Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 27 views

    Chapter 17 - TLS

    Uploaded by

    nsd8681
    Transport Layer Security (TLS) is a widely used security protocol that provides communication security over the internet. It uses cryptographic protocols to provide end-to-end encryption of segments of network connections above the transport layer, using symmetric cryptography for confidentiality and asymmetric cryptography for authentication. TLS has three subprotocols: the Record Protocol for encapsulation and encryption of messages, the Handshake Protocol for authentication and key exchange, and the Alert Protocol for transmitting error messages or closure alerts. TLS establishes authenticated and encrypted connections between a client and server using session resumption, session identifiers, and cryptographic parameters including the master secret.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd

    Chapter 17 - TLS

    Uploaded by

    nsd8681
    27 views28 pages
    Transport Layer Security (TLS) is a widely used security protocol that provides communication security over the internet. It uses cryptographic protocols to provide end-to-end encryption of segments of network connections above the transport layer, using symmetric cryptography for confidentiality and asymmetric cryptography for authentication. TLS has three subprotocols: the Record Protocol for encapsulation and encryption of messages, the Handshake Protocol for authentication and key exchange, and the Alert Protocol for transmitting error messages or closure alerts. TLS establishes authenticated and encrypted connections between a client and server using session resumption, session identifiers, and cryptographic parameters including the master secret.

    Copyright

    © © All Rights Reserved

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Transport Layer Security (TLS) is a widely used security protocol that provides communication security over the internet. It uses cryptographic protocols to provide end-to-end encryption of segments of network connections above the transport layer, using symmetric cryptography for confidentiality and asymmetric cryptography for authentication. TLS has three subprotocols: the Record Protocol for encapsulation and encryption of messages, the Handshake Protocol for authentication and key exchange, and the Alert Protocol for transmitting error messages or closure alerts. TLS establishes authenticated and encrypted connections between a client and server using session resumption, session identifiers, and cryptographic parameters including the master secret.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    27 views28 pages

    Chapter 17 - TLS

    Uploaded by

    nsd8681
    Transport Layer Security (TLS) is a widely used security protocol that provides communication security over the internet. It uses cryptographic protocols to provide end-to-end encryption of segments of network connections above the transport layer, using symmetric cryptography for confidentiality and asymmetric cryptography for authentication. TLS has three subprotocols: the Record Protocol for encapsulation and encryption of messages, the Handshake Protocol for authentication and key exchange, and the Alert Protocol for transmitting error messages or closure alerts. TLS establishes authenticated and encrypted connections between a client and server using session resumption, session identifiers, and cryptographic parameters including the master secret.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    of 28

    TRANSPORT LAYER SECURITY

    TLS
     It is one of the most widely used security
    services.
     SSL is a general-purpose service implemented
    as a set of protocols that rely on TCP.
     Here, there are two implementation choices. For
    full generality, SSL (or TLS) could be provided
    as part of the underlying protocol suite and
    therefore be transparent to applications.
     Alternatively, SSL can be embedded in specific
    packages.
    TLS Architecture
     SSL is designed to make use of TCP to provide a reliable end-to-end secure service.
     SSL is not a single protocol but rather two layers of protocols.
     The SSL Record Protocol provides basic security services to various higher-layer protocols.
     Three higher-layer protocols are defined as part of SSL:
    a. the Handshake Protocol
    b. The Change Cipher Spec Protocol
    c. the Alert Protocol.
    Two important TLS concepts are the TLS session and the TLS
    connection

    “
    Connection
    • A connection is a transport that provides a suitable type of
    service.
    • For TLS, such connections are peer-to-peer relationships.
    Session:
    • A TLS session is an association between a client and a
    server.
    • Sessions are created by the Handshake Protocol.
    • Sessions define a set of cryptographic security parameters
    which can be shared among multiple connections.
    A session is defined by the following parameters:
    • Session identifier: An arbitrary byte sequence chosen by the server
    to identify an active or re-sumable session state.
    • Peer certificate: An X509.v3 certificate of the peer. This element of
    the state may be null.
    • Compression method: The algorithm used to compress data prior to
    encryption.
    • Cipher spec: Specifies the bulk data encryption algorithm and a
    hash algorithm used for MAC calculation.
    • Master secret: 48-byte secret shared between the client and the
    server.
    • Is resumable: A flag indicating whether the session can be used to
    initiate new connections.
    A connection state is defined by the following parameters:
    • Server and client random: Byte sequences that are chosen by the
    server and client for each connection.
    • Server write MAC secret: The secret key used in MAC operations on
    data sent by the server.
    • Client write MAC secret: The secret key used in MAC operations on
    data sent by the client.
    • Server write key: The secret encryption key for data encrypted by the
    server and decrypted by the client.
    • Client write key: The symmetric encryption key for data encrypted by
    the client and decrypted by the server.

