSA key exchange NoneAnd the cipher specs, with their key material, IV sizes, and block sizes 🧁:
Key Expanded IV Block
Cipher Type Material Key Material Size Size
NULL Stream 0 0 0 N/A
IDEA_CBC Block 16 16 8 8
RC2_CBC_40 Block 5 16 8 8
RC4_40 Stream 5 16 0 N/A
RC4_128 Stream 16 16 0 N/A
DES40_CBC Block 5 8 8 8
DES_CBC Block 8 8 8 8
3DES_EDE_CBC Block 24 24 8 8Here's what those columns mean, in plain English 🤓:
Type tells you whether it's a stream cipher or a block cipher running in CBC mode 🌊🧱.
Key Material is the number of bytes from the key_block that get used for generating the write keys 🔑.
Expanded Key Material is the number of bytes actually fed into the encryption algorithm ✨.
IV Size is the amount of data that needs to be generated for the initialization vector. It's zero for stream ciphers, and equal to the block size for block ciphers 🌷.
Block Size is the amount of data a block cipher enciphers in one chunk. A block cipher running in CBC mode can only encrypt an even multiple of its block size 🧩.
And finally, the hash functions and their sizes 🧾:
Hash Hash Padding
function Size Size
NULL 0 0
MD5 16 48
SHA 20 40Appendix D. Implementation Notes 🛠️
The TLS protocol can't stop lots of common security mistakes all by itself 🙃. So this section gives a few recommendations to help implementors not mess up 🫶.
D.1. Random Number Generation and Seeding 🎲
TLS requires a cryptographically secure pseudorandom number generator (PRNG). Care must be taken when designing and seeding PRNGs 🌱. PRNGs based on secure hash operations, most notably MD5 and/or SHA, are acceptable, but they can't provide more security than the size of the random number generator state. (For example, MD5-based PRNGs usually provide 128 bits of state.) Not more security than the state, bestie, that's the rule 💀.
To estimate how much seed material is being produced, add up the number of bits of unpredictable information in each seed byte 🧮. For example, keystroke timing values taken from a PC compatible's 18.2 Hz timer provide 1 or 2 secure bits each, even though the total size of the counter value is 16 bits or more. Seeding a 128-bit PRNG would thus require approximately 100 such timer values. Wild that a keyboard tap can be a seed 😭🎀.
[RANDOM] provides guidance on the generation of random values 🌈.
D.2. Certificates and Authentication
Okay bestie, certificates are a whole vibe 🔐 Implementations are responsible for checking that certificates are legit, and they should generally support certificate revocation messages 💅 Every certificate should always be verified to make sure it was properly signed by a trusted Certificate Authority (CA) ✨ Picking and adding trusted CAs needs to be done very carefully, no cap 🙈 And users should be able to peek at info about the certificate and the root CA 👀
D.3. CipherSuites
CipherSuites are giving main character energy 🎀 TLS supports a whole range of key sizes and security levels, including some that offer no security or only minimal security 💀 A proper implementation will probably not support many cipher suites ✨ For example, 40-bit encryption is easily broken, so if you need strong security, you should not allow 40-bit keys 🙅 Anonymous Diffie-Hellman is strongly discouraged because it cannot prevent man-in-the-middle attacks 😭 Applications should also enforce minimum and maximum key sizes 💖 Like, certificate chains containing 512-bit RSA keys or signatures are not appropriate for high-security applications 🔐
Appendix E. Backward Compatibility with SSL
Okay so, for historical reasons and to avoid wasting reserved port numbers 🫶, application protocols secured by TLS 1.1, TLS 1.0, SSL 3.0, and SSL 2.0 all tend to share the same connection port. For example, https (HTTP secured by SSL or TLS) uses port 443 no matter which security protocol it's using 🌐 So some mechanism has to be figured out to tell the various protocols apart and negotiate among them 🦋
TLS versions 1.1 and 1.0, and SSL 3.0 are very similar, so supporting all of them is easy 💜 TLS clients who want to negotiate with older servers SHOULD send client hello messages using the SSL 3.0 record format and client hello structure, putting {3, 2} in the version field to note that they support TLS 1.1 ✨ If the server only supports TLS 1.0 or SSL 3.0, it will respond with a downrev 3.0 server hello. If it supports TLS 1.1, it will respond with a TLS 1.1 server hello. The negotiation then proceeds however is right for the negotiated protocol 💅
