Sjdin TLS/SSL
Peter [e-mail]
Based on material by Vitaly Shmatikov, Univ. of Texas, and by the previous course teachers
1
What is SSL / TLS?
Transport Layer Security protocol, version 1.0
De facto standard for Internet security The primary goal of the TLS protocol is to provide privacy and data integrity between two communicating applications In practice, used to protect information transmitted between browsers and Web servers
Based on Secure Sockets Layers protocol, ver 3.0
Same protocol design, different algorithms
Deployed in nearly every Web browser
2
SSL/TLS in Practice
3
Application-Level Protection
application presentation session transport network data link physical RPC TCP IP 802.11 email, Web, NFS Protects againt application-level threats (e.g., server impersonation), NOT against IP-level threats (spoofing, SYN flood, DDoS by data flood)
4
History of the Protocol
SSL 1.0
Internal Netscape design, early 1994? Lost in the mists of time
SSL 2.0
Published by Netscape, November 1994 Several weaknesses
SSL 3.0
Designed by Netscape and Paul Kocher, November 1996
TLS 1.0
Internet standard based on SSL 3.0, January 1999 Not interoperable with SSL 3.0
TLS uses HMAC instead of MAC; can run on any port
5
TLS Basics
TLS consists of two protocols
Familiar pattern for key exchange protocols
Handshake protocol
Use public-key cryptography to establish a shared (master) secret key between the client and the server
Record protocol
Use the secret key established in the handshake protocol to protect communication between the client and the server
6
SSL/TLS Record Protection
Use symmetric keys established in handshake protocol
7
Master Secret
Master Secret
Client to Server
Server to Client
Integrity Protection Key
Encryption Key
IV
Integrity Protection Key
Encryption Key
IV
Master Secret used for deriving six secrets
Three in each direction
8
TLS Handshake Protocol
Two parties: client and server Negotiate version of the protocol and the set of cryptographic algorithms to be used
Interoperability between different implementations of the protocol
Authenticate client and server
Use digital certificates to learn each others public keys and verify each others identity
Use public keys to establish the shared master secret
9
Handshake Protocol Structure
ClientHello ServerHello, [Certificate], [ServerKeyExchange], [CertificateRequest], ServerHelloDone
C
[Certificate], ClientKeyExchange, [CertificateVerify] switch to negotiated cipher Finished
S
Record of all sent and received handshake messages
switch to negotiated cipher Finished
10
ClientHello
ClientHello
Client announces (in plaintext): Protocol version it is running Cryptographic algorithms it supports
C
S
11
ClientHello (RFC)
struct { ProtocolVersion client_version; Random random; SessionID session_id; CipherSuite cipher_suites; } ClientHello
Highest version of the protocol supported by the client For generating master secret Session id (if the client wants to resume an old session) Set of cryptographic algorithms supported by the client (e.g., RSA or Diffie-Hellman)
CompressionMethod compression_methods;
Set of compression methods supported by the client
12
Cipher Suites
Key exchange Encryption Hash
SSL_NULL_WITH_NULL_NULL SSL_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 SSL_RSA_EXPORT_WITH_RC4_40_MD5 SSL_RSA_WITH_3DES_EDE_CBC_MD5 SSL_RSA_WITH_3DES_EDE_CBC_SHA SSL_RSA_WITH_DES_CBC_MD5 SSL_RSA_WITH_DES_CBC_SHA SSL_RSA_WITH_IDEA_CBC_MD5 SSL_RSA_WITH_IDEA_CBC_SHA SSL_RSA_WITH_NULL_MD5 SSL_RSA_WITH_NULL_SHA SSL_RSA_WITH_RC2_CBC_MD5 SSL_RSA_WITH_RC4_128_MD5 SSL_RSA_WITH_RC4_128_SHA SSL_DH_anon_WITH_DES_CBC_SHA SSL_DH_anon_WITH_3DES_EDE_CBC_SHA SSL_DH_anon_WITH_RC4_128_MD5 SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA SSL_DH_DSS_WITH_DES_CBC_SHA SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA SSL_DH_RSA_WITH_DES_CBC_SHA SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA SSL_DHE_DSS_WITH_DES_CBC_SHA SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA SSL_DHE_RSA_WITH_DES_CBC_SHA SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA SSL_FORTEZZA_DMS_WITH_NULL_SHA
13
ServerHello
C, Versionc, suitec, Nc ServerHello
C
Server responds (in plaintext) with: Highest protocol version supported by both client and server Strongest cryptographic suite selected from those offered by the client
S
14
ServerKeyExchange
C, Versionc, suitec, Nc Versions, suites, Ns, ServerKeyExchange
C
Server sends public-key certificate containing either RSA or Diffie-Hellman public key (depending on chosen crypto suite)
S
15
ClientKeyExchange
C, Versionc, suitec, Nc Versions, suites, Ns, sigca(S,Ks), ServerHelloDone
C
ClientKeyExchange
S
Client generates some secret key material and sends it to the server encrypted with the servers public key (if using RSA)
16
ClientKeyExchange (RFC)
struct { select (KeyExchangeAlgorithm) { case rsa: EncryptedPreMasterSecret; case diffie_hellman: ClientDiffieHellmanPublic; } exchange_keys } ClientKeyExchange struct { ProtocolVersion client_version; opaque random[46]; Random bits from which symmetric keys will be derived } PreMasterSecret (by hashing them with nonces)
17
Core SSL 3.0 Handshake
C, Versionc=3.0, suitec, Nc Versions=3.0, suites, Ns, sigca(S,Ks), ServerHelloDone
C
{Secretc}Ks If the protocol is correct, C and S share some secret key material (secretc) at this point switch to key derived from secretc, Nc, Ns switch to key derived from secretc, Nc, Ns
S
18
Version Rollback Attack
C, Versionc=2.0, suitec, Nc
Server is fooled into thinking it is communicating with a client who supports only SSL 2.0
Versions=2.0, suites, Ns, sigca(S,Ks), ServerHelloDone
C
{Secretc}Ks
S
C and S end up communicating using SSL 2.0 (weaker earlier version of the protocol that does not include Finished messagesdigests of all messages in the handshake)
19
SSL 2.0 Weaknesses (Fixed in 3.0)
Cipher suite preferences are not authenticated
Cipher suite rollback attack is possible
Weak MAC construction SSL 2.0 uses padding when computing MAC in block cipher modes, but padding length field is not authenticated
Attacker can delete bytes from the end of messages
MAC hash uses only 40 bits in export mode No support for certificate chains or non-RSA algorithms, no handshake while session is open
20
Chosen-Protocol Attacks
Why do people release new versions of security protocols? Because the old version got broken! New version must be backward-compatible
Not everybody upgrades right away
Attacker can fool someone into using the old, broken version and exploit known vulnerability
Similar: fool victim into using weak crypto algorithms
Defense is hard: must authenticate version early Many protocols had version rollback attacks
SSL, SSH, GSM (cell phones)
21
Version Check in SSL 3.0
C, Versionc=3.0, suitec, Nc Versions=3.0, suites, Ns, sigca(S,Ks), ServerHelloDone
Check that received version is equal to the version in ClientHello
C
Embed version number into secret
{Versionc,Secretc}Ks
S
If the protocol is correct, C and S share some secret key material secretc at this point
switch to key derived from secretc, Nc, Ns
switch to key derived from secretc, Nc, Ns
22
Reading
Kaufman. Chapter 19.
23