    • Initialization vectors: When a block cipher in CBC mode is used, an


    initialization vector (IV) is maintained for each key.
    • Sequence numbers: Each party maintains separate sequence numbers
    for transmitted and received messages for each connection.
    TLS Record protocol
    The TLS Record Protocol provides two services for SSL connections:

    • Confidentiality: The Handshake Protocol defines a shared secret key that is


    used for conventional encryption of SSL payloads.
    • Message Integrity: The Handshake Protocol also defines a shared secret key
    that is used to form a message authentication code (MAC).
    1. Fragmentation
    2. Compression
    3. Add MAC
    4. Encryption (Compressed data +MAC)
    5. The final step of SSL Record Protocol processing is to prepare a header
    consisting of the following fields:
    • Content Type (8 bits)
    • Major Version (8 bits)
    • Minor Version (8 bits)
    • Compressed Length (16 bits)
    Change Cipher Spec Protocol
    ● The Change Cipher Spec Protocol is one of the
    three SSL-specific protocols that use the TLS
    Record Protocol, and it is the simplest.
    ● This protocol consists of a single message,
    which consists of a single byte with the value 1.
    ● The sole purpose of this message is to cause the
    pending state to be copied into the current state,
    which updates the cipher suite to be used on this
    connection.
    Alert Protocol:
    ● The Alert Protocol is used to convey SSL-related alerts to the peer entity.

    Figure: SSL Record Format


    “
    ● Each message in this protocol consists of two bytes.
    ● The first byte takes the value warning (1) or fatal (2) to convey the
    severity of the message.
    ● The second byte contains a code that indicates the specific alert.

    Figure: SSL Record Protocol Payload


    List of those alerts that are always fatal :
    • Unexpected message
    • Bad record mac
    • Decompression failure
    • Handshake failure
    • Illegal parameter:
    • Close notify
    • No certificate
    • bad certificate
    • unsupported Certificate
    • Certificate revoked
    • Certificate expired
    • Certificate unknown
    Handshake Protocol
    • The Handshake Protocol consists of a series of
    messages exchanged by client
    and server.
    Each message has three fields:
    • Type (1 byte)
    • Length (3 bytes)
    • Content (# 0 bytes)
    “
    Phase 1: Establish Security Capabilities .
    Phase 2. Server Authentication and Key Exchange.
    Phase 3: Client Authentication and Key Exchange.
    Phase 4: Finish this phase completes the setting up of a
    secure connection.
    Cryptographic Computations
    ● Two further items are of interest:
    (1) the creation of a shared master secret by means
    of the key exchange
    (2) the generation of cryptographic parameters
    from the master secret.
    Master Secret Creation
    ● The shared master secret is a one-time 48-byte value (384
    bits) generated for this session by means of secure key
    exchange. The creation is in two stages.
    ● First, a pre_master_secret is exchanged.
    ● Second, the master_secret is calculated by both parties. For
    pre_master_secret exchange, there are two possibilities.
    1. RSA
    2. Diffie-Hellman
    Transport Layer Security
    ● It is an internet standard version of socket secure layer initiated by IETF.
    ● A primary use case of TLS is encrypting the communication between web applications
    and servers, such as web browsers loading a website.

    Version Number:
    ● The transport layer record format is same
    as that of SSL (i.e secure socket layer).
    ● Major difference is just their version values .
    Message authentication code:
    ● Transport layer security uses HMAC algorithm.
    ● The following illustration shows how the HMAC function works:

    ● HMAC is a type of MAC that uses a hash function


    i.e HMAC = hashFunc(secret key + message).
    ● Hence HMAC is defined as H[(K+ ⊕ opad) } H[(K+ ⊕ ipad) } M]] where:

    H = embedded hash function


    M = message input to HMAC
    K+= secret key padded with zeros on the left so that the result is equal to the
    block length of the hashcode.
    ipad = 00110110 (36 in hexadecimal) repeated 64 times
    opad =01011100 (5C in hexadecimal) repeated 64 times (512 bits )
    MAC…….
    ● SSL uses the same algorithm, except that the padding bytes (i.e ipad or opad) are
    concatenated with the secret key rather than being XORed with the secret key.
    ● The level of security should be about the same in both cases.
    ● MAC calculation encompasses the fields indicated in the following expression:

    MAC(MAC_write_secret ,seq_num || TLSCompressed.type ||


    TLSCompressed.version || TLSCompressed.length ||
    TLSCompressed.fragment)
    ● The MAC calculation in TLS covers all of the fields covered by the Secure socket layer
    calculation, plus the field TLSCompressed.version.
    Pseudorandom function:
    ● A construction is required to do expansion of secrets into blocks of data for the
    purposes of key generation or validation.
    ● The PRF takes as input a secret, a seed, and an identifying label and produces an output
    of arbitrary length.
    ● First, we define a data expansion function, P_hash(secret, data) which uses a single
    hash function to expand a secret and seed into an arbitrary quantity of output:

    HMAC_hash(secret, A(1) + seed) +


    HMAC_hash(secret, A(2) + seed) +
    ● where: HMAC_hash(secret, A(3) + seed) ...
    A() is defined as: A(0) = seed
    A(i) = HMAC_hash(secret, A(i-1))
    PRF….
    ● P_hash can be iterated as many times as is
    necessary to produce the required quantity of
    data.
    ● To make PRF as secure as possible, it uses two
    hash algorithms in a way that should guarantee its
    security.
    PRF is defined as :

    PRF(secret, label, seed)= P_hash(S1, label || Seed)


    Alert codes:
    record_overflow : A TLS record was received with a payload whose length exceeds 214 + 2048
    bytes.
    unknown_ca: Certificate was not accepted as the CA certificate could not be located or be
    matched .
    access_denied: When access control was applied, the sender decided not to proceed with the
    negotiation.

    decode_error: Decrypted ciphertext is invalid.

    protocol_version: The protocol version not supported.

    insufficient_security: Negotiation has failed specifically because the server requires ciphers
    more secure than those supported by the client.

    unsupported_extension: When the extension received is not supported

    internal_error: Local error

    decrypt_error: Unable to verify a signature, decrypt a key exchange, or validate a finished


    message.

    user_canceled: This handshake is being cancelled for some reason .

    no_renegotiation: This alert indicates that the sender is not able to renegotiate. This message
    is always a warning.
    Cipher Suites:
    There are several small differences
    between the cipher suites available under
    SSLv3 and under TLS:

    ● Key Exchange: TLS supports all of the key


    exchange techniques of SSLv3 with the
    exception of Fortezza.

    ● Symmetric Encryption Algorithms: TLS


    includes all of the symmetric encryption
    algorithms found in SSLv3, with the exception
    of Fortezza.
    Client Certificate Types:
    ● TLS defines the following certificate types to be
    requested in a certificate_ request message:
    rsa_sign, dss_sign, rsa_fixed_dh, and
    dss_fixed_dh.

    ● In addition, SSLv3 includes rsa_ephemeral_dh,


    dss_ephemeral_dh, and fortezza_kea. For TLS,
    the rsa_ sign and dss_sign types are used for that
    function.

    ● TLS does not include the Fortezza scheme.


    certificate_verify and finished messages:
     In the TLS certificate_verify message, the MD5 and SHA-1 hashes are calculated only
    over handshake_messages.

     As with the finished message in SSLv3, the finished message in TLS is a hash based
    on the shared master_secret, the previous handshake messages, & a label that identifies
    client or server. we have
    PRF(master_secret,finished_label,MD5(handshake_messages)|| SHA-
    1(handshake_messages))

     where finished_label is the string “client finished” for the client and “server finished”
    for the server.
    Cryptographic Computations:

     The pre_master_secret for TLS is calculated in the same way as in SSLv3. As in SSLv3,
    the master_secret in TLS is calculated as a hash function of the pre_ master_secret and
    the two hello random numbers.
     The form of the TLS calculation is different from that of SSLv3
    master_secret = PRF(premaster_secret,“ master secret",ClientHello.random ||
    ServerHello.random)
     The algorithm is performed until 48 bytes of pseudorandom output are produced.
    Padding:
    ● In SSL, the padding added prior to encryption of
    user data is the minimum amount required so
    that the total size of the data to be encrypted is a
    multiple of the cipher’s block length.
    ● In TLS, the padding can be any amount that
    results in a total that is a multiple of the cipher’s
    block length, up to a maximum of 255 bytes.
    ● A variable padding length may be used to
    frustrate attacks based on an analysis of the
    lengths of exchanged messages.

    You might also like