Similarly, a TLS 1.1 server that wants to interoperate with TLS 1.0 or SSL 3.0 clients SHOULD accept SSL 3.0 client hello messages and respond with a SSL 3.0 server hello if an SSL 3.0 client hello with a version field of {3, 0} is received, which means this client doesn't support TLS 🧚 Similarly, if an SSL 3.0 or TLS 1.0 hello with a version field of {3, 1} is received, the server SHOULD respond with a TLS 1.0 hello with a version field of {3, 1} 🌈
Whenever a client already knows the highest protocol known to a server (for example, when resuming a session), it SHOULD initiate the connection in that native protocol 🍓
TLS 1.1 clients that support SSL Version 2.0 servers MUST send SSL Version 2.0 client hello messages [SSL2]. TLS servers SHOULD accept either client hello format if they want to support SSL 2.0 clients on the same connection port. The only deviations from the Version 2.0 specification are the ability to specify a version with a value of three and the support for more ciphering types in the CipherSpec 🌸
Warning: The ability to send Version 2.0 client hello messages will be phased out with all due haste. Implementors SHOULD make every effort to move forward as quickly as possible. Version 3.0 provides better mechanisms for moving to newer versions 🚨
The following cipher specifications are carryovers from SSL Version 2.0. These are assumed to use RSA for key exchange and authentication 🔑
V2CipherSpec TLS_RC4_128_WITH_MD5 = { 0x01,0x00,0x80 };
V2CipherSpec TLS_RC4_128_EXPORT40_WITH_MD5 = { 0x02,0x00,0x80 };
V2CipherSpec TLS_RC2_CBC_128_CBC_WITH_MD5 = { 0x03,0x00,0x80 };
V2CipherSpec TLS_RC2_CBC_128_CBC_EXPORT40_WITH_MD5
= { 0x04,0x00,0x80 };
V2CipherSpec TLS_IDEA_128_CBC_WITH_MD5 = { 0x05,0x00,0x80 };
V2CipherSpec TLS_DES_64_CBC_WITH_MD5 = { 0x06,0x00,0x40 };
V2CipherSpec TLS_DES_192_EDE3_CBC_WITH_MD5 = { 0x07,0x00,0xC0 };Cipher specifications native to TLS can be included in Version 2.0 client hello messages using the syntax below. Any V2CipherSpec element with its first byte equal to zero will be ignored by Version 2.0 servers. Clients sending any of the above V2CipherSpecs SHOULD also include the TLS equivalent (see Appendix A.5) 🧩
V2CipherSpec (see TLS name) = { 0x00, CipherSuite };Note: TLS 1.1 clients may generate the SSLv2 EXPORT cipher suites in handshakes for backward compatibility, but they MUST NOT negotiate them in TLS 1.1 mode 🙅
E.1. Version 2 Client Hello
The Version 2.0 client hello message is shown below using this document's presentation model. The true definition is still assumed to be the SSL Version 2.0 specification. Note that this message MUST be sent directly on the wire, not wrapped as an SSLv3 record 📦
uint8 V2CipherSpec[3];
struct {
uint16 msg_length;
uint8 msg_type;
Version version;
uint16 cipher_spec_length;
uint16 session_id_length;
uint16 challenge_length;
V2CipherSpec cipher_specs[V2ClientHello.cipher_spec_length];
opaque session_id[V2ClientHello.session_id_length];
opaque challenge[V2ClientHello.challenge_length;
} V2ClientHello;Here's the breakdown of each field 💅
msg_length: This field is the length of the following data in bytes. The high bit MUST be 1 and is not part of the length.msg_type: This field, in conjunction with the version field, identifies a version 2 client hello message. The value SHOULD be one (1).version: The highest version of the protocol supported by the client (equals ProtocolVersion.version; see Appendix A.1).cipher_spec_length: This field is the total length of the field cipher_specs. It cannot be zero and MUST be a multiple of the V2CipherSpec length (3).session_id_length: This field MUST have a value of zero.challenge_length: The length in bytes of the client's challenge to the server to authenticate itself. When using the SSLv2 backward compatible handshake, the client MUST use a 32-byte challenge.cipher_specs: This is a list of all CipherSpecs the client is willing and able to use. There MUST be at least one CipherSpec acceptable to the server.session_id: This field MUST be empty.challenge: The client challenge to the server for the server to identify itself is a (nearly) arbitrary-length random. The TLS server will right-justify the challenge data to become the ClientHello.random data (padded with leading zeroes, if necessary), as specified in this protocol specification. If the length of the challenge is greater than 32 bytes, only the last 32 bytes are used. It is legitimate (but not necessary) for a V3 server to reject a V2 ClientHello that has fewer than 16 bytes of challenge data.
