Web security, SSL and TLS

Web security:
SSL and TLS
What are SSL and TLS?
SSL – Secure Socket Layer
TLS – Transport Layer Security
both provide a secure transport connection between applications (e.g., a web server and a browser)
SSL was developed by Netscape
SSL version 3.0 has been implemented in many web browsers (e.g., Netscape Navigator and MS Internet Explorer) and web servers and widely used on the Internet
SSL v3.0 was specified in an Internet Draft (1996)
it evolved into TLS specified in RFC 2246
TLS can be viewed as SSL v3.1
SSL architecture
SSL Record Protocol
SSL
Handshake
Protocol
SSL Change
Cipher Spec
Protocol
SSL
Alert
Protocol
applications
(e.g., HTTP)
TCP
IP
SSL components
SSL Handshake Protocol
negotiation of security algorithms and parameters
key exchange
server authentication and optionally client authentication
SSL Record Protocol
fragmentation
compression
message authentication and integrity protection
encryption
SSL Alert Protocol
error messages (fatal alerts and warnings)
SSL Change Cipher Spec Protocol
a single message that indicates the end of the SSL handshake
Sessions and connections
an SSL session is an association between a client and a server
sessions are stateful; the session state includes security algorithms and parameters
a session may include multiple secure connections between the same client and server
connections of the same session share the session state
sessions are used to avoid expensive negotiation of new security parameters for each connection
there may be multiple simultaneous sessions between the same two parties, but this feature is not used in practice
Sessions and connections
Session and connection states
session state
session identifier
arbitrary byte sequence chosen by the server to identify the session
peer certificate
X509 certificate of the peer
may be null
compression method
cipher spec
bulk data encryption algorithm (e.g., null, DES, 3DES, …)
MAC algorithm (e.g., MD5, SHA-1)
cryptographic attributes (e.g., hash size, IV size, …)
master secret
48-byte secret shared between the client and the server
is resumable
a flag indicating whether the session can be used to initiate new connections
connection states
Sessions and connections
Session and connection states cont’d
connection state
server and client random
random byte sequences chosen by the server and the client for every connection
server write MAC secret
secret key used in MAC operations on data sent by the server
client write MAC secret
secret key used in MAC operations on data sent by the client
server write key
secret encryption key for data encrypted by the server
client write key
secret encryption key for data encrypted by the client
initialization vectors
an IV is maintained for each encryption key if CBC mode is used
initialized by the SSL Handshake Protocol
final ciphertext block from each record is used as IV with the following record
sending and receiving sequence numbers
sequence numbers are 64 bits long
reset to zero after each Change Cipher Spec message
Sessions and connections
State changes
operating state
currently used state
pending state
state to be used
built using the current state
operating state  pending state
at the transmission and reception of a Change Cipher Spec message
party A
(client or server)
party B
(server or client)
Change Cipher Spec
Sessions and connections
SSL Record Protocol – processing overview
MAC
application data
padding
type
fragmentation
compression
msg authentication and
encryption (with padding if necessary)
version
length
type
version
length
type
version
length
SSLPlaintext
SSLCompressed
SSLCiphertext
SSL Record Protocol
Header
type
the higher level protocol used to process the enclosed fragment
possible types:
change_cipher_spec
alert
handshake
application_data
version
SSL version, currently 3.0
length
length (in bytes) of the enclosed fragment or compressed fragment
max value is 214 + 2048
SSL Record Protocol
MAC
MAC = hash( MAC_write_secret | pad_2 |
hash( MAC_write_secret | pad_1 | seq_num | type | length | fragment ) )

similar to HMAC but the pads are concatenated
supported hash functions:
MD5
SHA-1
pad_1 is 0x36 repeated 48 times (MD5) or 40 times (SHA-1)
pad_2 is 0x5C repeated 48 times (MD5) or 40 times (SHA-1)


SSL Record Protocol
Encryption
supported algorithms
block ciphers (in CBC mode)
RC2_40
DES_40
DES_56
3DES_168
IDEA_128
Fortezza_80
stream ciphers
RC4_40
RC4_128
if a block cipher is used, than padding is applied
last byte of the padding is the padding length

