Internet Security Cryptographic Principles, Algorithms and Protocols - Chapter 8 pdf

When the client or server sends a change cipher spec message, it copies the pending write state into the current write state.. When the handshake negotiation is completed, the client and

8 Transport Layer Security:

SSLv3 and TLSv1

Secure Sockets Layer version 3 (SSLv3) was introduced by Netscape CommunicationsCorporation in 1995 SSLeay implements both SSLv2 and SSLv3 and TLSv1 as of therelease of SSLeay-0.9.0 SSLv3 was designed with public review and input from industryand was published as an Internet-Draft document After reaching a consensus of opinion toInternet standardisation, the Transport Layer Security (TLS) Working Group was formedwithin IETF in order to develop an initial version of TLS as an Internet standard Thefirst version of TLS is very closely compatible with SSLv3 The TLSv1 protocol providescommunications privacy and data integrity between two communicating parties over theInternet Both the SSL and TLS protocols allow client/server applications to communicate

in such a way that they prevent eavesdropping, tampering or message forgery The SSL(or TLS) protocol is composed of two layers: the SSL (or TLS) Record Protocol and theSSL (or TLS) Handshake Protocol

This chapter is devoted to a full discussion of the protocols of both SSLv3 and TLSv1

SSL is a layered protocol It is not a single protocol but rather two layers of protocols

At the lower level, the SSL Record Protocol is layered on top of some reliable transportprotocol such as TCP The SSL Record Protocol is also used to encapsulate various higher-level protocols A higher-level protocol can layer on top of the SSL protocol transparently.For example, the HyperText Transfer Protocol (HTTP), which provides a transfer servicefor Web client/server interaction, can operate on top of the SSL Record Protocol.The SSL Record Protocol takes the upper-layer application message to be transmitted,fragments the data into manageable blocks, optionally compresses the data, applies anMAC, encrypts, adds a header, and transmits the result to TCP The received data is

Internet Security. Edited by M.Y Rhee

 2003 John Wiley & Sons, Ltd ISBN 0-470-85285-2

SSL Handshake Protocol

SSL Change Cipher Spec Protocol

Figure 8.1 Two-layered SSL protocols.

decrypted, verified, decompressed, reassembled, and then delivered to higher-level clients.Figure 8.1 illustrates the overview of the SSL protocol stack

There are two defined specifications: SSL session and SSL connection

SSL session

An SSL session is an association between a client and a server Sessions are created by theHandshake Protocol They define a set of cryptographic security parameters, which can beshared among multiple connections Sessions are used to avoid the expensive negotiation

of new security parameters for each connection An SSL session coordinates the states

of the client and server Logically the state is represented twice as the current operating

state and pending state When the client or server receives a change cipher spec message,

it copies the pending read state into the current read state When the client or server

sends a change cipher spec message, it copies the pending write state into the current

write state When the handshake negotiation is completed, the client and server exchange

change cipher spec messages, and they then communicate using the newly agreed-upon

cipher spec

The session state is defined by the following elements:

• Session identifier: This is a value generated by a server that identifies an active or

resumable session state

• Peer certificate: This is an X.509 v3 certificate of the peer This element of the state

may be null

• Compression method : This is the algorithm used to compress data prior to encryption.

• Cipher spec: This specifies the bulk data encryption algorithm (such as null, DES,

etc.) and a hash algorithm (such as MD5 or SHA-1) used for MAC computation Italso defines cryptographic attributes such as the hash size

• Master secret : This is a 48-byte secret shared between the client and server It

repre-sents secure secret data used for generating encryption keys, MAC secrets and IVs

• Is resumable: This designates a flag indicating whether the session can be used to

initiate new connections

SSL connection

A connection is a transport (in the OSI layering model definition) that provides a suitabletype of service For SSL, such connections are peer-to-peer relationships The connectionsare transient Every connection is associated with one session

The connection state is defined by the following elements:

• Server and client random: These are byte sequences that are chosen by the server and

client for each connection

• Server write MAC secret : This indicates the secret key used in MAC operations on

data sent by the server

• Client write MAC secret : This represents the secret key used in MAC operations on

data sent by the client

• Server write key: This is the conventional cipher key for data encrypted by the server

and decrypted by the client

• Client write key :

This is the conventional cipher key for data encrypted by the client and decrypted bythe server

• Initialisation vectors: When a block cipher in CBC mode is used, an IV is maintained

for each key This field is first initialised by the SSL Handshake Protocol Thereafterthe final ciphertext block from each record is preserved for use as the IV with thefollowing record The IV is XORed with the first plaintext block prior to encryption

