2. cnp3-ebook
3. protocols/tls
4. English
5. Zen

24 ../../protocols/tls.rst:51
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — A second approach to initiate a TLS session is to use the standard TCP port number for the application layer protocol and define a special message in this protocol to trigger the start of the TLS session. This is the solution used for SMTP with the ``STARTTLS`` message. This extension to SMTP :rfc:`3207` defines the new STARTTLS command. The client can issue this command to indicate to the server that it wants to start a TLS session as shown in the example below captured during a session on port 25. 504/10000 · 504
25 ../../protocols/tls.rst:77
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — In the remaining parts of this chapter, we assume that the TLS session starts immediately after the establishment of the TCP connection. This corresponds to the deployments on web servers. We focus our presentation of TLS on this very popular use case. TLS is a complex protocol that supports other features than the one used by web servers. A more detailed presentation of TLS may be found in [KPS2002]_ and [Ristic2015]_. 423/10000 · 423
26 ../../protocols/tls.rst:84
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — A TLS session is divided in two phases: the handshake and the data transfer. During the handshake, the client and the server negotiate the security parameters and the keys that will be used to secure the data transfer. During the second phase, all the messages exchanged are encrypted and authenticated with the negotiated algorithms and keys. 343/10000 · 343
27 ../../protocols/tls.rst:93
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — The TLS handshake 17/10000 · 17
28 ../../protocols/tls.rst:95
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — When used to interact with a regular web server, the TLS handshake has three important objectives: 98/10000 · 98
29 ../../protocols/tls.rst:98
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — Securely negotiate the cryptographic algorithms that will be used by the client and the server over the TLS session 115/10000 · 115
30 ../../protocols/tls.rst:100
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — Verify that the client interacts with a valid server 52/10000 · 52
31 ../../protocols/tls.rst:101
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — Securely agree on the keys that will be used to encrypt and authenticate the messages exchanged over the TLS session 116/10000 · 116
32 ../../protocols/tls.rst:105
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — The TLS handshake is a four-way handshake illustrated in the figure below. 74/10000 · 74
33 ../../protocols/tls.rst:130
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — In a nutshell, the client starts the TLS handshake by proposing a random nonce. The server replies with its random nonce and a certificate that binds its name to a public key. The client generates a MasterSecret that will be used later to derive the session keys and encrypts it with the public key of the server. It also generates a `Finished` message that contains a MAC of all the messages exchanged to allow the server to detect any modification of the messages sent by the client. The server also sends its own `Finished` message. At that point, the client and the server sent encrypted records thanks to the keys derived from the MasterSecret. 649/10000 · 649
34 ../../protocols/tls.rst:140
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — Let us first discuss the negotiation of the cryptographic algorithms and parameters. Like all security protocols, TLS includes some agility in its design since new cryptographic algorithms appear over the years and some older algorithms become deprecated once cryptanalysts find flaws. The TLS handshakes starts with the ``ClientHello`` message that is sent by the client. This message carries the following information : 421/10000 · 421
35 ../../protocols/tls.rst:147
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — `Protocol version number`: this is the version of the TLS protocol supported by the client. The server should use the same version of the TLS protocol as the client, but may opt for an older version. Both versions 1.2 and 1.3 of TLS are deployed today. Older versions are being deprecated. 289/10000 · 289
36 ../../protocols/tls.rst:150
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — `Random number`: security protocols rely on random numbers. The client sends a 32 bytes long random number where usually four of these bytes correspond to the client's clock. This random number is used, together with the server's random number, as a seed to generate the security keys. 285/10000 · 285
37 ../../protocols/tls.rst:155
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — `Cipher suites` : this ordered list contains the set of cryptographic algorithms that are supported by the client, with the most preferred one listed first. In contrast with ``ssh`` that allows negotiating independent algorithms for encryption, key exchange and authentication, TLS relies on suites that combine these algorithms together. Many cryptographic suites have been defined for TLS. Various recommendations have been published on the security of some of these suites :rfc:`7525`. 488/10000 · 488
38 ../../protocols/tls.rst:162
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — `Compression algorithm` : the client may propose the utilization of a specific compression algorithm (e.g. zlib). In theory, compressing the data before encrypting it is an intelligent way to reduce the amount of data exchanged. Unfortunately, its implementation in TLS has caused several security problems [PHG2013]_. For this reason, compression is usually disabled in TLS :rfc:`7525`. 387/10000 · 387
39 ../../protocols/tls.rst:167
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — `Extensions` : TLS supports various extensions in the ``ClientHello`` message. These extensions :rfc:`6066` are important to allow the protocol to evolve, but many of them go beyond the scope of this chapter. 208/10000 · 208
40 ../../protocols/tls.rst:173
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — The ``Server Name Indication (SNI)`` 36/10000 · 36
41 ../../protocols/tls.rst:175
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — The ``Server Name Indication (SNI)`` extension defined in :rfc:`6066` is an important TLS extension for web servers. It is used by the client to indicate the name of the server that it wishes to contact. The IP address associated to this name has been queried from the DNS and used to establish the TCP connection. Why should the client indicate the server name in the TLS ``ClientHello`` ? The motivation is the same as for the ``Host`` header line in HTTP/1.0. With the SNI extension, a single TLS server can support several web sites that use different domain names. Thanks to the SNI extension, the server knows the concerned domain name at the start of the TLS session. Without this extension, hosting providers would have been forced use one IP address per TLS-enabled server. 783/10000 · 783
42 ../../protocols/tls.rst:190
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — The server replies to the ``ClientHello`` with several messages: 64/10000 · 64
43 ../../protocols/tls.rst:192
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — the ``ServerHello`` message that contains the protocol version chosen by the server (assumed to be the same as the client version in this chapter), the 32 random bytes chosen by the server, the `Cipher Suite` selected by the server from the list advertised by the client and a `Session Id`. This `Session Id` is an identifier which is chosen by the server. It identifies the TLS session and the security parameters (algorithms and keys) negotiated for this session. It is used to support session resumption. 507/10000 · 507