Abstract
At the time of writing, TLS version 1.2 is the only version supported by all websites. This is one of the reasons why we chose version 1.2 for a detailed analysis of TLS. The second reason is that all attacks on TLS published so far cannot be understood without a thorough knowledge of the TLS blueprint underlying version 1.2. We start with an overview of the complex ecosystem of TLS, including its architecture and methods to activate TLS. We continue with the encryption layer, the TLS record layer. The TLS handshake is the most complex part of TLS, and we devote several sections to it: After a quick overview, we explain the central concept of ciphersuites. Then we look closely at all handshake messages and their role in the protocol. This section also details key derivation and the cryptography of the two main handshake families. Alert messages and the two variants of the TLS handshake, TLS session resumption and TLS renegotiation, are also part of the standard. TLS extenions and various HTTP headers modifying TLS standard behavior are specified in separate RFCs. The most fundamental change in TLS functionality is Datagram TLS (DTLS) which adapts TLS to UDP-based traffic. An extensive related work section and exercises conclude this chapter.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Aboba, B., Simon, D., Eronen, P.: Extensible Authentication Protocol (EAP) Key Management Framework. RFC 5247 (Proposed Standard) (2008). DOI https://doi.org/10.17487/RFC5247. URL https://www.rfc-editor.org/rfc/rfc5247.txt. Updated by RFC 8940
Barthe, G., Gregoire, B., Heraud, S., Zanella Beguelin, S.: Computer-aided security proofs for the working cryptographer. In: P. Rogaway (ed.) Advances in Cryptology – CRYPTO 2011, Lecture Notes in Computer Science, vol. 6841, pp. 71–90. Springer, Heidelberg, Germany, Santa Barbara, CA, USA (2011). DOI https://doi.org/10.1007/978-3-642-22792-9_5
Bellare, M., Namprempre, C.: Authenticated encryption: Relations among notions and analysis of the generic composition paradigm. In: T. Okamoto (ed.) Advances in Cryptology–ASIACRYPT 2000, Lecture Notes in Computer Science, vol. 1976, pp. 531–545. Springer, Heidelberg, Germany, Kyoto, Japan (2000). DOI https://doi.org/10.1007/3-540-44448-3_41
Bellare, M., Namprempre, C.: Authenticated encryption: Relations among notions and analysis of the generic composition paradigm. Journal of Cryptology 21(4), 469–491 (2008). DOI https://doi.org/10.1007/s00145-008-9026-x
Bellare, M., Rogaway, P.: Entity authentication and key distribution (1994)
Bhargavan, K., Fournet, C., Corin, R., Zalinescu, E.: Cryptographically verified implementations for TLS. In: P. Ning, P.F. Syverson, S. Jha (eds.) ACM CCS 2008: 15th Conference on Computer and Communications Security, pp. 459–468. ACM Press, Alexandria, Virginia, USA (2008). DOI https://doi.org/10.1145/1455770.1455828
Bhargavan, K., Fournet, C., Kohlweiss, M., Pironti, A., Strub, P.Y.: Implementing TLS with verified cryptographic security. In: 2013 IEEE Symposium on Security and Privacy, pp. 445–459. IEEE Computer Society Press, Berkeley, CA, USA (2013). DOI https://doi.org/10.1109/SP.2013.37
Bhargavan, K., Fournet, C., Kohlweiss, M., Pironti, A., Strub, P.Y., Zanella Beguelin, S.: Proving the TLS handshake secure (as it is). In: J.A. Garay, R. Gennaro (eds.) Advances in Cryptology – CRYPTO 2014, Part II, Lecture Notes in Computer Science, vol. 8617, pp. 235–255. Springer, Heidelberg, Germany, Santa Barbara, CA, USA (2014). DOI https://doi.org/10.1007/978-3-662-44381-1_14
Bhargavan (Ed.), K., Delignat-Lavaud, A., Pironti, A., Langley, A., Ray, M.: Transport Layer Security (TLS) Session Hash and Extended Master Secret Extension. RFC 7627 (Proposed Standard) (2015). DOI https://doi.org/10.17487/RFC7627. URL https://www.rfc-editor.org/rfc/rfc7627.txt
Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., Moeller, B.: Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS). RFC 4492 (Informational) (2006). DOI https://doi.org/10.17487/RFC4492. URL https://www.rfc-editor.org/rfc/rfc4492.txt. Obsoleted by RFC 8422, updated by RFCs 5246, 7027, 7919
Blake-Wilson, S., Nystrom, M., Hopwood, D., Mikkelsen, J., Wright, T.: Transport Layer Security (TLS) Extensions. RFC 4366 (Proposed Standard) (2006). DOI https://doi.org/10.17487/RFC4366. URL https://www.rfc-editor.org/rfc/rfc4366.txt. Obsoleted by RFCs 5246, 6066, updated by RFC 5746
Bleichenbacher, D.: Chosen ciphertext attacks against protocols based on the RSA encryption standard PKCS #1. In: H. Krawczyk (ed.) Advances in Cryptology – CRYPTO’98, Lecture Notes in Computer Science, vol. 1462, pp. 1–12. Springer, Heidelberg, Germany, Santa Barbara, CA, USA (1998). DOI https://doi.org/10.1007/BFb0055716
Brinkmann, M., Dresen, C., Merget, R., Poddebniak, D., Muller, J., Somorovsky, J., Schwenk, J., Schinzel, S.: ALPACA: Application layer protocol confusion - analyzing and mitigating cracks in TLS authentication. In: M. Bailey, R. Greenstadt (eds.) USENIX Security 2021: 30th USENIX Security Symposium, pp. 4293–4310. USENIX Association (2021)
Brzuska, C., Fischlin, M., Smart, N., Warinschi, B., Williams, S.: Less is more: Relaxed yet composable security notions for key exchange. Cryptology ePrint Archive, Report 2012/242 (2012). https://eprint.iacr.org/2012/242
Canetti, R.: Universally composable security: A new paradigm for cryptographic protocols. In: 42nd Annual Symposium on Foundations of Computer Science, pp. 136–145. IEEE Computer Society Press, Las Vegas, NV, USA (2001). DOI https://doi.org/10.1109/SFCS.2001.959888
Canetti, R., Krawczyk, H.: Analysis of key-exchange protocols and their use for building secure channels. In: B. Pfitzmann (ed.) Advances in Cryptology – EUROCRYPT 2001, Lecture Notes in Computer Science, vol. 2045, pp. 453–474. Springer, Heidelberg, Germany, Innsbruck, Austria (2001). DOI https://doi.org/10.1007/3-540-44987-6_28
Chaki, S., Datta, A.: ASPIER: An automated framework for verifying security protocol implementations. In: J.C. Mitchell (ed.) CSF 2009: IEEE 22st Computer Security Foundations Symposium, pp. 172–185. IEEE Computer Society Press, Port Jefferson, New York, USA (2009). DOI https://doi.org/10.1109/CSF.2009.20
Coron, J.S., Joye, M., Naccache, D., Paillier, P.: New attacks on PKCS#1 v1.5 encryption. In: B. Preneel (ed.) Advances in Cryptology – EUROCRYPT 2000, Lecture Notes in Computer Science, vol. 1807, pp. 369–381. Springer, Heidelberg, Germany, Bruges, Belgium (2000). DOI https://doi.org/10.1007/3-540-45539-6_25
Dierks, T., Allen, C.: The TLS Protocol Version 1.0. RFC 2246 (Proposed Standard) (1999). URL http://www.ietf.org/rfc/rfc2246.txt
Dierks, T., Rescorla, E.: The Transport Layer Security (TLS) Protocol Version 1.1. RFC 4346 (Proposed Standard) (2006). URL http://www.ietf.org/rfc/rfc4346.txt
Dierks, T., Rescorla, E.: The Transport Layer Security (TLS) Protocol Version 1.2. RFC 5246 (Proposed Standard) (2008). URL http://www.ietf.org/rfc/rfc5246.txt
Dolev, D., Yao, A.C.: On the security of public key protocols. IEEE Trans. Inf. Theory 29(2), 198–207 (1983). DOI https://doi.org/10.1109/TIT.1983.1056650. URL https://doi.org/10.1109/TIT. 1983.1056650
Eastlake 3rd, D.: Transport Layer Security (TLS) Extensions: Extension Definitions. RFC 6066 (Proposed Standard) (2011). DOI https://doi.org/10.17487/RFC6066. URL https://www.rfc-editor.org/rfc/rfc6066.txt. Updated by RFCs 8446, 8449
Eronen (Ed.), P., Tschofenig (Ed.), H.: Pre-Shared Key Ciphersuites for Transport Layer Security (TLS). RFC 4279 (Proposed Standard) (2005). DOI https://doi.org/10.17487/RFC4279. URL https://www.rfc-editor.org/rfc/rfc4279.txt. Updated by RFC 8996
Evans, C., Palmer, C., Sleevi, R.: PublicKey Pinning Extension for HTTP. RFC 7469 (Proposed Standard) (2015). DOI https://doi.org/10.17487/RFC7469. URL https://www.rfc-editor.org/rfc/rfc7469.txt
Ford-Hutchinson, P.: Securing FTP with TLS. RFC 4217 (Proposed Standard) (2005). DOI https://doi.org/10.17487/RFC4217. URL https://www.rfc-editor.org/rfc/rfc4217.txt. Updated by RFC 8996
Freier, A., Karlton, P., Kocher, P.: The Secure Sockets Layer (SSL) Protocol Version 3.0. RFC 6101 (Historic) (2011). DOI https://doi.org/10.17487/RFC6101. URL https://www.rfc-editor.org/rfc/rfc6101.txt
Friedl, S., Popov, A., Langley, A., Stephan, E.: Transport Layer Security (TLS) Application-Layer Protocol Negotiation Extension. RFC 7301 (Proposed Standard) (2014). DOI https://doi.org/10.17487/RFC7301. URL https://www.rfc-editor.org/rfc/rfc7301.txt. Updated by RFC8447
Gajek, S., Manulis, M., Pereira, O., Sadeghi, A.R., Schwenk, J.: Universally composable security analysis of TLS. In: J. Baek, F. Bao, K. Chen, X. Lai (eds.) ProvSec 2008: 2nd International Conference on Provable Security, Lecture Notes in Computer Science, vol. 5324, pp. 313–327. Springer, Heidelberg, Germany, Shanghai, China (2008)
Giesen, F., Kohlar, F., Stebila, D.: On the security of TLS renegotiation. In: A.R. Sadeghi, V.D. Gligor, M. Yung (eds.) ACM CCS 2013: 20th Conference on Computer and Communications Security, pp. 387–398. ACM Press, Berlin, Germany (2013). DOI https://doi.org/10.1145/2508859.2516694
Gillmor, D.: Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for Transport Layer Security (TLS). RFC 7919 (Proposed Standard) (2016). DOI https://doi.org/10.17487/RFC7919. URL https://www.rfc-editor.org/rfc/rfc7919.txt
Gutmann, P.: Encrypt-then-MAC for Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS). RFC 7366 (Proposed Standard) (2014). DOI https://doi.org/10.17487/RFC7366. URL https://www.rfc-editor.org/rfc/rfc7366.txt
Hickman, K.: The SSL Protocol. Internet Draft, http://tools.ietf.org/html/drafthickman-netscape-ssl-00.txt (1995). URL http://tools.ietf.org/html/draft-hickman-netscape-ssl-00.txt
Hodges, J., Morgan, R., Wahl, M.: Lightweight Directory Access Protocol (v3): Extension for Transport Layer Security. RFC 2830 (Proposed Standard) (2000). DOI https://doi.org/10.17487/RFC2830. URL https://www.rfc-editor.org/rfc/rfc2830.txt. Obsoleted by RFCs 4511, 4513, 4510, updated by RFC 3377
Hoffman, P.: SMTP Service Extension for Secure SMTP over Transport Layer Security. RFC 3207 (Proposed Standard) (2002). DOI https://doi.org/10.17487/RFC3207. URL https://www.rfc-editor.org/rfc/rfc3207.txt. Updated by RFC 7817
Hollenbeck, S.:Transport Layer Security Protocol Compression Methods. RFC3749 (Proposed Standard) (2004). DOI https://doi.org/10.17487/RFC3749. URL https://www.rfc-editor.org/rfc/rfc3749.txt. Updated by RFCs 8447, 8996
Jager, T., Kohlar, F., Schage, S., Schwenk, J.: On the security of TLS-DHE in the standard model. In: R. Safavi-Naini, R. Canetti (eds.)Advances in Cryptology – CRYPTO 2012, Lecture Notes in Computer Science, vol. 7417, pp. 273–293. Springer, Heidelberg, Germany, Santa Barbara, CA, USA (2012). DOI https://doi.org/10.1007/978-3-642-32009-5_17
Jager, T., Kohlar, F., Schage, S., Schwenk, J.: Authenticated confidential channel establishment and the security of TLS-DHE. Journal of Cryptology 30(4), 1276–1324 (2017). DOI https://doi.org/10.1007/s00145-016-9248-2
Jonsson, J., Kaliski Jr., B.S.: On the security of RSA encryption in TLS. In: M. Yung (ed.) Advances in Cryptology – CRYPTO 2002, Lecture Notes in Computer Science, vol. 2442, pp. 127–142. Springer, Heidelberg, Germany, Santa Barbara, CA, USA (2002). DOI https://doi.org/10.1007/3-540-45708-9_9
Kaliski, B.: PKCS #1: RSA Encryption Version 1.5. RFC 2313 (Informational) (1998). DOI https://doi.org/10.17487/RFC2313. URL https://www.rfc-editor.org/rfc/rfc2313.txt. Obsoleted by RFC 2437
Khare, R., Lawrence, S.: Upgrading to TLSWithin HTTP/1.1. RFC 2817 (Proposed Standard) (2000). DOI https://doi.org/10.17487/RFC2817. URL https://www.rfc-editor.org/rfc/rfc2817.txt. Updated by RFCs 7230, 7231
Kiltz, E., O’Neill, A., Smith, A.: Instantiability of RSA-OAEP under chosen-plaintext attack. In: T. Rabin (ed.) Advances in Cryptology – CRYPTO 2010, Lecture Notes in Computer Science, vol. 6223, pp. 295–313. Springer, Heidelberg, Germany, Santa Barbara, CA, USA (2010). DOI https://doi.org/10.1007/978-3-642-14623-7_16
Kiltz, E., Pietrzak, K.: On the security of padding-based encryption schemes - or - why we cannot prove OAEP secure in the standard model. In: A. Joux (ed.) Advances in Cryptology–EUROCRYPT 2009, Lecture Notes in Computer Science, vol. 5479, pp. 389–406. Springer, Heidelberg, Germany, Cologne, Germany (2009). DOI https://doi.org/10.1007/978-3-642-01001-9_23
Kohlweiss, M., Maurer, U., Onete, C., Tackmann, B., Venturi, D.: (De-)constructing TLS. Cryptology ePrint Archive, Report 2014/020 (2014). https://eprint.iacr.org/2014/020
Krawczyk, H.: The order of encryption and authentication for protecting communications (or: How secure is SSL?). In: J. Kilian (ed.) Advances in Cryptology – CRYPTO 2001, Lecture Notes in Computer Science, vol. 2139, pp. 310–331. Springer, Heidelberg, Germany, Santa Barbara, CA, USA (2001). DOI https://doi.org/10.1007/3-540-44647-8_19
Krawczyk, H., Paterson, K.G., Wee, H.: On the security of the TLS protocol: A systematic analysis. In: R. Canetti, J.A. Garay (eds.) Advances in Cryptology – CRYPTO 2013, Part I, Lecture Notes in Computer Science, vol. 8042, pp. 429–448. Springer, Heidelberg, Germany, Santa Barbara, CA, USA (2013). DOI https://doi.org/10.1007/978-3-642-40041-4_24
Kusters, R., Tuengerthal, M.: Composition theorems without pre-established session identifiers. In: Y. Chen, G. Danezis, V. Shmatikov (eds.) ACM CCS 2011: 18th Conference on Computer and Communications Security, pp. 41–50. ACM Press, Chicago, Illinois, USA (2011). DOI https://doi.org/10.1145/2046707.2046715
Li, Y., Schage, S., Yang, Z., Kohlar, F., Schwenk, J.: On the security of the pre-shared key ciphersuites of TLS. In: H. Krawczyk (ed.) PKC 2014: 17th International Conference on Theory and Practice of Public Key Cryptography, Lecture Notes in Computer Science, vol. 8383, pp. 669–684. Springer, Heidelberg, Germany, Buenos Aires, Argentina (2014). DOI https://doi.org/10.1007/978-3-642-54631-0_38
Maurer, U., Tackmann, B.: On the soundness of authenticate-then-encrypt: formalizing the malleability of symmetric encryption. In: E. Al-Shaer, A.D. Keromytis, V. Shmatikov (eds.) ACM CCS 2010: 17th Conference on Computer and Communications Security, pp. 505–515. ACM Press, Chicago, Illinois, USA (2010). DOI https://doi.org/10.1145/1866307.1866364
Mitchell, J.C.: Finite-state analysis of security protocols. In: A.J. Hu, M.Y. Vardi (eds.) CAV, Lecture Notes in Computer Science, vol. 1427, pp. 71–76. Springer (1998)
Morrissey, P., Smart, N.P., Warinschi, B.: A modular security analysis of the TLS handshake protocol. In: J. Pieprzyk (ed.) Advances in Cryptology – ASIACRYPT 2008, Lecture Notes in Computer Science, vol. 5350, pp. 55–73. Springer, Heidelberg, Germany, Melbourne,Australia (2008). DOI https://doi.org/10.1007/978-3-540-89255-7_5
Murchison, K., Vinocur, J., Newman, C.: Using Transport Layer Security (TLS) with Network News Transfer Protocol (NNTP). RFC 4642 (Proposed Standard) (2006). DOI https://doi.org/10.17487/RFC4642. URL https://www.rfc-editor.org/rfc/rfc4642.txt. Updated by RFCs8143, 8996
Newman, C.: Using TLS with IMAP, POP3 and ACAP. RFC 2595 (Proposed Standard) (1999). DOI https://doi.org/10.17487/RFC2595. URL https://www.rfc-editor.org/rfc/rfc2595.txt. Updated by RFCs 4616, 7817, 8314
Nir, Y., Langley, A.: ChaCha20 and Poly1305 for IETF Protocols. RFC 7539 (Informational) (2015). DOI https://doi.org/10.17487/RFC7539. URL https://www.rfc-editor.org/rfc/rfc7539.txt. Obsoleted by RFC 8439
Ogata, K., Futatsugi, K.: Equational approach to formal analysis of TLS. In: 25th International Conference on Distributed Computing Systems (ICDCS 2005), 6-10 June 2005, Columbus, OH, USA, pp. 795–804. IEEE Computer Society (2005). DOI https://doi.org/10.1109/ICDCS.2005.32. URL https://doi.org/10.1109/ICDCS.2005.32
Paterson, K.G., Ristenpart, T., Shrimpton, T.: Tag size does matter: Attacks and proofs for the TLS record protocol. In: D.H. Lee, X. Wang (eds.) Advances in Cryptology – ASIACRYPT 2011, Lecture Notes in Computer Science, vol. 7073, pp. 372–389. Springer, Heidelberg, Germany, Seoul, South Korea (2011). DOI https://doi.org/10.1007/978-3-642-25385-0_20
Paulson, L.C.: Inductive analysis of the internet protocol tls. ACM Trans. Inf. Syst. Secur. 2(3), 332–351 (1999)
Ray, M., Dispensa, S.: Renegotiating TLS. https://www.ietf.org/proceedings/76/slides/tls-7.pdf (2009)
Rescorla, E.: The Transport Layer Security (TLS) Protocol Version 1.3. RFC 8446 (Proposed Standard) (2018). DOI https://doi.org/10.17487/RFC8446. URL https://www.rfc-editor.org/rfc/rfc8446.txt
Rescorla, E., Modadugu, N.: Datagram Transport Layer Security. RFC 4347 (Historic) (2006). DOI https://doi.org/10.17487/RFC4347. URL https://www.rfc-editor.org/rfc/rfc4347.txt. Obsoleted by RFC 6347, updated by RFCs 5746, 7507
Rescorla, E., Ray, M., Dispensa, S., Oskov, N.: Transport Layer Security (TLS) Renegotiation Indication Extension. RFC 5746 (Proposed Standard) (2010). DOI https://doi.org/10.17487/RFC5746. URL https://www.rfc-editor.org/rfc/rfc5746.txt
Saint-Andre, P.: Extensible Messaging and Presence Protocol (XMPP): Core. RFC 6120 (Proposed Standard) (2011). DOI https://doi.org/10.17487/RFC6120. URL https://www.rfc-editor.org/rfc/rfc6120.txt. Updated by RFCs 7590, 8553
Salowey, J., Zhou, H., Eronen, P., Tschofenig, H.: Transport Layer Security (TLS) Session Resumption without Server-Side State. RFC 5077 (Proposed Standard) (2008). DOI https://doi.org/10.17487/RFC5077. URL https://www.rfc-editor.org/rfc/rfc5077.txt. Obsoleted by RFC 8446, updated by RFC 8447
Seggelmann, R., Tuexen, M., Williams, M.: Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) Heartbeat Extension. RFC 6520 (Proposed Standard) (2012). DOI https://doi.org/10.17487/RFC6520. URL https://www.rfc-editor.org/rfc/rfc6520.txt. Updated by RFC 8447
Velvindron, L., Moriarty, K., Ghedini, A.: Deprecating MD5 and SHA-1 Signature Hashes in TLS 1.2 and DTLS 1.2. RFC 9155 (Proposed Standard) (2021). DOI https://doi.org/10.17487/RFC9155. URL https://www.rfc-editor.org/rfc/rfc9155.txt
Wagner, D., Schneier, B.: Analysis of the SSL 3.0 protocol. The Second USENIX Workshop on Electronic Commerce Proceedings (1996)
Author information
Authors and Affiliations
Corresponding author
Rights and permissions
Copyright information
© 2022 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this chapter
Cite this chapter
Schwenk, J. (2022). Transport Layer Security. In: Guide to Internet Cryptography. Information Security and Cryptography. Springer, Cham. https://doi.org/10.1007/978-3-031-19439-9_10
Download citation
DOI: https://doi.org/10.1007/978-3-031-19439-9_10
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-19438-2
Online ISBN: 978-3-031-19439-9
eBook Packages: Computer ScienceComputer Science (R0)