• Sequence numbers: Each party maintains separate sequence numbers for transmitted

and received messages for each connection When a party sends or receives a changecipher spec message, the appropriate sequence number is set to zero Sequence num-bers may not exceed264− 1

The SSL Record Protocol provides basic security services to various higher-layer cols Three upper-layer protocols are defined as part of SSL: the Handshake Protocol, theChange Cipher Spec Protocol and the Alert Protocol Two layers of SSL protocols areshown in Figure 8.1 The SSL Record Layer receives data from higher layers in blocks

proto-of arbitrary size

The SSL Record Protocol takes an application message to be transmitted, fragments thedata into manageable blocks, optionally compresses the data, applies an MAC, encrypts,adds a header, and transmits the result in a TCP segment The received data is decrypted,verified, decompressed, reassembled and then delivered to higher-level clients The overalloperation of the SSL Record Protocol is shown in Figure 8.2

• Fragmentation: A higher-layer message is fragmented into blocks (SSLPlaintext

re-cords) of 214bytes or less

280 INTERNET SECURITY

C

EK Compress

Encrypt

SSL record header

Transmit to TCP

H() K

K : Shared sceret key H() : Hash function (MD5 or SHA-1) Fragment

Compressed data

EK

Figure 8.2 The overall operation of the SSL Record Protocol.

• Compression and decompression: All records are compressed using the compression

algorithm defined in the current session state The compression algorithm translates

an SSLPlaintext structure into an SSLCompressed structure Compression must belossless and may not increase the current length by more than 1024 bytes If the decom-pression function encounters an SSLCompressed.fragment that would decompress

to a length in excess of 214= 16348 bytes, it should issue a fatal failure alert

decompression-Compression is essentially useful when encryption is applied If both sion and encryption are required, compression should be applied before encryption.The compression processing should ensure that an SSLPlaintext structure is identicalafter being compressed and decompressed Compression is optionally applied in theSSL Record Protocol, but, if applied, it must be done before encryption and MACcomputation

compres-• MAC : The MAC is computed before encryption The computation of an MAC over the

compressed data is illustrated in Figure 8.3 Using a shared secret key, the calculation

Team-Fly®

MAC-write-secret: Shared secret key

Hash (H1 and H): Cryptographic hash algorithm;

either MD5 or SHA-1Pad-1: The byte 0x36 (0011 0110) repeated

48 times (384 bits) for MD5 and

40 times (320 bits) for SHA-1Pad-2: The byte 0x5C (0101 1100) repeated

48 times for MD5 and

40 times for SHA-1Seq-num: The sequence number for this message

SSLCompressed.type: The higher-level protocol used to

process this fragmentSSLCompressed.length: The length of the compressed

fragment

SSLCompressed.fragment: The compressed fragment (the plaintext

fragment if not compressed)

The compressed message plus the MAC are encrypted using symmetric encryption.The block ciphers being used as encryption algorithms are:

DES(56), Triple DES(168), IDEA(128),

RC5(variable) and Fortezza(80)

where the number inside the brackets indicates the key size Fortezza is a PCMCIAcard that provides both encryption and digital signing

For block encryption, padding is added after the MAC prior to encryption Thetotal size of the data (plaintext plus MAC plus padding) to be encrypted must be

a multiple of the cipher’s block length Padding is added to force the length of theplaintext to be a multiple of the block cipher’s block length Padding is formed byappending a single ‘1’ bit to the end of the message and then ‘0’ bits are added, asmany as needed The last 64 bits of the total size of padded data are reserved for theoriginal message length

For stream encryption, the compressed message plus the MAC are encrypted Sincethe MAC is computed before encryption takes place, it is encrypted along with thecompressed plaintext

• Append SSL record header : The final processing of the SSL Record Protocol is to

append an SSL record header The composed fields consist of:

– Content type (8 bits): This field is the higher-layer protocol used to process the

– Compressed length (16 bits): This field indicates the length in bytes of the

plain-text fragment or compressed fragment if compression is required The maximumvalue is214+ 2048

Figure 8.4 illustrates the SSL Record Protocol format

The SSL-specific protocols consist of the Change Cipher Spec Protocol, the AlertProtocol and the Handshake Protocol, as shown in Figure 8.1 The contents of these threeprotocols are presented in what follows

The Change Cipher Spec Protocol is the simplest of the three SSL-specific protocols.This protocol consists of a single message, which is compressed and encrypted underthe current CipherSpec The message consists of a single byte of value 1 The changecipher spec message is sent by both the client and server to notify the receiving party

type

Plaintext or compressed text

MAC(0, 16 byte(MD5), 20 byte(SHA-1))

