TLS Handshake Protocol

 

CH       C -> S: ProtVer, Rc, SessionID, CipherSuiteList, CompMethList

            S: If (SessionID BAD) THEN goto Negotiate New Session

 

Resume Session

SH       S -> C:  ProtVer, Rs, SessionID (old), CipherSuite, CompMeth

CCS    S -> C: X

F          S -> C: PRF(master, “finished”, hash(Previous Messages))

CCS    C -> S: X

F          C -> S: PRF(master, “finished”, hash(Previous Messages))

End

 

Negotiate New Session

SH       S -> C: ProtVer, Rs, SessionID (new),  CipherSuite, CompMeth

            S: IF (Key Exchange is Authenticated) THEN goto Authenticated Server

 

            Anonymous Server

SKE     S -> C: p, g, Ys

SHD    S -> C: X

CKE    C -> S: Yc

CCS    C -> S: X

F          C -> S: PRF(master, “finished”, hash(Previous Messages))

CCS    S -> C: X

F          S -> C: PRF(master, “finished”, hash(Previous Messages))

End

 

Authenticated Server

            S: IF (Key Exchange is ~RSA) THEN goto Diffie-Helman

 

            RSA

                        S: IF (Key Exchange is RSA_EXPORT & Public Key in Certificate for Signing only) THEN goto Temporary Key

 

                                    Encryption Key in Certificate

SC            S -> C: {S, Ks+}Kca-

                        Goto Client Response

 

Temporary Key

SC            S -> C: {S, sKs+}Kca-

SKE            S -> C: Ks+, {hash(Rc + Rs + Ks+)}sKs-

            Goto Client Response


 

Diffie-Helman

                        IF (Key Exchange is DHE) THEN goto DHE

 

                                    DH (RSA & DSS signing)

                        SC            S -> C: {S, (p, g, Ys), sKs+}Kca-

                                    Goto Client Response

 

DHE (RSA & DSS signing)

 

                        SC            S -> C: {S, sKs+}Kca-

                        SKE            (p, g, Ys), {hash(Rc + Rs + (p, g, Ys))}sKs-

 

            Client Response

            IF (No Client Certificate) THEN goto Client Key Exchange

CR       S -> C: (Cert_Type_List, Cert_Auth_List)

SHD    S -> C: X

CC       C -> S: {C, Kc+}Kca-

 

Client Key Exchange

            IF (Key Exchange is RSA or RSA_EXPORT) THEN

CKE    C -> S: {Prot. Ver., PreMaster}Ks+

            ELSE IF (Key Exchange is DHE) THEN

CKE    C -> S: Yc

            ELSE IF (Key Exhange is DH) THEN

CKE    C -> S: 0

 

            IF (no Client Certificate or Key Exchange DH) THEN goto Client Finished

 

            Certificate Verify

CV       C -> S: {hash(PreviousMessages)}sKc-

 

Client Finished

CCS    C -> S: X

F          C -> S: PRF(master, “finished”, hash(Previous Messages))

CCS    S -> C: X

F          S -> C: PRF(master, “finished”, hash(Previous Messages))

End

 


GLOSSARY

 

Bad Session ID

This means that the Client proposed no session ID or the one proposed was not found on a list of acceptable old sessions.

 

Computing Master Secret

master = PRF(PreMaster, “master secret”, Rc + Rs)      

 

Hash

In rfc 2246 there are two types of hashes used, MD5 and SHA.  These are used together to produce hashes.  However, they are not always used in the same fashion, in DSS signing only the SHA hash is used while in RSA signing both are used.

 

PRF

This is a function that uses the MD5 and SHA hashing algorithms.  It is used to combine these two hashing functions so that if one is broken, the other will still ensure security.

 

RSA vs DSS signing

These are different signing methods, but for protocol analysis purposes and our simple representation, this difference was ignored.

 

TLS Message codes

CH = Client Hello

SH = Server Hello

SC = Server Certificate

SKE = Server Key Exchange

CR = Certificate Request

SHD = Server Hello Done

CC = Client Certificate

CKE = Client Key Exchange

CV = Certificate Verify

CCS = Change Cipher Spec – this is not a handshake protocol message

F = Finished

 

Reference

rfc2246 on which the above was adapted from