SSL Record Protocol
SSL Alert Protocol
each alert message consists of 2 fields (bytes)
first field (byte): “warning” or “fatal”
second field (byte):
fatal
unexpected_message
bad_record_MAC
decompression_failure
handshake_failure
illegal_parameter
warning
close_notify
no_certificate
bad_certificate
unsupported_certificate
certificate_revoked
certificate_expired
certificate_unknown
in case of a fatal alert
connection is terminated
session ID is invalidated  no new connection can be established within this session
SSL Alert Protocol
SSL Handshake Protocol – overview
client
server
client_hello
server_hello
certificate
server_key_exchange
certificate_request
server_hello_done
certificate
client_key_exchange
certificate_verify
change_cipher_spec
finished
change_cipher_spec
finished
Phase 1: Negotiation of the session ID, key exchange
algorithm, MAC algorithm, encryption algorithm, and
exchange of initial random numbers
Phase 2: Server may send its certificate and key
exchange message, and it may request the client
to send a certificate. Server signals end of hello
phase.
Phase 3: Client sends certificate if requested and may
send an explicit certificate verification message.
Client always sends its key exchange message.
Phase 4: Change cipher spec and finish handshake
SSL Handshake Protocol
Hello messages
client_hello
client_version
the highest version supported by the client
client_random
current time (4 bytes) + pseudo random bytes (28 bytes)
session_id
empty if the client wants to create a new session, or
the session ID of an old session within which the client wants to create the new connection
cipher_suites
list of cryptographic options supported by the client ordered by preference
a cipher suite contains the specification of the
key exchange method, the encryption and the MAC algorithm
the algorithms implicitly specify the hash_size, IV_size, and key_material parameters (part of the Cipher Spec of the session state)
exmaple: SSL_RSA_with_3DES_EDE_CBC_SHA
compression_methods
list of compression methods supported by the client
SSL Handshake Protocol / Phase 1
Hello messages cont’d
server_hello
server_version
min( highest version supported by client, highest version supported by server )
server_random
current time + random bytes
random bytes must be independent of the client random
session_id
session ID chosen by the server
if the client wanted to resume an old session:
server checks if the session is resumable
if so, it responds with the session ID and the parties proceed to the finished messages
if the client wanted a new session
server generates a new session ID
cipher_suite
single cipher suite selected by the server from the list given by the client
compression_method
single compression method selected by the server
SSL Handshake Protocol / Phase 1
Supported key exchange methods
RSA based (SSL_RSA_with...)
the secret key (pre-master secret) is encrypted with the server’s public RSA key
the server’s public key is made available to the client during the exchange
fixed Diffie-Hellman (SSL_DH_RSA_with… or SSL_DH_DSS_with…)
the server has fix DH parameters contained in a certificate signed by a CA
the client may have fix DH parameters certified by a CA or it may send an unauthenticated one-time DH public value in the client_key_exchange message
ephemeral Diffie-Hellman (SSL_DHE_RSA_with… or SSL_DHE_DSS_with…)
both the server and the client generate one-time DH parameters
the server signs its DH parameters with its private RSA or DSS key
the client may authenticate itself (if requested by the server) by signing the hash of the handshake messages with its private RSA or DSS key
anonymous Diffie-Hellman
both the server and the client generate one-time DH parameters
they send their parameters to the peer without authentication
Fortezza
Fortezza proprietary key exchange scheme
SSL Handshake Protocol / Phase 1
Server certificate and key exchange messages
certificate
required for every key exchange method except for anonymous DH
contains one or a chain of X.509 certificates (up to a known root CA)
may contain
public RSA key suitable for encryption, or
public RSA or DSS key suitable for signing only, or
fix DH parameters
server_key_exchange
sent only if the certificate does not contain enough information to complete the key exchange (e.g., the certificate contains an RSA signing key only)
may contain
public RSA key (exponent and modulus), or
DH parameters (p, g, public DH value), or
Fortezza parameters
digitally signed
if DSS: SHA-1 hash of (client_random | server_random | server_params) is signed
if RSA: MD5 hash and SHA-1 hash of (client_random | server_random | server_params) are concatenated and encrypted with the private RSA key
SSL Handshake Protocol / Phase 2
Certificate request and server hello done msgs
certificate_request
sent if the client needs to authenticate itself
specifies which type of certificate is requested (rsa_sign, dss_sign, rsa_fixed_dh, dss_fixed_dh, …)
server_hello_done
sent to indicate that the server is finished its part of the key exchange
after sending this message the server waits for client response
the client should verify that the server provided a valid certificate and the server parameters are acceptable
SSL Handshake Protocol / Phase 2
Client authentication and key exchange
certificate
sent only if requested by the server
may contain
public RSA or DSS key suitable for signing only, or
fix DH parameters
client_key_exchange
always sent (but it is empty if the key exchange method is fix DH)
may contain
RSA encrypted pre-master secret, or
client one-time public DH value, or
Fortezza key exchange parameters
certificate_verify
sent only if the client sent a certificate
provides client authentication
contains signed hash of all the previous handshake messages
if DSS: SHA-1 hash is signed
if RSA: MD5 and SHA-1 hash is concatenated and encrypted with the private key
MD5( master_secret | pad_2 | MD5( handshake_messages | master_secret | pad_1 ) )
SHA( master_secret | pad_2 | SHA( handshake_messages | master_secret | pad_1 ) )
SSL Handshake Protocol / Phase 3
Finished messages
finished
sent immediately after the change_cipher_spec message
first message that uses the newly negotiated algorithms, keys, IVs, etc.
used to verify that the key exchange and authentication was successful
contains the MD5 and SHA-1 hash of all the previous handshake messages:
MD5( master_secret | pad_2 | MD5( handshake_messages | sender | master_secret | pad_1 ) ) |
SHA( master_secret | pad_2 | SHA( handshake_messages | sender | master_secret | pad_1 ) )
where “sender” is a code that identifies that the sender is the client or the server (client: 0x434C4E54; server: 0x53525652)