Major version

Minor version

Compressed length

To be encrypted

Figure 8.4 SSL Record Protocol format.

that subsequent records will be protected under the just-negotiated CipherSpec and keys.Reception of this message causes the pending state to be copied into the current state,which updates the cipher suite to be used on this connection The client sends a changecipher spec message following handshake key exchange and certificate verify messages(if any), and the server sends one after successfully processing the key exchange message

it received from the client

One of the content types supported by the SSL Record Layer is the alert type Alertmessages convey the severity of the message and a description of the alert Alert messagesconsist of 2 bytes The first byte takes the value warning or fatal to convey the seriousness

of the message If the level is fatal, SSL immediately terminates the connection In thiscase, other connections on the same session may continue, but the session identifiers must

be invalidated, preventing the failed session from being used to establish new connections.The second byte contains a code that indicates the specific alert As with other applicationsthat use SSL, alert messages are compressed and encrypted, as specified by the currentconnection state

A specification of SSL-related alerts that are always fatal is listed in the following:

• unexpected-message: An inappropriate message was received This alert is always

fatal

• bad-record-mac: This alert is returned if a record is received with an incorrect MAC.

This message is always fatal

• decompression-failure: The decompression function received improper input (i.e data

that would expand to a length that is greater than the maximum allowable length).This message is always fatal

• no-certificate: This alert message may be sent in response to a certificate request if

no appropriate certificate is available

• bad-certificate: A received certificate was corrupt, i.e contained a signature that did

not verify correctly

• unsupported certificate: The type of the received certificate is not supported.

• certificate-revoked : A certificate has been revoked by its signer.

• certificate-expired : A certificate has expired or is not currently valid.

• certificate-unknown: This means some other unspecified issue arose in processing the

certificate, rendering it unacceptable

• illegal-parameter: A field in the handshake was out of range or inconsistent with

other fields This is always fatal

• close-notify : This message notifies the recipient that the sender will not send any more

messages on this connection The session becomes unresumable if any connection isterminated without proper close-notify messages with level equal to warning Eachparty is required to send a close-notify alert before closing the write side of theconnection Either party may initiate a close-notify alert Any data received after aclosure alert is ignored

The SSL Handshake Protocol being operated on top of the SSL Record Layer is themost important part of SSL This protocol provides three services for SSL connectionsbetween the server and client The Handshake Protocol allows the client/server to agree

on a protocol version, to authenticate each other by forming an MAC, and to negotiate

an encryption algorithm and cryptographic keys for protecting data sent in an SSL recordbefore the application protocol transmits or receives its first byte of data

The Handshake Protocol consists of a series of messages exchanged by the clientand server Figure 8.5 shows the exchange of handshake messages needed to establish

a logical connection between client and server The contents and significance of eachmessage are presented in detail in the following sections

8.1.5.1 Phase 1: Hello Messages for Logical Connection

The client sends a client hello message to which the server must respond with a serverhello message, or else a fatal error will occur and the connection will fail The client helloand server hello are used to establish security enhancement capabilities between clientand server The client hello and server hello establish the following attributes: protocolversion, random values (ClientHello.random and ServerHello.random), session ID, ciphersuite and compression method

Hello messages

The hello phase messages are used to exchange security enhancement capabilities betweenclient and server

• Hello request : This message is sent by the server at any time, but may be ignored

by the client if the Handshake Protocol is already underway A client who receives ahello request while in a handshake negotiation state should simply ignore the message

Asterisks (*) are optional or situation-dependent

messages that are not always sent

Application data

Phase 1 Hello messages for logical connection

Phase 2 Server authentication and key exchange

Phase 3 Client authentication and key exchange

Phase 4 End of secure connection

Figure 8.5 SSL Handshake Protocol.

• Client hello: The exchange is initiated by the client A client sends a client hello

message using the session ID of the session to be resumed The server then checksits session cache for a match If a match is found, the server will send a server hellomessage with the same session ID value The client sends a client hello message withthe following parameters:

– Client version: This is the version of the SSL protocol in which the client wishes to

communicate during this session This should be the most recent (highest-valued)version supported by the client The value of this version will be 3.0

– Random: This is a client-generated random structure with 28 bytes generated by

a secure random number generator

– Session ID : This is the identity of a session when the client wishes to use this

con-nection A nonzero value indicates that the client wishes to update the parameters

of an existing connection or create a new connection in this session A zero valueindicates that the client wishes to establish a new connection in a new session.– Cipher suites: This is a list of the cryptographic options supported by the client,

with the client’s first preference first The single cipher suite is an element of alist selected by the server from the list in ClientHello.cipher suites For a resumedsession, this field is the value from the state of the session being resumed.– Compression method : This is a list of the compression methods supported by the

client, sorted by client preference If the session ID field is not empty, it mustinclude the compression method from that session

• Server hello: The server will send the server hello message in response to a client hello

message when it has found an acceptable set of algorithms If it is unable to find such

a match, it will respond with a handshake failure alert The structure of this messageconsists of: server version, random, session ID, cipher suite and compression method

– Server version: This field will contain the lower-valued version suggested by the

client in the client hello and the highest-valued version supported by the server.The value of this version is 3.0

– Random: This structure is generated by the server and must be different from

ClientHello.random

– Session ID : This field represents the identity of the session corresponding to this

connection If the ClientHello.session id is non-empty, the server will look in itssession cache for a match If a match is found and the server is willing to establishthe new connection using the specified session state, the server will respond withthe same value as was supplied by the client This indicates a resumed sessionand dictates that the parties must proceed directly to the finished messages.– Cipher suite: This is the single cipher suite selected by the server from the list in

ClientHello.cipher suites For a resumed session, this field is the value from thestate of the session being resumed

– Compression method : This is the single compression algorithm selected by the

server from the list in ClientHello.compression methods For a resumed sessions,this field is the value from the resumed session state

8.1.5.2 Phase 2: Server Authentication and Key Exchange

Following the hello messages, the server begins this phase by sending its certificate if itneeds to be authenticated Additionally, a server key exchange message may be sent if it

is required If the server is authenticated, it may request a certificate from the client, ifthat is appropriate to the cipher suite selected Then the server will send the server hellodone message, indicating that the hello message phase of the handshake is complete Theserver will then wait for a client response If the server has sent a certificate requestmessage, the client must send the certificate message

• Server certificate: If the server is to be authenticated, it must send a certificate

imme-diately following the server hello message The certificate type must be appropriatefor the selected cipher suite’s key exchange algorithm, and is generally an X.509 v3certificate It must contain a key which matches the key exchange method The signingalgorithm for the certificate must be the same as the algorithm for the certificate key

• Server key exchange message: The server key exchange message is sent by the server

only when it is required This message is not used if the server certificate containsDiffie–Hellman parameters, or RSA key exchange is to be used for a signature-only RSA

– params: the server’s key exchange parameters

– signed-params: for non-anonymous key exchange, a hash of the correspondingparams value, with the signature appropriate to that hash applied

As usual, a signature is created by taking the hash of the message and encrypting itwith the sender’s public key Hence, the hash is defined as:

md5-hash: MD5(ClientHello.random||ServerHello.random||serverParams)

sha-hash: SHA(ClientHello.random||ServerHello.random||serverParams)

enum{anonymous, rsa, dsa}SignatureAlgorithm;

For a DSS signature, the hash is performed using the SHA-1 algorithm In the case

of an RSA signature, both an MD5 and an SHA-1 hash are calculated, and the catenation of the two hashes is encrypted with the server’s public key

con-• Certificate request message: A non-anonymous server can optionally request a

certifi-cate from the client, if appropriate for the selected cipher suite This message includestwo parameters, certificate type and certificate authorities Its structure is as follows:

– certificate types: This field is a list of the types of certificates requested, sorted

in order of the server’s preference

– certificate authorities: This is a list of the distinguished names of acceptable tificate authorities These distinguished names may specify a desired distinguishedname for a root CA or for a subordinate CA; thus, this message can be used todescribe both known roots and a desired authorization space

cer-Note that DistinguishedName is derived from X.509 and that it is a fatal handshakefailure alert for an anonymous server to request client identification.

• Server hello done message: This message is sent by the server to indicate the end

of the server hello and associated messages After sending this message, the serverwill wait for a client response This message means that server has finished sendingmessages to support the key exchange, and the client can proceed with its phase ofthe key exchange Upon receipt of the server hello done message, the client shouldverify that the server provided a valid certificate if required and check that the serverhello parameters are acceptable If all is satisfactory, the client sends one or moremessages back to the server

8.1.5.3 Phase 3: Client Authentication and Key Exchange

If the server has sent a certificate request message, the client must send the certificatemessage The client key exchange message is then sent, and the content of that messagewill depend on the public key algorithm selected between the client hello and the serverhello If the client has sent a certificate with signing ability, a digitally signed certificateverify message is sent to explicitly verify the certificate

• Client certificate message: This is the first message the client can send after

receiv-ing a server hello done message This message is sent only when the server requests

a certificate If no suitable certificate is available, the client should send a cate message containing no certificates If client authentication is required by theserver for the handshake to continue, it may respond with a fatal handshake failurealert The same message type and structure will be used for the client’s response to

certifi-a certificcertifi-ate request messcertifi-age Note thcertifi-at certifi-a client mcertifi-ay send no certificcertifi-ates if it doesnot have an appropriate certificate to send in response to the server’s authentica-tion request The client’s Diffie–Hellman certificates must match the server-specifiedDiffie-Hellman parameters

• Client key exchange message: This message is always sent by the client It will

imme-diately follow the client certificate message, if it is sent Otherwise it will be the firstmessage sent by the client after it receives the server hello done message With thismessage, the premaster secret is set, either through direct transmission of the RSA-encrypted secret, or by transmission of Diffie–Hellman parameters which will alloweach side to agree upon the same premaster secret When the key exchange method

is DH–RSA or DH–DSS, client certification has been requested, and the client wasable to respond with a certificate which contained a Diffie–Hellman public key whoseparameters matched those specified by the server in its certificate; this message willnot contain any data

• Certificate verify message: This message is used to provide explicit verification of a

client certificate The message is only sent following any client certificate that hassigning capability (i.e all certificates except those containing fixed Diffie–Hellmanparameters) When sent, it will immediately follow the client key exchange message.This message signs a hash code based on the preceding messages, and its structure isdefined as follows:

master_secret||pad1))

where pad1 and pad2 are the values defined earlier for the MAC, handshake-messagesrefer to all Handshake Protocol messages sent or received starting at client-hello butnot including this message, and master secret is the calculated secret If the user’sprivate key is DSS, then it is used to encrypt the SHA-1 hash If the user’s privatekey is RSA, it is used to encrypt the concatenation of the MD5 and SHA-1 hashes

8.1.5.4 Phase 4: End of Secure Connection

At this point, a change cipher spec message is sent by the client, and the client copiesthe pending CipherSpec into the current CipherSpec The client then immediately sendsthe finished message under the new algorithms, keys and secrets In response, the serverwill send its own change cipher spec message, transfer the pending CipherSpec to thecurrent one, and then send its finished message under the new CipherSpec At this point,the handshake is complete and the client and server may begin to exchange applicationlayer data (see Figure 8.5)

• Change cipher spec messages: The client sends a change cipher spec message and

copies the pending CipherSpec in the current CipherSpec This message is immediatelysent after the certificate verify message that is used to provide explicit verification of aclient certificate It is essential that a change cipher spec message is received betweenthe other handshake messages and the finished message It is a fatal error if a changecipher spec message is not preceded by a finished message at the appropriate point inthe handshake

• Finished message: This is always sent immediately after a change cipher spec message

to verify that the key exchange and authentication processes were successful Thecontent of the finished message is the concatenation of two hash values:

MD5(master_secret||pad2||MD5(handshake_messages||Sender||master_secret||pad1))

SHA(master_secret||pad2||SHA(handshake_messages||Sender||master_secret||pad1))

where ‘Sender’ is a code that identifies that the sender is the client and shake messages’ is code that identifies the data from all handshake messages up tobut not including this message

Application data treated as transparent data is carried by the Record Layer and is

fragmented, compressed and encrypted based on the current connection state

The key exchange, authentication, encryption and MAC algorithms are determined bythe cipher suite selected by the server and revealed in the server hello message Thecompression algorithm is negotiated in the hello messages, and the random values areexchanged in the hello messages The creation of a shared master secret by means of thekey exchange and the generation of cryptographic parameters from the master secrete are

of interest to study as two further items

For all key exchange methods, the same algorithm is used to convert the premaster secretinto the master secret In order to create the master secret, a premaster secret is firstexchanged between two parties and then the master secret is calculated from it Themaster secret is always exactly 48 bytes (384 bits) shared between the client and server.But the length of the premaster secret is not fixed and will vary depending on the keyexchange method There are two ways for the exchange of the premaster secret:

• RSA: When RSA is used for server authentication and key exchange, a 48-byte

pre-master secret is generated by the client, encrypted with the server’s public key andsent to the server The server decrypts the ciphertext (of the premaster secret) using itsprivate key to recover the premaseter secret Both parties then convert the premastersecret into the master secret as specified below

• Diffie–Hellman: A conventional Diffie–Hellman computation is performed Both

client and server generate a Diffie-Hellman common key This negotiated key is used

as the premaster secret and is converted into the master secret, as specified below

The client and server then compute the master secret as follows: