Ssl Protocol Stack And Handshake

Front 1

What does the SSL Record Protocol do?

Back 1

Fragments data into 2^14 byte chunks (may compress)

Adds MAC

Encrypts data

Appends to SSL Record header

Front 2

What does the Change Cipher protocol do?

Back 2

Handshake protocol establishes a connection, the state of the connection is in a pending state till change to protcol is made to make it current (basically a confirmation)

Front 3

What does alert protocol do?

Back 3

Each message 2 bytes

1st byte for level of severity

2nd for alert code

Front 4

What does the handshake protocol do?

Back 4

Allows server and client to:

Authenticate each other

Negotiate encryption and mac algorithms

Negotiate cryptographic paramters and keys

And the state

THIS IS DONE BEFORE ANY DATA IS TRANSMITTED

Front 5

Client version?

Back 5

Highest version of ssl or tls supported by the client

Front 6

Client random?

Back 6

Defines how long packages need to be validated for, so if a message takes longer than the planned time to get somewhere it's invalidated.

Front 7

Client session id?

Back 7

0 for new session or old ID if establishing a connection

Front 8

Client Cipher Suites?

Back 8

List of cryptographic options supported by client by order of preference

Front 9

Client Compression methods?

Back 9

List of compression method supported by the client

Front 10

Server version?

Back 10

Highest version of SSL or TLS supported by both server and client

Front 11

Server random?

Back 11

Current time + random bytes which need to be independent of the client's random bytes

Front 12

Server session id?

Back 12

Chosen after checking what client wants to do. Either new session id or resume session with session id if possible

Front 13

Server Cipher suite?

Back 13

1 Cipher suite chosen by server from client's options

Front 14

Server Compression method?

Back 14

Chosen by server from client's options.

Front 15

Server certificate?

Back 15

Mandatory. Server to client for authentication. Needed for every key exchange except anonymous DH. Contains 1 or more certificates.

Front 16

Server key exchange?

Back 16

If certificate does not contain enough info for key exchange. Digitally signed.

Front 17

Certificate request?

Back 17

Sent if the client needs to authenticate itself to the server, specifies type of certificate requested

Front 18

Server hello done?

Back 18

Indicates server has finished its part of the key exchange, server waits for client response and verification of valid certificate and server parameters are acceptable

Front 19

Certificate and client key exchange?

Back 19

Sent only if requested by server? Client key always sent

May contain 3 types e.g. RSA, Fortezza, encrypted RSA

Front 20

Encrypted version number confirmation?

Back 20

Client includes this (already agreed upon) to let the server know the response is from an authentic client. AUTHENTICATION

Front 21

Certificate verify?

Back 21

Client signs a hash containing the master secret and handshake messages. Sent only if the client sends a certificate.

Front 22

Generating a secret shared key?

Back 22

Client generates 48 byte premaster secret (random number)

Encrypts using server's rsa pub key

2 bytes of premaster key confirm the client version

Server decrypts with prv key and authenticates

Front 23

Generating secret shared key 2?

Back 23

Client and server use premaster key and random numbers to generate the master secret 48 bytes long total 384 bits = 128/3

1 for MAC

1 for symmetric encryption key

1 for IV for symmetric algorithm

Front 24

Finished message?

Back 24

Used to verify key exchange and authentication was successful, sent immediately after change cipher spec message

Front 25

Https uses what port?

Back 25

443