SSL Handshake Protocol / Phase 4
Cryptographic computations
pre-master secret
if key exchange is RSA based:
generated by the client
sent to the server encrypted with the server’s public RSA key
if key exchange is Diffie-Hellman based:
pre_master_secret = gxy mod p
master secret (48 bytes)
master_secret = MD5( pre_master_secret | SHA( “A” | pre_master_secret | client_random | server_random )) |
MD5( pre_master_secret | SHA( “BB” | pre_master_secret | client_random | server_random )) |
MD5( pre_master_secret | SHA( “CCC” | pre_master_secret | client_random | server_random ))
keys, MAC secrets, IVs
MD5( master_secret | SHA( “A” | master_secret | client_random | server_random )) |
MD5( master_secret | SHA( “BB” | master_secret | client_random | server_random )) |
MD5( master_secret | SHA( “CCC” | master_secret | client_random | server_random )) | …
client write MAC secret
server write MAC secret
client write key
server write key
…
key block :
SSL Handshake Protocol
Key exchange alternatives
RSA / no client authentication
server sends its encryption capable RSA public key in server_certificate
server_key_exchange is not sent
client sends encrypted pre-master secret in client_key_exchange
client_certificate and certificate_verify are not sent
or
server sends its RSA or DSS public signature key in server_certificate
server sends a temporary RSA public key in server_key_exchange
client sends encrypted pre-master secret in client_key_exchange
client_certificate and certificate_verify are not sent

SSL Handshake Protocol
Key exchange alternatives cont’d
RSA / client is authenticated
server sends its encryption capable RSA public key in server_certificate
server_key_exchange is not sent
client sends its RSA or DSS public signature key in client_certificate
client sends encrypted pre-master secret in client_key_exchange
client sends signature on all previous handshake messages in certificate_verify
or
server sends its RSA or DSS public signature key in server_certificate
server sends a one-time RSA public key in server_key_exchange
client sends its RSA or DSS public signature key in client_certificate
client sends encrypted pre-master secret in client_key_exchange
client sends signature on all previous handshake messages in certificate_verify
SSL Handshake Protocol
Key exchange alternatives cont’d
fix DH / no client authentication
server sends its fix DH parameters in server_certificate
server_key_exchange is not sent
client sends its one-time DH public value in client_key_exchange
client_ certificate and certificate_verify are not sent

fix DH / client is authenticated
server sends its fix DH parameters in server_certificate
server_key_exchange is not sent
client sends its fix DH parameters in client_certificate
client_key_exchange is sent but empty
certificate_verify is not sent
SSL Handshake Protocol
Key exchange alternatives cont’d
ephemeral DH / no client authentication
server sends its RSA or DSS public signature key in server_certificate
server sends signed one-time DH parameters in server_key_exchange
client sends one-time DH public value in client_key_exchange
client_certificate and certificate_verify are not sent

ephemeral DH / client is authenticated
server sends its RSA or DSS public signature key in server_certificate
server sends signed one-time DH parameters in server_key_exchange
client sends its RSA or DSS public signature key in client_certificate
client sends one-time DH public value in client_key_exchange
client sends signature on all previous handshake messages in certificate_verify
SSL Handshake Protocol
Key exchange alternatives cont’d
anonymous DH / no client authentication
server_certificate is not sent
server sends (unsigned) one-time DH parameters in server_key_exchange
client sends one-time DH public value in client_key_exchange
client_certificate and certificate_verify are not sent

anonymous DH / client is authenticated
not allowed
SSL Handshake Protocol
TLS vs. SSL
version number
for TLS the current version number is 3.1
MAC
TLS uses HMAC
the MAC covers the version field of the record header too
more alert codes
cipher suites
TLS doesn’t support Fortezza key exchange and Fortezza encryption
certificate_verify message
the hash is computed only over the handshake messages
in SSL the hash contained the master_secret and pads

TLS vs. SSL
TLS vs. SSL cont’d
pseudorandom function PRF
P_hash(secret, seed) = HMAC_hash( secret, A(1) | seed ) |
HMAC_hash( secret, A(2) | seed ) |
HMAC_hash( secret, A(3) | seed ) | …
where
A(0) = seed
A(i) = HMAC_hash(secret, A(i-1))

PRF(secret, label, seed) =
P_MD5(secret_left, label | seed) Å P_SHA(secret_right, label | seed)
TLS vs. SSL
TLS vs. SSL cont’d
finished message
PRF( master_secret,
“client finished”,
MD5(handshake_messages) | SHA(handshake_messages) )
cryptographic computations
pre-master secret is calculated in the same way as in SSL
master secret:
PRF( pre_master_secret,
“master secret”,
client_random | server_random )
key block:
PRF( master_secret,
“key expansion”,
server_random | client_random )
padding before block cipher encryption
variable length padding is allowed (max 255 padding bytes)
TLS vs. SSL