Note: Requests to resume a TLS session MUST use a TLS client hello 🔁
E.2. Avoiding Man-in-the-Middle Version Rollback
When TLS clients fall back to Version 2.0 compatibility mode, they SHOULD use special PKCS #1 block formatting. This is done so that TLS servers will reject Version 2.0 sessions with TLS-capable clients 🛡️
When TLS clients are in Version 2.0 compatibility mode, they set the right-hand (least significant) 8 random bytes of the PKCS padding (not including the terminal null of the padding) for the RSA encryption of the ENCRYPTED-KEY-DATA field of the CLIENT-MASTER-KEY to 0x03 (the other padding bytes are random). After decrypting the ENCRYPTED-KEY-DATA field, servers that support TLS SHOULD issue an error if these eight padding bytes are 0x03. Version 2.0 servers receiving blocks padded in this manner will proceed normally ✅
Appendix F. Security Analysis
The TLS protocol is designed to establish a secure connection between a client and a server communicating over an insecure channel. This document makes several traditional assumptions, including that attackers have substantial computational resources and cannot obtain secret information from sources outside the protocol. Attackers are assumed to have the ability to capture, modify, delete, replay, and otherwise tamper with messages sent over the communication channel. This appendix outlines how TLS has been designed to resist a variety of attacks. Yikes, the bad guys are very determined 😈
F.1. Handshake Protocol
The handshake protocol is responsible for selecting a CipherSpec and generating a Master Secret, which together make up the primary cryptographic parameters associated with a secure session 🤝 The handshake protocol can also optionally authenticate parties who have certificates signed by a trusted certificate authority 🪪
F.1.1. Authentication and Key Exchange
TLS supports three authentication modes: authentication of both parties, server authentication with an unauthenticated client, and total anonymity. Whenever the server is authenticated, the channel is secure against man-in-the-middle attacks, but completely anonymous sessions are inherently vulnerable to such attacks 😬 Anonymous servers cannot authenticate clients. If the server is authenticated, its certificate message must provide a valid certificate chain leading to an acceptable certificate authority. Similarly, authenticated clients must supply an acceptable certificate to the server. Each party is responsible for verifying that the other's certificate is valid and has not expired or been revoked 🔍
The general goal of the key exchange process is to create a pre_master_secret known to the communicating parties and not to attackers 🗝️ The pre_master_secret will be used to generate the master_secret (see Section 8.1). The master_secret is required to generate the finished messages, encryption keys, and MAC secrets (see Sections 7.4.8, 7.4.9, and 6.3). By sending a correct finished message, parties thus prove that they know the correct pre_master_secret 🙌
F.1.1.1. Anonymous Key Exchange
Completely anonymous sessions can be established using RSA or Diffie-Hellman for key exchange. With anonymous RSA, the client encrypts a pre_master_secret with the server's uncertified public key extracted from the server key exchange message. The result is sent in a client key exchange message. Since eavesdroppers do not know the server's private key, it will be infeasible for them to decode the pre_master_secret 🕵️
Note: No anonymous RSA Cipher Suites are defined in this document 📝
With Diffie-Hellman, the server's public parameters are contained in the server key exchange message, and the client's are sent in the client key exchange message. Eavesdroppers who do not know the private values should not be able to find the Diffie-Hellman result (i.e., the pre_master_secret) 🫣
Warning: Completely anonymous connections only provide protection against passive eavesdropping. Unless an independent tamper-proof channel is used to verify that the finished messages were not replaced by an attacker, server authentication is required in environments where active man-in-the-middle attacks are a concern 🚨
F.1.1.2. RSA Key Exchange and Authentication
okay so with RSA, key exchange and server authentication are combined into one move 💅 The public key may live in the server's certificate, or it may be a temporary RSA key sent in a server key exchange message. When temporary RSA keys are used, the server's RSA certificate signs them. That signature includes the current ClientHello.random, so old signatures and temporary keys can't get replayed 🙅♀️ Servers may use a single temporary RSA key for multiple negotiation sessions.
Note: the temporary RSA key option is super useful if servers need big certificates but still have to follow government size limits on keys used for key exchange 🏛️
Ngl, if ephemeral RSA isn't used, a compromise of the server's static RSA key means every session protected under that static key loses confidentiality 😭 If you're a TLS user who wants Perfect Forward Secrecy, go for DHE cipher suites 🦋 You can also limit the damage from a private key exposure by changing your private key (and certificate) often.
After the client checks the server's certificate, it encrypts a pre_master_secret with the server's public key 🔐 If the server can decode that pre_master_secret and produce a correct finished message, it proves it actually knows the private key that matches the server certificate. Iconic.
When RSA is used for key exchange, the client gets authenticated through the certificate verify message (see Section 7.4.8) 💜 The client signs a value derived from the master_secret and every handshake message before it. Those handshake messages include the server certificate, which ties the signature to that specific server, and ServerHello.random, which ties the signature to this exact handshake. Main character energy for sure ✨
F.1.1.3. Diffie-Hellman Key Exchange with Authentication
When Diffie-Hellman key exchange is used, the server can either hand over a certificate with fixed Diffie-Hellman parameters, or send a set of temporary Diffie-Hellman parameters in the server key exchange message, signed with a DSS or RSA certificate 🌸 The temporary parameters get hashed together with the hello.random values before signing, so attackers can't replay old parameters. Either way, the client can check the certificate or signature to make sure the parameters really belong to the server.
If the client has a certificate with fixed Diffie-Hellman parameters, that certificate has everything needed to finish the key exchange. Heads up though: in this case the client and server will generate the same Diffie-Hellman result (aka pre_master_secret) every single time they talk 😳 To keep the pre_master_secret from hanging around in memory longer than it has to, turn it into the master_secret as soon as possible 🧚 Also, client Diffie-Hellman parameters have to be compatible with the ones the server supplied, or the key exchange won't work.
If the client has a standard DSS or RSA certificate, or it's unauthenticated, it sends a set of temporary parameters to the server in the client key exchange message. It can then optionally use a certificate verify message to authenticate itself 🎀
If the same DH keypair is going to be reused for multiple handshakes (either because the client or server has a certificate with a fixed DH keypair, or because the server is reusing DH keys), you need to be careful about small subgroup attacks 🙈 Implementations SHOULD follow the guidelines found in [SUBGROUP].
Small subgroup attacks are easiest to dodge by using one of the DHE ciphersuites and generating a fresh DH private key (X) for every handshake 🌈 If a suitable base (like 2) is chosen, g^X mod p can be computed really fast, so the performance cost stays tiny. Using a fresh key each handshake also gives you Perfect Forward Secrecy, which is honestly so iconic 👑 Implementations SHOULD generate a new X for each handshake when using DHE ciphersuites.
F.1.2. Version Rollback Attacks
Because TLS has a bunch of big upgrades over SSL Version 2.0, attackers may try to trick TLS-capable clients and servers into falling back to Version 2.0 😤 This attack can only happen if two TLS-capable parties use an SSL 2.0 handshake.
The solution with non-random PKCS #1 block type 2 message padding is kinda inelegant, but it gives Version 3.0 servers a reasonably secure way to detect the attack 🔍 It isn't secure against attackers who can brute force the key and swap in a new ENCRYPTED-KEY-DATA message with the same key (but normal padding) before the application's wait threshold runs out. So if you're worried about attacks at that scale, don't use 40-bit encryption keys 💀 Changing the padding of the least-significant 8 bytes of the PKCS padding doesn't hurt security for the signed hash sizes and RSA key lengths used in the protocol. That's basically the same as increasing the input block size by 8 bytes, so it's fine 🫶
F.1.3. Detecting Attacks against the Handshake Protocol
An attacker might try to mess with the handshake exchange so the parties pick different encryption algorithms than they normally would 👀
For this attack, the attacker has to actively change one or more handshake messages. When that happens, the client and server compute different values for the handshake message hashes. That means the parties won't accept each other's finished messages 🚨 Without the master_secret, the attacker can't repair the finished messages, so the attack gets caught. Bestie, the system catches it. 🙌
F.1.4. Resuming Sessions
When a connection is established by resuming a session, the new ClientHello.random and ServerHello.random values get hashed with the session's master_secret 🔁 As long as the master_secret hasn't been compromised, and the secure hash operations used to produce the encryption keys and MAC secrets are secure, the connection should be secure and effectively independent from previous connections. Attackers can't use known encryption keys or MAC secrets to compromise the master_secret without breaking the secure hash operations (which use both SHA and MD5) 🧠
Sessions can't be resumed unless both the client and server agree 🤝 If either party suspects the session may have been compromised, or that certificates may have expired or been revoked, it should force a full handshake. An upper limit of 24 hours is suggested for session ID lifetimes, because an attacker who gets a master_secret may be able to impersonate the compromised party until that session ID is retired ⏳ Apps that might run in relatively insecure environments should not write session IDs to stable storage 🙅♀️
F.1.5. MD5 and SHA
TLS uses hash functions super conservatively 🫧 Wherever possible, MD5 and SHA are used together, so non-catastrophic flaws in one algorithm won't break the overall protocol. Double protection, bestie 💖
F.2. Protecting Application Data
The master_secret gets hashed with the ClientHello.random and ServerHello.random to produce unique data encryption keys and MAC secrets for each connection 🔑
Outgoing data is protected with a MAC before it gets sent 📦 To stop message replay or modification attacks, the MAC is computed from the MAC secret, the sequence number, the message length, the message contents, and two fixed character strings. The message type field makes sure messages meant for one TLS Record Layer client don't get redirected to another 🎯 The sequence number makes sure attempts to delete or reorder messages get detected. Since sequence numbers are 64 bits long, they should never overflow 🔢 Messages from one party can't be inserted into the other's output, since they use independent MAC secrets. The server-write and client-write keys are independent too, so stream cipher keys only get used once 🌊
If an attacker does break an encryption key, every message encrypted with it can be read 😱 Similarly, compromising a MAC key can make message modification attacks possible. Because MACs are also encrypted, message-alteration attacks generally require breaking the encryption algorithm as well as the MAC 🛡️
Note: MAC secrets may be larger than encryption keys, so messages can stay tamper resistant even if the encryption keys get broken 🌟
F.3. Explicit IVs
[CBCATT] describes a chosen plaintext attack on TLS that depends on knowing the IV for a record 🕵️♀️ Earlier versions of TLS [TLS1.0] used the CBC residue of the previous record as the IV, so they were open to this attack. This version uses an explicit IV to protect against it 💅
F.4. Security of Composite Cipher Modes
TLS protects transmitted application data using the symmetric encryption and authentication functions defined in the negotiated ciphersuite 🔐 The goal is to protect both the integrity and confidentiality of that data from malicious active attackers on the network. Turns out the order you apply encryption and authentication matters a lot for hitting that goal [ENCAUTH] 🤯
The most robust method, called encrypt-then-authenticate, first encrypts the data and then applies a MAC to the ciphertext 👑 This method gets both integrity and confidentiality with ANY pair of encryption and MAC functions, as long as the encryption is secure against chosen plaintext attacks and the MAC is secure against chosen-message attacks. TLS uses a different method, called authenticate-then-encrypt, where a MAC is computed on the plaintext first and then the plaintext and MAC get concatenated and encrypted together 🙃 This method has been proven secure for CERTAIN combinations of encryption and MAC functions, but it's not guaranteed to be secure in general. In fact, it's been shown that there exist perfectly secure encryption functions (secure even in the information-theoretic sense) that, combined with any secure MAC function, fail to provide confidentiality against an active attack 😬 So new ciphersuites and operation modes adopted into TLS need to be analyzed under authenticate-then-encrypt to verify they actually achieve the stated integrity and confidentiality goals 🔬
Right now, authenticate-then-encrypt has been proven secure for some important cases 🎉 One is stream ciphers, where a computationally unpredictable pad, as long as the message plus the MAC tag, is produced with a pseudo-random generator and XORed with the concatenation of plaintext and MAC tag. The other is CBC mode using a secure block cipher. In that case, security can be shown if you apply one CBC encryption pass to the concatenation of plaintext and MAC and use a new, independent, and unpredictable IV for each new plaintext and MAC pair 🧁 In previous SSL versions, CBC mode was used properly EXCEPT it used a predictable IV, namely the last block of the previous ciphertext. That made TLS open to chosen plaintext attacks. This version of the protocol is immune to those attacks ✨ For the exact details on which encryption modes are proven secure, see [ENCAUTH] 🌸
F.5. Denial of Service ✨
okay so TLS gets hit by a bunch of denial of service (DoS) attacks 😭. The big one: an attacker opens a huge pile of TCP connections and makes a server burn through tons of CPU doing RSA decryption 🔥. the good news is TLS usually runs over TCP, so it's hard for the attacker to hide where they're coming from, as long as the TCP stack does proper TCP SYN randomization [SEQNUM] 🎀.
TLS runs over TCP, which means it also has to deal with DoS attacks on individual connections 💀. attackers can forge RSTs to kill connections, or forge partial TLS records to make a connection stall 🙈. a TCP-using protocol generally can't defend against this kind of attack on its own, so anyone who's worried about it should use IPsec AH [AH-ESP] or ESP [AH-ESP] 🛡️.
F.6. Final Notes 💜
for TLS to actually give you a secure connection, the client and server systems, the keys, and the applications all have to be secure 🫶. the implementation also has to be free of security errors, no exceptions 🙅♀️.
the whole system is only as strong as its weakest key exchange and authentication algorithm, so only trustworthy cryptographic functions should be used 🔐. short public keys, 40-bit bulk encryption keys, and anonymous servers should be used with great caution ⚠️. implementations and users need to be really careful about which certificates and certificate authorities they accept, because a dishonest certificate authority can do tremendous damage 😱.
⚠️ bestie, this is the part where you don't just trust any cert that shows up. double check who's vouching for it 🫠.
Normative References 📚
[AES] National Institute of Standards and Technology, "Specification for the Advanced Encryption Standard (AES)" FIPS 197. November 26, 2001.
[3DES] W. Tuchman, "Hellman Presents No Shortcut Solutions To DES," IEEE Spectrum, v. 16, n. 7, July 1979, pp. 40-41.
[DES] ANSI X3.106, "American National Standard for Information Systems-Data Link Encryption," American National Standards Institute, 1983.
[DSS] NIST FIPS PUB 186-2, "Digital Signature Standard," National Institute of Standards and Technology, U.S. Department of Commerce, 2000.
[HMAC] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-Hashing for Message Authentication", RFC 2104, February 1997.
[IDEA] X. Lai, "On the Design and Security of Block Ciphers," ETH Series in Information Processing, v. 1, Konstanz: Hartung-Gorre Verlag, 1992.
[MD5] Rivest, R., "The MD5 Message-Digest Algorithm ", RFC 1321, April 1992.
[PKCS1A] B. Kaliski, "Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 1.5", RFC 2313, March 1998.
[PKCS1B] J. Jonsson, B. Kaliski, "Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1", RFC 3447, February 2003.
[PKIX] Housley, R., Polk, W., Ford, W., and D. Solo, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 3280, April 2002.
[RC2] Rivest, R., "A Description of the RC2(r) Encryption Algorithm", RFC 2268, March 1998.
[SCH] B. Schneier. "Applied Cryptography: Protocols, Algorithms, and Source Code in C, 2ed", Published by John Wiley & Sons, Inc. 1996.
[SHA] NIST FIPS PUB 180-2, "Secure Hash Standard," National Institute of Standards and Technology, U.S. Department of Commerce., August 2001.
[REQ] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 2434, October 1998.
[TLSAES] Chown, P., "Advanced Encryption Standard (AES) Ciphersuites for Transport Layer Security (TLS)", RFC 3268, June 2002.
[TLSEXT] Blake-Wilson, S., Nystrom, M., Hopwood, D., Mikkelsen, J., and T. Wright, "Transport Layer Security (TLS) Extensions", RFC 3546, June 2003.
[TLSKRB] Medvinsky, A. and M. Hur, "Addition of Kerberos Cipher Suites to Transport Layer Security (TLS)", RFC 2712, October 1999.
Informative References 🧠
[AH-ESP] Kent, S., "IP Authentication Header", RFC 4302, December 2005.
Eastlake 3rd, D., "Cryptographic Algorithm Implementation Requirements for Encapsulating Security Payload (ESP) and Authentication Header (AH)", RFC 4305, December 2005.
[BLEI] Bleichenbacher D., "Chosen Ciphertext Attacks against Protocols Based on RSA Encryption Standard PKCS #1" in Advances in Cryptology -- CRYPTO'98, LNCS vol. 1462, pages: 1-12, 1998.
[CBCATT] Moeller, B., "Security of CBC Ciphersuites in SSL/TLS: Problems and Countermeasures", http://www.openssl.org/~bodo/tls-cbc.txt.
[CBCTIME] Canvel, B., "Password Interception in a SSL/TLS Channel", http://lasecwww.epfl.ch/memo_ssl.shtml, 2003.
[ENCAUTH] Krawczyk, H., "The Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?)", Crypto 2001.
[KPR03] Klima, V., Pokorny, O., Rosa, T., "Attacking RSA-based Sessions in SSL/TLS", http://eprint.iacr.org/2003/052/, March 2003.
[PKCS6] RSA Laboratories, "PKCS #6: RSA Extended Certificate Syntax Standard," version 1.5, November 1993.
[PKCS7] RSA Laboratories, "PKCS #7: RSA Cryptographic Message Syntax Standard," version 1.5, November 1993.
[RANDOM] Eastlake, D., 3rd, Schiller, J., and S. Crocker, "Randomness Requirements for Security", BCP 106, RFC 4086, June 2005.
[RSA] R. Rivest, A. Shamir, and L. M. Adleman, "A Method for Obtaining Digital Signatures and Public-Key Cryptosystems," Communications of the ACM, v. 21, n. 2, Feb 1978, pp. 120-126.
[SEQNUM] Bellovin, S., "Defending Against Sequence Number Attacks", RFC 1948, May 1996.
[SSL2] Hickman, Kipp, "The SSL Protocol", Netscape Communications Corp., Feb 9, 1995.
[SSL3] A. Frier, P. Karlton, and P. Kocher, "The SSL 3.0 Protocol", Netscape Communications Corp., Nov 18, 1996.
[SUBGROUP] Zuccherato, R., "Methods for Avoiding the "Small-Subgroup" Attacks on the Diffie-Hellman Key Agreement Method for S/MIME", RFC 2785, March 2000.
[TCP] Hellstrom, G. and P. Jones, "RTP Payload for Text Conversation", RFC 4103, June 2005.
[TIMING] Boneh, D., Brumley, D., "Remote timing attacks are practical", USENIX Security Symposium 2003.
[TLS1.0] Dierks, T. and C. Allen, "The TLS Protocol Version 1.0", RFC 2246, January 1999.
[X501] ITU-T Recommendation X.501: Information Technology - Open Systems Interconnection - The Directory: Models, 1993.
[X509] ITU-T Recommendation X.509 (1997 E): Information Technology - Open Systems Interconnection - "The Directory - Authentication Framework". 1988.
[XDR] Srinivasan, R., "XDR: External Data Representation Standard", RFC 1832, August 1995.
Authors' Addresses 🎀
Working Group Chairs
Win Treese
EMail: treese@acm.org
Eric Rescorla
EMail: ekr@rtfm.com
Editors
Tim Dierks Independent
EMail: tim@dierks.org
Eric Rescorla RTFM, Inc.
EMail: ekr@rtfm.com
Other Contributors
Christopher Allen (co-editor of TLS 1.0) Alacrity Ventures EMail: ChristopherA@AlacrityManagement.com
Martin Abadi University of California, Santa Cruz EMail: abadi@cs.ucsc.edu
Ran Canetti IBM EMail: canetti@watson.ibm.com
Taher Elgamal Securify EMail: taher@securify.com
Anil Gangolli EMail: anil@busybuddha.org
Kipp Hickman
Phil Karlton (co-author of SSLv3)
Paul Kocher (co-author of SSLv3) Cryptography Research EMail: paul@cryptography.com
Hugo Krawczyk Technion Israel Institute of Technology EMail: hugo@ee.technion.ac.il
Robert Relyea Netscape Communications EMail: relyea@netscape.com
Jim Roskind Netscape Communications EMail: jar@netscape.com
Michael Sabin
Dan Simon Microsoft, Inc. EMail: dansimon@microsoft.com
Tom Weinstein
Comments 💬
The discussion list for the IETF TLS working group is located at the e-mail address <ietf-tls@lists.consensus.com>. Information on the group and information on how to subscribe to the list is at <http://lists.consensus.com/>.
Archives of the list can be found at: <http://www.imc.org/ietf-tls/mail-archive/>
Full Copyright Statement 🌈
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🦋
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
Acknowledgement 🫶
Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA). 💖
📦 where this page comes from
- ietf: rfc4346 2006-04
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms