（一）SSL/TLS协议运行机制的概述

一、作用

不使用SSL/TLS的HTTP通信，就是不加密的通信。所有信息明文传播，带来了三大风险。

（1） 窃听风险（eavesdropping）：第三方可以获知通信内容。

（2） 篡改风险（tampering）：第三方可以修改通信内容。

（3） 冒充风险（pretending）：第三方可以冒充他人身份参与通信。

SSL/TLS协议是为了解决这三大风险而设计的，希望达到：

（1） 所有信息都是加密传播，第三方无法窃听。

（2） 具有校验机制，一旦被篡改，通信双方会立刻发现。

（3） 配备身份证书，防止身份被冒充。

互联网是开放环境，通信双方都是未知身份，这为协议的设计带来了很大的难度。而且，协议还必须能够经受所有匪夷所思的攻击，这使得SSL/TLS协议变得异常复杂。

二、历史

互联网加密通信协议的历史，几乎与互联网一样长。

1994年，NetScape公司设计了SSL协议（Secure Sockets Layer）的1.0版，但是未发布。

1995年，NetScape公司发布SSL 2.0版，很快发现有严重漏洞。

1996年，SSL 3.0版问世，得到大规模应用。

1999年，互联网标准化组织ISOC接替NetScape公司，发布了SSL的升级版TLS 1.0版。

2006年和2008年，TLS进行了两次升级，分别为TLS 1.1版和TLS 1.2版。最新的变动是2011年TLS 1.2的修订版。

目前，应用最广泛的是TLS 1.0，接下来是SSL 3.0。但是，主流浏览器都已经实现了TLS 1.2的支持。

TLS 1.0通常被标示为SSL 3.1，TLS 1.1为SSL 3.2，TLS 1.2为SSL 3.3。

三、基本的运行过程

SSL/TLS协议的基本思路是采用公钥加密法，也就是说，客户端先向服务器端索要公钥，然后用公钥加密信息，服务器收到密文后，用自己的私钥解密。

但是，这里有两个问题。

（1）如何保证公钥不被篡改？

解决方法：将公钥放在数字证书中。只要证书是可信的，公钥就是可信的。

（2）公钥加密计算量太大，如何减少耗用的时间？

解决方法：每一次对话（session），客户端和服务器端都生成一个"对话密钥"（session key），用它来加密信息。由于"对话密钥"是对称加密，所以运算速度非常快，而服务器公钥只用于加密"对话密钥"本身，这样就减少了加密运算的消耗时间。

因此，SSL/TLS协议的基本过程是这样的：

（1） 客户端向服务器端索要并验证公钥。

（2） 双方协商生成"对话密钥"。

（3） 双方采用"对话密钥"进行加密通信。

上面过程的前两步，又称为"握手阶段"（handshake）。

四、握手阶段的详细过程

"握手阶段"涉及四次通信，我们一个个来看。需要注意的是，"握手阶段"的所有通信都是明文的。

4.1 客户端发出请求（ClientHello）

首先，客户端（通常是浏览器）先向服务器发出加密通信的请求，这被叫做ClientHello请求。

在这一步，客户端主要向服务器提供以下信息。

（1） 支持的协议版本，比如TLS 1.0版。

（2） 一个客户端生成的随机数，稍后用于生成"对话密钥"。

（3） 支持的加密方法，比如RSA公钥加密。

（4） 支持的压缩方法。

这里需要注意的是，客户端发送的信息之中不包括服务器的域名。也就是说，理论上服务器只能包含一个网站，否则会分不清应该向客户端提供哪一个网站的数字证书。这就是为什么通常一台服务器只能有一张数字证书的原因。

对于虚拟主机的用户来说，这当然很不方便。2006年，TLS协议加入了一个Server Name Indication扩展，允许客户端向服务器提供它所请求的域名。

4.2 服务器回应（SeverHello）

服务器收到客户端请求后，向客户端发出回应，这叫做SeverHello。服务器的回应包含以下内容。

（1） 确认使用的加密通信协议版本，比如TLS 1.0版本。如果浏览器与服务器支持的版本不一致，服务器关闭加密通信。

（2） 一个服务器生成的随机数，稍后用于生成"对话密钥"。

（3） 确认使用的加密方法，比如RSA公钥加密。

（4） 服务器证书。

除了上面这些信息，如果服务器需要确认客户端的身份，就会再包含一项请求，要求客户端提供"客户端证书"。比如，金融机构往往只允许认证客户连入自己的网络，就会向正式客户提供USB密钥，里面就包含了一张客户端证书。

4.3 客户端回应

客户端收到服务器回应以后，首先验证服务器证书。如果证书不是可信机构颁布、或者证书中的域名与实际域名不一致、或者证书已经过期，就会向访问者显示一个警告，由其选择是否还要继续通信。

如果证书没有问题，客户端就会从证书中取出服务器的公钥。然后，向服务器发送下面三项信息。

（1） 一个随机数。该随机数用服务器公钥加密，防止被窃听。

（2） 编码改变通知，表示随后的信息都将用双方商定的加密方法和密钥发送。

（3） 客户端握手结束通知，表示客户端的握手阶段已经结束。这一项同时也是前面发送的所有内容的hash值，用来供服务器校验。

上面第一项的随机数，是整个握手阶段出现的第三个随机数，又称"pre-master key"。有了它以后，客户端和服务器就同时有了三个随机数，接着双方就用事先商定的加密方法，各自生成本次会话所用的同一把"会话密钥"。

至于为什么一定要用三个随机数，来生成"会话密钥"，dog250解释得很好：

"不管是客户端还是服务器，都需要随机数，这样生成的密钥才不会每次都一样。由于SSL协议中证书是静态的，因此十分有必要引入一种随机因素来保证协商出来的密钥的随机性。

对于RSA密钥交换算法来说，pre-master-key本身就是一个随机数，再加上hello消息中的随机，三个随机数通过一个密钥导出器最终导出一个对称密钥。

pre master的存在在于SSL协议不信任每个主机都能产生完全随机的随机数，如果随机数不随机，那么pre master secret就有可能被猜出来，那么仅适用pre master secret作为密钥就不合适了，因此必须引入新的随机因素，那么客户端和服务器加上pre master secret三个随机数一同生成的密钥就不容易被猜出了，一个伪随机可能完全不随机，可是是三个伪随机就十分接近随机了，每增加一个自由度，随机性增加的可不是一。"

此外，如果前一步，服务器要求客户端证书，客户端会在这一步发送证书及相关信息。

4.4 服务器的最后回应

服务器收到客户端的第三个随机数pre-master key之后，计算生成本次会话所用的"会话密钥"。然后，向客户端最后发送下面信息。

（1）编码改变通知，表示随后的信息都将用双方商定的加密方法和密钥发送。

（2）服务器握手结束通知，表示服务器的握手阶段已经结束。这一项同时也是前面发送的所有内容的hash值，用来供客户端校验。

至此，整个握手阶段全部结束。接下来，客户端与服务器进入加密通信，就完全是使用普通的HTTP协议，只不过用"会话密钥"加密内容。

（二）Https(SSL/TLS)原理详解

概述

Https(Hyper Text Transfer Protocol over Secure Socket Layer)，是一种基于SSL/TLS的Http，所有的http数据都是在SSL/TLS协议封装之上传输的。Https协议在Http协议的基础上，添加了SSL/TLS握手以及数据加密传输，也属于应用层协议。所以，研究Https协议原理，最终其实是研究SSL/TLS协议。

SSL协议，是一种安全传输协议，最初是由 Netscape 在1996年发布，由于一些安全的原因SSL v1.0和SSL v2.0都没有公开，直到1996年的SSL v3.0。TLS是SSL v3.0的升级版，目前市面上所有的Https都是用的是TLS，而不是SSL。

TLS握手

TLS的握手阶段是发生在TCP握手之后。握手实际上是一种协商的过程，对协议所必需的一些参数进行协商。TLS握手过程分为四步，过程如下：（备注：图中加方括号的均为可选消息）

Client Hello

由于客户端(如浏览器)对一些加解密算法的支持程度不一样，但是在TLS协议传输过程中必须使用同一套加解密算法才能保证数据能够正常的加解密。在TLS握手阶段，客户端首先要告知服务端，自己支持哪些加密算法，所以客户端需要将本地支持的加密套件(Cipher Suite)的列表传送给服务端。除此之外，客户端还要产生一个随机数，这个随机数一方面需要在客户端保存，另一方面需要传送给服务端，客户端的随机数需要跟服务端产生的随机数结合起来产生后面要讲到的Master Secret。

Server Hello

上图中，从Server Hello到Server Done，有些服务端的实现是每条单独发送，有服务端实现是合并到一起发送。Sever Hello和Server Done都是只有头没有内容的数据。

服务端在接收到客户端的Client Hello之后，服务端需要将自己的证书发送给客户端。这个证书是对于服务端的一种认证。例如，客户端收到了一个来自于称自己是www.alipay.com的数据，但是如何证明对方是合法的alipay支付宝呢？这就是证书的作用，支付宝的证书可以证明它是alipay，而不是财付通。证书是需要申请，并由专门的数字证书认证机构(CA)通过非常严格的审核之后颁发的电子证书。颁发证书的同时会产生一个私钥和公钥。私钥由服务端自己保存，不可泄漏。公钥则是附带在证书的信息中，可以公开的。证书本身也附带一个证书电子签名，这个签名用来验证证书的完整性和真实性，可以防止证书被串改。另外，证书还有个有效期。

在服务端向客户端发送的证书中没有提供足够的信息的时候，还可以向客户端发送一个Server Key Exchange。

此外，对于非常重要的保密数据，服务端还需要对客户端进行验证，以保证数据传送给了安全的合法的客户端。服务端可以向客户端发出Cerficate Request消息，要求客户端发送证书对客户端的合法性进行验证。

跟客户端一样，服务端也需要产生一个随机数发送给客户端。客户端和服务端都需要使用这两个随机数来产生Master Secret。

最后服务端会发送一个Server Hello Done消息给客户端，表示Server Hello消息结束了。

Client Key Exchange

如果服务端需要对客户端进行验证，在客户端收到服务端的Server Hello消息之后，首先需要向服务端发送客户端的证书，让服务端来验证客户端的合法性。

在此之前的所有TLS握手信息都是明文传送的。在收到服务端的证书等信息之后，客户端会使用一些加密算法(例如：RSA, Diffie-Hellman)产生一个48个字节的Key，这个Key叫PreMaster Secret，很多材料上也被称作PreMaster Key, 最终通过Master secret生成session secret， session secret就是用来对应用数据进行加解密的。PreMaster secret属于一个保密的Key，只要截获PreMaster secret，就可以通过之前明文传送的随机数，最终计算出session secret，所以PreMaster secret使用RSA非对称加密的方式，使用服务端传过来的公钥进行加密，然后传给服务端。

接着，客户端需要对服务端的证书进行检查，检查证书的完整性以及证书跟服务端域名是否吻合。

ChangeCipherSpec是一个独立的协议，体现在数据包中就是一个字节的数据，用于告知服务端，客户端已经切换到之前协商好的加密套件的状态，准备使用之前协商好的加密套件加密数据并传输了。

在ChangecipherSpec传输完毕之后，客户端会使用之前协商好的加密套件和session secret加密一段Finish的数据传送给服务端，此数据是为了在正式传输应用数据之前对刚刚握手建立起来的加解密通道进行验证。

Server Finish

服务端在接收到客户端传过来的PreMaster加密数据之后，使用私钥对这段加密数据进行解密，并对数据进行验证，也会使用跟客户端同样的方式生成session secret，一切准备好之后，会给客户端发送一个ChangeCipherSpec，告知客户端已经切换到协商过的加密套件状态，准备使用加密套件和session secret加密数据了。之后，服务端也会使用session secret加密后一段Finish消息发送给客户端，以验证之前通过握手建立起来的加解密通道是否成功。

根据之前的握手信息，如果客户端和服务端都能对Finish信息进行正常加解密且消息正确的被验证，则说明握手通道已经建立成功，接下来，双方可以使用上面产生的session secret对数据进行加密传输了。

Secret Keys

上面的分析和讲解主要是为了突出握手的过程，所以PreMaster secret，Master secret，session secret都是一代而过，但是对于Https，SSL/TLS深入的理解和掌握，这些Secret Keys是非常重要的部分。所以，准备把这些Secret Keys抽出来单独分析和讲解。

我们先来看看这些Secret Keys的的生成过程以及作用流程图：

PreMaster secret

PreMaster secret是在客户端使用RSA或者Diffie-Hellman等加密算法生成的。它将用来跟服务端和客户端在Hello阶段产生的随机数结合在一起生成Master secret。在客户端使用服务单的公钥对PreMaster secret进行加密之后传送给服务端，服务端将使用私钥进行解密得到PreMaster secret。也就是说服务端和客户端都有一份相同的PreMaster secret和随机数。

PreMaster secret前两个字节是TLS的版本号，这是一个比较重要的用来核对握手数据的版本号，因为在Client Hello阶段，客户端会发送一份加密套件列表和当前支持的SSL/TLS的版本号给服务端，而且是使用明文传送的，如果握手的数据包被破解之后，攻击者很有可能串改数据包，选择一个安全性较低的加密套件和版本给服务端，从而对数据进行破解。所以，服务端需要对密文中解密出来对的PreMaster版本号跟之前Client Hello阶段的版本号进行对比，如果版本号变低，则说明被串改，则立即停止发送任何消息。

关于PreMaster Secret(Key)的计算:

Client Hello 和Server Hello阶段都会发送各自的Random随机数给对方，最终都是用来计算Master Secret的。

至于PreMaster Secret(Key)的计算，主要是通过RSA或者Diffie-Hellman算法生成。我们可以看出，由于在Say Hello阶段，随机数都是明文传送的，如果PreMaster Secret泄漏的话，会导致整个SSL/TLS失效。PreMaster/Master Secret(Key)的计算流程如图所示：

Master secret

上面已经提到，由于服务端和客户端都有一份相同的PreMaster secret和随机数，这个随机数将作为后面产生Master secret的种子，结合PreMaster secret，客户端和服务端将计算出同样的Master secret。

Master secret是有系列的hash值组成的，它将作为数据加解密相关的secret的Key Material。Master secret最终解析出来的数据如下：

其中，write MAC key，就是session secret或者说是session key。Client write MAC key是客户端发数据的session secret，Server write MAC secret是服务端发送数据的session key。MAC(Message Authentication Code)，是一个数字签名，用来验证数据的完整性，可以检测到数据是否被串改。关于MAC的工作原理详见MAC。

关于Session Secret(Key)的计算:

Session Secret(Key)是从Key Materaial中获取的。Key Material的计算跟Master Secret(Key)的计算类似，只不过计算的次数要多。 Key Material需要计算12次，从而产生12个hash值，计算过程如图：

由于画图展示的原因，上面我只画出了计算4个hash的流程，其实这个是要计算12次，来产生12个hash。

产生12个hash之后，紧接着就可以从这个Key Material中获取Session Secret了。

如图所示，从Key Material依次可以解析出Client MAC, Server MAC, Client Cipher，Server Cipher, Client IV, Server IV。 其中，Client/Server MAC是用来对数据进行验证的，Cliet/Server Cipher就是Client/Server write encryption Key，用来对数据进行加解密的。

应用数据传输

在所有的握手阶段都完成之后，就可以开始传送应用数据了。应用数据在传输之前，首先要附加上MAC secret，然后再对这个数据包使用write encryption key进行加密。在服务端收到密文之后，使用Client write encryption key进行解密，客户端收到服务端的数据之后使用Server write encryption key进行解密，然后使用各自的write MAC key对数据的完整性包括是否被串改进行验证。

(三)The Transport Layer Security (TLS) Protocol

Version 1.2

  1.  
  2. Status of This Memo
  3.  
  4.    This document specifies an Internet standards track protocol for the
  5.    Internet community, and requests discussion and suggestions for
  6.    improvements.  Please refer to the current edition of the "Internet
  7.    Official Protocol Standards" (STD 1) for the standardization state
  8.    and status of this protocol.  Distribution of this memo is unlimited.
  9.  
  10. Abstract
  11.  
  12.    This document specifies Version 1.2 of the Transport Layer Security
  13.    (TLS) protocol.  The TLS protocol provides communications security
  14.    over the Internet.  The protocol allows client/server applications to
  15.    communicate in a way that is designed to prevent eavesdropping,
  16.    tampering, or message forgery.
  17.  
  18. Table of Contents
  19.  
  20.    1. Introduction ....................................................4
  21.       1.1. Requirements Terminology ...................................5
  22.       1.2. Major Differences from TLS 1.1 .............................5
  23.    2. Goals ...........................................................6
  24.    3. Goals of This Document ..........................................7
  25.    4. Presentation Language ...........................................7
  26.       4.1. Basic Block Size ...........................................7
  27.       4.2. Miscellaneous ..............................................8
  28.       4.3. Vectors ....................................................8
  29.       4.4. Numbers ....................................................9
  30.       4.5. Enumerateds ................................................9
  31.       4.6. Constructed Types .........................................10
  32.            4.6.1. Variants ...........................................10
  33.       4.7. Cryptographic Attributes ..................................12
  34.       4.8. Constants .................................................14
  35.    5. HMAC and the Pseudorandom Function .............................14
  36.    6. The TLS Record Protocol ........................................15
  37.       6.1. Connection States .........................................16
  38.       6.2. Record Layer ..............................................19
  39.            6.2.1. Fragmentation ......................................19
  40.  
  41. Dierks & Rescorla           Standards Track                     [Page 1]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.            6.2.2. Record Compression and Decompression ...............20
  4.            6.2.3. Record Payload Protection ..........................21
  5.                   6.2.3.1. Null or Standard Stream Cipher ............22
  6.                   6.2.3.2. CBC Block Cipher ..........................22
  7.                   6.2.3.3. AEAD Ciphers ..............................24
  8.       6.3. Key Calculation ...........................................25
  9.    7. The TLS Handshaking Protocols ..................................26
  10.       7.1. Change Cipher Spec Protocol ...............................27
  11.       7.2. Alert Protocol ............................................28
  12.            7.2.1. Closure Alerts .....................................29
  13.            7.2.2. Error Alerts .......................................30
  14.       7.3. Handshake Protocol Overview ...............................33
  15.       7.4. Handshake Protocol ........................................37
  16.            7.4.1. Hello Messages .....................................38
  17.                   7.4.1.1. Hello Request .............................38
  18.                   7.4.1.2. Client Hello ..............................39
  19.                   7.4.1.3. Server Hello ..............................42
  20.                   7.4.1.4. Hello Extensions ..........................44
  21.                            7.4.1.4.1. Signature Algorithms ...........45
  22.            7.4.2. Server Certificate .................................47
  23.            7.4.3. Server Key Exchange Message ........................50
  24.            7.4.4. Certificate Request ................................53
  25.            7.4.5. Server Hello Done ..................................55
  26.            7.4.6. Client Certificate .................................55
  27.            7.4.7. Client Key Exchange Message ........................57
  28.                   7.4.7.1. RSA-Encrypted Premaster Secret Message ....58
  29.                   7.4.7.2. Client Diffie-Hellman Public Value ........61
  30.            7.4.8. Certificate Verify .................................62
  31.            7.4.9. Finished ...........................................63
  32.    8. Cryptographic Computations .....................................64
  33.       8.1. Computing the Master Secret ...............................64
  34.            8.1.1. RSA ................................................65
  35.            8.1.2. Diffie-Hellman .....................................65
  36.    9. Mandatory Cipher Suites ........................................65
  37.    10. Application Data Protocol .....................................65
  38.    11. Security Considerations .......................................65
  39.    12. IANA Considerations ...........................................65
  40.    Appendix A. Protocol Data Structures and Constant Values ..........68
  41.       A.1. Record Layer ..............................................68
  42.       A.2. Change Cipher Specs Message ...............................69
  43.       A.3. Alert Messages ............................................69
  44.       A.4. Handshake Protocol ........................................70
  45.            A.4.1. Hello Messages .....................................71
  46.            A.4.2. Server Authentication and Key Exchange Messages ....72
  47.            A.4.3. Client Authentication and Key Exchange Messages ....74
  48.            A.4.4. Handshake Finalization Message .....................74
  49.       A.5. The Cipher Suite ..........................................75
  50.       A.6. The Security Parameters ...................................77
  51.  
  52. Dierks & Rescorla           Standards Track                     [Page 2]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.       A.7. Changes to RFC 4492 .......................................78
  4.    Appendix B. Glossary ..............................................78
  5.    Appendix C. Cipher Suite Definitions ..............................83
  6.    Appendix D. Implementation Notes ..................................85
  7.       D.1. Random Number Generation and Seeding ......................85
  8.       D.2. Certificates and Authentication ...........................85
  9.       D.3. Cipher Suites .............................................85
  10.       D.4. Implementation Pitfalls ...................................85
  11.    Appendix E. Backward Compatibility ................................87
  12.       E.1. Compatibility with TLS 1.0/1.1 and SSL 3.0 ................87
  13.       E.2. Compatibility with SSL 2.0 ................................88
  14.       E.3. Avoiding Man-in-the-Middle Version Rollback ...............90
  15.    Appendix F. Security Analysis .....................................91
  16.       F.1. Handshake Protocol ........................................91
  17.            F.1.1. Authentication and Key Exchange ....................91
  18.                   F.1.1.1. Anonymous Key Exchange ....................91
  19.                   F.1.1.2. RSA Key Exchange and Authentication .......92
  20.                   F.1.1.3. Diffie-Hellman Key Exchange with
  21.                            Authentication ............................92
  22.            F.1.2. Version Rollback Attacks ...........................93
  23.            F.1.3. Detecting Attacks Against the Handshake Protocol ...94
  24.            F.1.4. Resuming Sessions ..................................94
  25.       F.2. Protecting Application Data ...............................94
  26.       F.3. Explicit IVs ..............................................95
  27.       F.4. Security of Composite Cipher Modes ........................95
  28.       F.5. Denial of Service .........................................96
  29.       F.6. Final Notes ...............................................96
  30.    Normative References ..............................................97
  31.    Informative References ............................................98
  32.    Working Group Information ........................................101
  33.    Contributors .....................................................101
  34.  
  35. Dierks & Rescorla           Standards Track                     [Page 3]
  1. RFC 5246                          TLS                        August 2008

1. Introduction

  1.  
  2.    The primary goal of the TLS protocol is to provide privacy and data
  3.    integrity between two communicating applications.  The protocol is
  4.    composed of two layers: the TLS Record Protocol and the TLS Handshake
  5.    Protocol.  At the lowest level, layered on top of some reliable
  6.    transport protocol (e.g., TCP [TCP]), is the TLS Record Protocol.
  7.    The TLS Record Protocol provides connection security that has two
  8.    basic properties:
  9.  
  10.    -  The connection is private.  Symmetric cryptography is used for
  11.       data encryption (e.g., AES [AES], RC4 [SCH], etc.).  The keys for
  12.       this symmetric encryption are generated uniquely for each
  13.       connection and are based on a secret negotiated by another
  14.       protocol (such as the TLS Handshake Protocol).  The Record
  15.       Protocol can also be used without encryption.
  16.  
  17.    -  The connection is reliable.  Message transport includes a message
  18.       integrity check using a keyed MAC.  Secure hash functions (e.g.,
  19.       SHA-1, etc.) are used for MAC computations.  The Record Protocol
  20.       can operate without a MAC, but is generally only used in this mode
  21.       while another protocol is using the Record Protocol as a transport
  22.       for negotiating security parameters.
  23.  
  24.    The TLS Record Protocol is used for encapsulation of various higher-
  25.    level protocols.  One such encapsulated protocol, the TLS Handshake
  26.    Protocol, allows the server and client to authenticate each other and
  27.    to negotiate an encryption algorithm and cryptographic keys before
  28.    the application protocol transmits or receives its first byte of
  29.    data.  The TLS Handshake Protocol provides connection security that
  30.    has three basic properties:
  31.  
  32.    -  The peer's identity can be authenticated using asymmetric, or
  33.       public key, cryptography (e.g., RSA [RSA], DSA [DSS], etc.).  This
  34.       authentication can be made optional, but is generally required for
  35.       at least one of the peers.
  36.  
  37.    -  The negotiation of a shared secret is secure: the negotiated
  38.       secret is unavailable to eavesdroppers, and for any authenticated
  39.       connection the secret cannot be obtained, even by an attacker who
  40.       can place himself in the middle of the connection.
  41.  
  42.    -  The negotiation is reliable: no attacker can modify the
  43.       negotiation communication without being detected by the parties to
  44.       the communication.
  45.  
  46. Dierks & Rescorla           Standards Track                     [Page 4]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    One advantage of TLS is that it is application protocol independent.
  4.    Higher-level protocols can layer on top of the TLS protocol
  5.    transparently.  The TLS standard, however, does not specify how
  6.    protocols add security with TLS; the decisions on how to initiate TLS
  7.    handshaking and how to interpret the authentication certificates
  8.    exchanged are left to the judgment of the designers and implementors
  9.    of protocols that run on top of TLS.

1.1. Requirements Terminology

  1.  
  2.    The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
  3.    "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
  4.    document are to be interpreted as described in RFC 2119 [REQ].

1.2. Major Differences from TLS 1.1

  1.  
  2.    This document is a revision of the TLS 1.1 [TLS1.1] protocol which
  3.    contains improved flexibility, particularly for negotiation of
  4.    cryptographic algorithms.  The major changes are:
  5.  
  6.    -  The MD5/SHA-1 combination in the pseudorandom function (PRF) has
  7.       been replaced with cipher-suite-specified PRFs.  All cipher suites
  8.       in this document use P_SHA256.
  9.  
  10.    -  The MD5/SHA-1 combination in the digitally-signed element has been
  11.       replaced with a single hash.  Signed elements now include a field
  12.       that explicitly specifies the hash algorithm used.
  13.  
  14.    -  Substantial cleanup to the client's and server's ability to
  15.       specify which hash and signature algorithms they will accept.
  16.       Note that this also relaxes some of the constraints on signature
  17.       and hash algorithms from previous versions of TLS.
  18.  
  19.    -  Addition of support for authenticated encryption with additional
  20.       data modes.
  21.  
  22.    -  TLS Extensions definition and AES Cipher Suites were merged in
  23.       from external [TLSEXT] and [TLSAES].
  24.  
  25.    -  Tighter checking of EncryptedPreMasterSecret version numbers.
  26.  
  27.    -  Tightened up a number of requirements.
  28.  
  29.    -  Verify_data length now depends on the cipher suite (default is
  30.       still 12).
  31.  
  32.    -  Cleaned up description of Bleichenbacher/Klima attack defenses.
  33.  
  34. Dierks & Rescorla           Standards Track                     [Page 5]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    -  Alerts MUST now be sent in many cases.
  4.  
  5.    -  After a certificate_request, if no certificates are available,
  6.       clients now MUST send an empty certificate list.
  7.  
  8.    -  TLS_RSA_WITH_AES_128_CBC_SHA is now the mandatory to implement
  9.       cipher suite.
  10.  
  11.    -  Added HMAC-SHA256 cipher suites.
  12.  
  13.    -  Removed IDEA and DES cipher suites.  They are now deprecated and
  14.       will be documented in a separate document.
  15.  
  16.    -  Support for the SSLv2 backward-compatible hello is now a MAY, not
  17.       a SHOULD, with sending it a SHOULD NOT.  Support will probably
  18.       become a SHOULD NOT in the future.
  19.  
  20.    -  Added limited "fall-through" to the presentation language to allow
  21.       multiple case arms to have the same encoding.
  22.  
  23.    -  Added an Implementation Pitfalls sections
  24.  
  25.    -  The usual clarifications and editorial work.

2. Goals

  1.  
  2.    The goals of the TLS protocol, in order of priority, are as follows:
  3.  
  4.    1. Cryptographic security: TLS should be used to establish a secure
  5.       connection between two parties.
  6.  
  7.    2. Interoperability: Independent programmers should be able to
  8.       develop applications utilizing TLS that can successfully exchange
  9.       cryptographic parameters without knowledge of one another's code.
  10.  
  11.    3. Extensibility: TLS seeks to provide a framework into which new
  12.       public key and bulk encryption methods can be incorporated as
  13.       necessary.  This will also accomplish two sub-goals: preventing
  14.       the need to create a new protocol (and risking the introduction of
  15.       possible new weaknesses) and avoiding the need to implement an
  16.       entire new security library.
  17.  
  18.    4. Relative efficiency: Cryptographic operations tend to be highly
  19.       CPU intensive, particularly public key operations.  For this
  20.       reason, the TLS protocol has incorporated an optional session
  21.       caching scheme to reduce the number of connections that need to be
  22.       established from scratch.  Additionally, care has been taken to
  23.       reduce network activity.
  24.  
  25. Dierks & Rescorla           Standards Track                     [Page 6]
  1. RFC 5246                          TLS                        August 2008

3. Goals of This Document

  1.  
  2.    This document and the TLS protocol itself are based on the SSL 3.0
  3.    Protocol Specification as published by Netscape.  The differences
  4.    between this protocol and SSL 3.0 are not dramatic, but they are
  5.    significant enough that the various versions of TLS and SSL 3.0 do
  6.    not interoperate (although each protocol incorporates a mechanism by
  7.    which an implementation can back down to prior versions).  This
  8.    document is intended primarily for readers who will be implementing
  9.    the protocol and for those doing cryptographic analysis of it.  The
  10.    specification has been written with this in mind, and it is intended
  11.    to reflect the needs of those two groups.  For that reason, many of
  12.    the algorithm-dependent data structures and rules are included in the
  13.    body of the text (as opposed to in an appendix), providing easier
  14.    access to them.
  15.  
  16.    This document is not intended to supply any details of service
  17.    definition or of interface definition, although it does cover select
  18.    areas of policy as they are required for the maintenance of solid
  19.    security.

4. Presentation Language

  1.  
  2.    This document deals with the formatting of data in an external
  3.    representation.  The following very basic and somewhat casually
  4.    defined presentation syntax will be used.  The syntax draws from
  5.    several sources in its structure.  Although it resembles the
  6.    programming language "C" in its syntax and XDR [XDR] in both its
  7.    syntax and intent, it would be risky to draw too many parallels.  The
  8.    purpose of this presentation language is to document TLS only; it has
  9.    no general application beyond that particular goal.

4.1. Basic Block Size

  1.  
  2.    The representation of all data items is explicitly specified.  The
  3.    basic data block size is one byte (i.e., 8 bits).  Multiple byte data
  4.    items are concatenations of bytes, from left to right, from top to
  5.    bottom.  From the byte stream, a multi-byte item (a numeric in the
  6.    example) is formed (using C notation) by:
  7.  
  8.       value = (byte[0] << 8*(n-1)) | (byte[1] << 8*(n-2)) |
  9.               ... | byte[n-1];
  10.  
  11.    This byte ordering for multi-byte values is the commonplace network
  12.    byte order or big-endian format.
  13.  
  14. Dierks & Rescorla           Standards Track                     [Page 7]
  1. RFC 5246                          TLS                        August 2008

4.2. Miscellaneous

  1.  
  2.    Comments begin with "/*" and end with "*/".
  3.  
  4.    Optional components are denoted by enclosing them in "[[ ]]" double
  5.    brackets.
  6.  
  7.    Single-byte entities containing uninterpreted data are of type
  8.    opaque.

4.3. Vectors

  1.  
  2.    A vector (single-dimensioned array) is a stream of homogeneous data
  3.    elements.  The size of the vector may be specified at documentation
  4.    time or left unspecified until runtime.  In either case, the length
  5.    declares the number of bytes, not the number of elements, in the
  6.    vector.  The syntax for specifying a new type, T', that is a fixed-
  7.    length vector of type T is
  8.  
  9.       T T'[n];
  10.  
  11.    Here, T' occupies n bytes in the data stream, where n is a multiple
  12.    of the size of T.  The length of the vector is not included in the
  13.    encoded stream.
  14.  
  15.    In the following example, Datum is defined to be three consecutive
  16.    bytes that the protocol does not interpret, while Data is three
  17.    consecutive Datum, consuming a total of nine bytes.
  18.  
  19.       opaque Datum[3];      /* three uninterpreted bytes */
  20.       Datum Data[9];        /* 3 consecutive 3 byte vectors */
  21.  
  22.    Variable-length vectors are defined by specifying a subrange of legal
  23.    lengths, inclusively, using the notation <floor..ceiling>.  When
  24.    these are encoded, the actual length precedes the vector's contents
  25.    in the byte stream.  The length will be in the form of a number
  26.    consuming as many bytes as required to hold the vector's specified
  27.    maximum (ceiling) length.  A variable-length vector with an actual
  28.    length field of zero is referred to as an empty vector.
  29.  
  30.       T T'<floor..ceiling>;
  31.  
  32.    In the following example, mandatory is a vector that must contain
  33.    between 300 and 400 bytes of type opaque.  It can never be empty.
  34.    The actual length field consumes two bytes, a uint16, which is
  35.    sufficient to represent the value 400 (see Section 4.4).  On the
  36.    other hand, longer can represent up to 800 bytes of data, or 400
  37.    uint16 elements, and it may be empty.  Its encoding will include a
  38.  
  39. Dierks & Rescorla           Standards Track                     [Page 8]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    two-byte actual length field prepended to the vector.  The length of
  4.    an encoded vector must be an even multiple of the length of a single
  5.    element (for example, a 17-byte vector of uint16 would be illegal).
  6.  
  7.       opaque mandatory<300..400>;
  8.             /* length field is 2 bytes, cannot be empty */
  9.       uint16 longer<0..800>;
  10.             /* zero to 400 16-bit unsigned integers */

4.4. Numbers

  1.  
  2.    The basic numeric data type is an unsigned byte (uint8).  All larger
  3.    numeric data types are formed from fixed-length series of bytes
  4.    concatenated as described in Section 4.1 and are also unsigned.  The
  5.    following numeric types are predefined.
  6.  
  7.       uint8 uint16[2];
  8.       uint8 uint24[3];
  9.       uint8 uint32[4];
  10.       uint8 uint64[8];
  11.  
  12.    All values, here and elsewhere in the specification, are stored in
  13.    network byte (big-endian) order; the uint32 represented by the hex
  14.    bytes 01 02 03 04 is equivalent to the decimal value 16909060.
  15.  
  16.    Note that in some cases (e.g., DH parameters) it is necessary to
  17.    represent integers as opaque vectors.  In such cases, they are
  18.    represented as unsigned integers (i.e., leading zero octets are not
  19.    required even if the most significant bit is set).

4.5. Enumerateds

  1.  
  2.    An additional sparse data type is available called enum.  A field of
  3.    type enum can only assume the values declared in the definition.
  4.    Each definition is a different type.  Only enumerateds of the same
  5.    type may be assigned or compared.  Every element of an enumerated
  6.    must be assigned a value, as demonstrated in the following example.
  7.    Since the elements of the enumerated are not ordered, they can be
  8.    assigned any unique value, in any order.
  9.  
  10.       enum { e1(v1), e2(v2), ... , en(vn) [[, (n)]] } Te;
  11.  
  12.    An enumerated occupies as much space in the byte stream as would its
  13.    maximal defined ordinal value.  The following definition would cause
  14.    one byte to be used to carry fields of type Color.
  15.  
  16.       enum { red(3), blue(5), white(7) } Color;
  17.  
  18. Dierks & Rescorla           Standards Track                     [Page 9]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    One may optionally specify a value without its associated tag to
  4.    force the width definition without defining a superfluous element.
  5.  
  6.    In the following example, Taste will consume two bytes in the data
  7.    stream but can only assume the values 1, 2, or 4.
  8.  
  9.       enum { sweet(1), sour(2), bitter(4), (32000) } Taste;
  10.  
  11.    The names of the elements of an enumeration are scoped within the
  12.    defined type.  In the first example, a fully qualified reference to
  13.    the second element of the enumeration would be Color.blue.  Such
  14.    qualification is not required if the target of the assignment is well
  15.    specified.
  16.  
  17.       Color color = Color.blue;     /* overspecified, legal */
  18.       Color color = blue;           /* correct, type implicit */
  19.  
  20.    For enumerateds that are never converted to external representation,
  21.    the numerical information may be omitted.
  22.  
  23.       enum { low, medium, high } Amount;

4.6. Constructed Types

  1.  
  2.    Structure types may be constructed from primitive types for
  3.    convenience.  Each specification declares a new, unique type.  The
  4.    syntax for definition is much like that of C.
  5.  
  6.       struct {
  7.           T1 f1;
  8.           T2 f2;
  9.           ...
  10.           Tn fn;
  11.       } [[T]];
  12.  
  13.    The fields within a structure may be qualified using the type's name,
  14.    with a syntax much like that available for enumerateds.  For example,
  15.    T.f2 refers to the second field of the previous declaration.
  16.    Structure definitions may be embedded.

4.6.1. Variants

  1.  
  2.    Defined structures may have variants based on some knowledge that is
  3.    available within the environment.  The selector must be an enumerated
  4.    type that defines the possible variants the structure defines.  There
  5.    must be a case arm for every element of the enumeration declared in
  6.    the select.  Case arms have limited fall-through: if two case arms
  7.    follow in immediate succession with no fields in between, then they
  8.  
  9. Dierks & Rescorla           Standards Track                    [Page 10]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    both contain the same fields.  Thus, in the example below, "orange"
  4.    and "banana" both contain V2.  Note that this is a new piece of
  5.    syntax in TLS 1.2.
  6.  
  7.    The body of the variant structure may be given a label for reference.
  8.    The mechanism by which the variant is selected at runtime is not
  9.    prescribed by the presentation language.
  10.  
  11.       struct {
  12.           T1 f1;
  13.           T2 f2;
  14.           ....
  15.           Tn fn;
  16.            select (E) {
  17.                case e1: Te1;
  18.                case e2: Te2;
  19.                case e3: case e4: Te3;
  20.                ....
  21.                case en: Ten;
  22.            } [[fv]];
  23.       } [[Tv]];
  24.  
  25.    For example:
  26.  
  27.       enum { apple, orange, banana } VariantTag;
  28.  
  29.       struct {
  30.           uint16 number;
  31.           opaque string<0..10>; /* variable length */
  32.       } V1;
  33.  
  34.       struct {
  35.           uint32 number;
  36.           opaque string[10];    /* fixed length */
  37.       } V2;
  38.  
  39.       struct {
  40.           select (VariantTag) { /* value of selector is implicit */
  41.               case apple:
  42.                 V1;   /* VariantBody, tag = apple */
  43.               case orange:
  44.               case banana:
  45.                 V2;   /* VariantBody, tag = orange or banana */
  46.           } variant_body;       /* optional label on variant */
  47.       } VariantRecord;
  48.  
  49. Dierks & Rescorla           Standards Track                    [Page 11]
  1. RFC 5246                          TLS                        August 2008

4.7. Cryptographic Attributes

  1.  
  2.    The five cryptographic operations -- digital signing, stream cipher
  3.    encryption, block cipher encryption, authenticated encryption with
  4.    additional data (AEAD) encryption, and public key encryption -- are
  5.    designated digitally-signed, stream-ciphered, block-ciphered, aead-
  6.    ciphered, and public-key-encrypted, respectively.  A field's
  7.    cryptographic processing is specified by prepending an appropriate
  8.    key word designation before the field's type specification.
  9.    Cryptographic keys are implied by the current session state (see
  10.    Section 6.1).
  11.  
  12.    A digitally-signed element is encoded as a struct DigitallySigned:
  13.  
  14.       struct {
  15.          SignatureAndHashAlgorithm algorithm;
  16.          opaque signature<0..2^16-1>;
  17.       } DigitallySigned;
  18.  
  19.    The algorithm field specifies the algorithm used (see Section
  20.    7.4.1.4.1 for the definition of this field).  Note that the
  21.    introduction of the algorithm field is a change from previous
  22.    versions.  The signature is a digital signature using those
  23.    algorithms over the contents of the element.  The contents themselves
  24.    do not appear on the wire but are simply calculated.  The length of
  25.    the signature is specified by the signing algorithm and key.
  26.  
  27.    In RSA signing, the opaque vector contains the signature generated
  28.    using the RSASSA-PKCS1-v1_5 signature scheme defined in [PKCS1].  As
  29.    discussed in [PKCS1], the DigestInfo MUST be DER-encoded [X680]
  30.    [X690].  For hash algorithms without parameters (which includes
  31.    SHA-1), the DigestInfo.AlgorithmIdentifier.parameters field MUST be
  32.    NULL, but implementations MUST accept both without parameters and
  33.    with NULL parameters.  Note that earlier versions of TLS used a
  34.    different RSA signature scheme that did not include a DigestInfo
  35.    encoding.
  36.  
  37.    In DSA, the 20 bytes of the SHA-1 hash are run directly through the
  38.    Digital Signing Algorithm with no additional hashing.  This produces
  39.    two values, r and s.  The DSA signature is an opaque vector, as
  40.    above, the contents of which are the DER encoding of:
  41.  
  42.       Dss-Sig-Value ::= SEQUENCE {
  43.           r INTEGER,
  44.           s INTEGER
  45.       }
  46.  
  47. Dierks & Rescorla           Standards Track                    [Page 12]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    Note: In current terminology, DSA refers to the Digital Signature
  4.    Algorithm and DSS refers to the NIST standard.  In the original SSL
  5.    and TLS specs, "DSS" was used universally.  This document uses "DSA"
  6.    to refer to the algorithm, "DSS" to refer to the standard, and it
  7.    uses "DSS" in the code point definitions for historical continuity.
  8.  
  9.    In stream cipher encryption, the plaintext is exclusive-ORed with an
  10.    identical amount of output generated from a cryptographically secure
  11.    keyed pseudorandom number generator.
  12.  
  13.    In block cipher encryption, every block of plaintext encrypts to a
  14.    block of ciphertext.  All block cipher encryption is done in CBC
  15.    (Cipher Block Chaining) mode, and all items that are block-ciphered
  16.    will be an exact multiple of the cipher block length.
  17.  
  18.    In AEAD encryption, the plaintext is simultaneously encrypted and
  19.    integrity protected.  The input may be of any length, and aead-
  20.    ciphered output is generally larger than the input in order to
  21.    accommodate the integrity check value.
  22.  
  23.    In public key encryption, a public key algorithm is used to encrypt
  24.    data in such a way that it can be decrypted only with the matching
  25.    private key.  A public-key-encrypted element is encoded as an opaque
  26.    vector <0..2^16-1>, where the length is specified by the encryption
  27.    algorithm and key.
  28.  
  29.    RSA encryption is done using the RSAES-PKCS1-v1_5 encryption scheme
  30.    defined in [PKCS1].
  31.  
  32.    In the following example
  33.  
  34.       stream-ciphered struct {
  35.           uint8 field1;
  36.           uint8 field2;
  37.           digitally-signed opaque {
  38.             uint8 field3<0..255>;
  39.             uint8 field4;
  40.           };
  41.       } UserType;
  42.  
  43.    The contents of the inner struct (field3 and field4) are used as
  44.    input for the signature/hash algorithm, and then the entire structure
  45.    is encrypted with a stream cipher.  The length of this structure, in
  46.    bytes, would be equal to two bytes for field1 and field2, plus two
  47.    bytes for the signature and hash algorithm, plus two bytes for the
  48.    length of the signature, plus the length of the output of the signing
  49.  
  50. Dierks & Rescorla           Standards Track                    [Page 13]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    algorithm.  The length of the signature is known because the
  4.    algorithm and key used for the signing are known prior to encoding or
  5.    decoding this structure.

4.8. Constants

  1.  
  2.    Typed constants can be defined for purposes of specification by
  3.    declaring a symbol of the desired type and assigning values to it.
  4.  
  5.    Under-specified types (opaque, variable-length vectors, and
  6.    structures that contain opaque) cannot be assigned values.  No fields
  7.    of a multi-element structure or vector may be elided.
  8.  
  9.    For example:
  10.  
  11.       struct {
  12.           uint8 f1;
  13.           uint8 f2;
  14.       } Example1;
  15.  
  16.       Example1 ex1 = {1, 4};  /* assigns f1 = 1, f2 = 4 */

5. HMAC and the Pseudorandom Function

  1.  
  2.    The TLS record layer uses a keyed Message Authentication Code (MAC)
  3.    to protect message integrity.  The cipher suites defined in this
  4.    document use a construction known as HMAC, described in [HMAC], which
  5.    is based on a hash function.  Other cipher suites MAY define their
  6.    own MAC constructions, if needed.
  7.  
  8.    In addition, a construction is required to do expansion of secrets
  9.    into blocks of data for the purposes of key generation or validation.
  10.    This pseudorandom function (PRF) takes as input a secret, a seed, and
  11.    an identifying label and produces an output of arbitrary length.
  12.  
  13.    In this section, we define one PRF, based on HMAC.  This PRF with the
  14.    SHA-256 hash function is used for all cipher suites defined in this
  15.    document and in TLS documents published prior to this document when
  16.    TLS 1.2 is negotiated.  New cipher suites MUST explicitly specify a
  17.    PRF and, in general, SHOULD use the TLS PRF with SHA-256 or a
  18.    stronger standard hash function.
  19.  
  20.    First, we define a data expansion function, P_hash(secret, data),
  21.    that uses a single hash function to expand a secret and seed into an
  22.    arbitrary quantity of output:
  23.  
  24. Dierks & Rescorla           Standards Track                    [Page 14]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.       P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
  4.                              HMAC_hash(secret, A(2) + seed) +
  5.                              HMAC_hash(secret, A(3) + seed) + ...
  6.  
  7.    where + indicates concatenation.
  8.  
  9.    A() is defined as:
  10.  
  11.       A(0) = seed
  12.       A(i) = HMAC_hash(secret, A(i-1))
  13.  
  14.    P_hash can be iterated as many times as necessary to produce the
  15.    required quantity of data.  For example, if P_SHA256 is being used to
  16.    create 80 bytes of data, it will have to be iterated three times
  17.    (through A(3)), creating 96 bytes of output data; the last 16 bytes
  18.    of the final iteration will then be discarded, leaving 80 bytes of
  19.    output data.
  20.  
  21.    TLS's PRF is created by applying P_hash to the secret as:
  22.  
  23.       PRF(secret, label, seed) = P_<hash>(secret, label + seed)
  24.  
  25.    The label is an ASCII string.  It should be included in the exact
  26.    form it is given without a length byte or trailing null character.
  27.    For example, the label "slithy toves" would be processed by hashing
  28.    the following bytes:
  29.  
  30.       73 6C 69 74 68 79 20 74 6F 76 65 73

6. The TLS Record Protocol

  1.  
  2.    The TLS Record Protocol is a layered protocol.  At each layer,
  3.    messages may include fields for length, description, and content.
  4.    The Record Protocol takes messages to be transmitted, fragments the
  5.    data into manageable blocks, optionally compresses the data, applies
  6.    a MAC, encrypts, and transmits the result.  Received data is
  7.    decrypted, verified, decompressed, reassembled, and then delivered to
  8.    higher-level clients.
  9.  
  10.    Four protocols that use the record protocol are described in this
  11.    document: the handshake protocol, the alert protocol, the change
  12.    cipher spec protocol, and the application data protocol.  In order to
  13.    allow extension of the TLS protocol, additional record content types
  14.    can be supported by the record protocol.  New record content type
  15.    values are assigned by IANA in the TLS Content Type Registry as
  16.    described in Section 12.
  17.  
  18. Dierks & Rescorla           Standards Track                    [Page 15]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    Implementations MUST NOT send record types not defined in this
  4.    document unless negotiated by some extension.  If a TLS
  5.    implementation receives an unexpected record type, it MUST send an
  6.    unexpected_message alert.
  7.  
  8.    Any protocol designed for use over TLS must be carefully designed to
  9.    deal with all possible attacks against it.  As a practical matter,
  10.    this means that the protocol designer must be aware of what security
  11.    properties TLS does and does not provide and cannot safely rely on
  12.    the latter.
  13.  
  14.    Note in particular that type and length of a record are not protected
  15.    by encryption.  If this information is itself sensitive, application
  16.    designers may wish to take steps (padding, cover traffic) to minimize
  17.    information leakage.

6.1. Connection States

  1.  
  2.    A TLS connection state is the operating environment of the TLS Record
  3.    Protocol.  It specifies a compression algorithm, an encryption
  4.    algorithm, and a MAC algorithm.  In addition, the parameters for
  5.    these algorithms are known: the MAC key and the bulk encryption keys
  6.    for the connection in both the read and the write directions.
  7.    Logically, there are always four connection states outstanding: the
  8.    current read and write states, and the pending read and write states.
  9.    All records are processed under the current read and write states.
  10.    The security parameters for the pending states can be set by the TLS
  11.    Handshake Protocol, and the ChangeCipherSpec can selectively make
  12.    either of the pending states current, in which case the appropriate
  13.    current state is disposed of and replaced with the pending state; the
  14.    pending state is then reinitialized to an empty state.  It is illegal
  15.    to make a state that has not been initialized with security
  16.    parameters a current state.  The initial current state always
  17.    specifies that no encryption, compression, or MAC will be used.
  18.  
  19.    The security parameters for a TLS Connection read and write state are
  20.    set by providing the following values:
  21.  
  22.    connection end
  23.       Whether this entity is considered the "client" or the "server" in
  24.       this connection.
  25.  
  26.    PRF algorithm
  27.       An algorithm used to generate keys from the master secret (see
  28.       Sections 5 and 6.3).
  29.  
  30. Dierks & Rescorla           Standards Track                    [Page 16]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    bulk encryption algorithm
  4.       An algorithm to be used for bulk encryption.  This specification
  5.       includes the key size of this algorithm, whether it is a block,
  6.       stream, or AEAD cipher, the block size of the cipher (if
  7.       appropriate), and the lengths of explicit and implicit
  8.       initialization vectors (or nonces).
  9.  
  10.    MAC algorithm
  11.       An algorithm to be used for message authentication.  This
  12.       specification includes the size of the value returned by the MAC
  13.       algorithm.
  14.  
  15.    compression algorithm
  16.       An algorithm to be used for data compression.  This specification
  17.       must include all information the algorithm requires to do
  18.       compression.
  19.  
  20.    master secret
  21.       A 48-byte secret shared between the two peers in the connection.
  22.  
  23.    client random
  24.       A 32-byte value provided by the client.
  25.  
  26.    server random
  27.       A 32-byte value provided by the server.
  28.  
  29.       These parameters are defined in the presentation language as:
  30.  
  31.       enum { server, client } ConnectionEnd;
  32.  
  33.       enum { tls_prf_sha256 } PRFAlgorithm;
  34.  
  35.       enum { null, rc4, 3des, aes }
  36.         BulkCipherAlgorithm;
  37.  
  38.       enum { stream, block, aead } CipherType;
  39.  
  40.       enum { null, hmac_md5, hmac_sha1, hmac_sha256,
  41.            hmac_sha384, hmac_sha512} MACAlgorithm;
  42.  
  43.       enum { null(0), (255) } CompressionMethod;
  44.  
  45.       /* The algorithms specified in CompressionMethod, PRFAlgorithm,
  46.          BulkCipherAlgorithm, and MACAlgorithm may be added to. */
  47.  
  48. Dierks & Rescorla           Standards Track                    [Page 17]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.       struct {
  4.           ConnectionEnd          entity;
  5.           PRFAlgorithm           prf_algorithm;
  6.           BulkCipherAlgorithm    bulk_cipher_algorithm;
  7.           CipherType             cipher_type;
  8.           uint8                  enc_key_length;
  9.           uint8                  block_length;
  10.           uint8                  fixed_iv_length;
  11.           uint8                  record_iv_length;
  12.           MACAlgorithm           mac_algorithm;
  13.           uint8                  mac_length;
  14.           uint8                  mac_key_length;
  15.           CompressionMethod      compression_algorithm;
  16.           opaque                 master_secret[48];
  17.           opaque                 client_random[32];
  18.           opaque                 server_random[32];
  19.       } SecurityParameters;
  20.  
  21.    The record layer will use the security parameters to generate the
  22.    following six items (some of which are not required by all ciphers,
  23.    and are thus empty):
  24.  
  25.       client write MAC key
  26.       server write MAC key
  27.       client write encryption key
  28.       server write encryption key
  29.       client write IV
  30.       server write IV
  31.  
  32.    The client write parameters are used by the server when receiving and
  33.    processing records and vice versa.  The algorithm used for generating
  34.    these items from the security parameters is described in Section 6.3.
  35.  
  36.    Once the security parameters have been set and the keys have been
  37.    generated, the connection states can be instantiated by making them
  38.    the current states.  These current states MUST be updated for each
  39.    record processed.  Each connection state includes the following
  40.    elements:
  41.  
  42.    compression state
  43.       The current state of the compression algorithm.
  44.  
  45.    cipher state
  46.       The current state of the encryption algorithm.  This will consist
  47.       of the scheduled key for that connection.  For stream ciphers,
  48.       this will also contain whatever state information is necessary to
  49.       allow the stream to continue to encrypt or decrypt data.
  50.  
  51. Dierks & Rescorla           Standards Track                    [Page 18]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    MAC key
  4.       The MAC key for this connection, as generated above.
  5.  
  6.    sequence number
  7.       Each connection state contains a sequence number, which is
  8.       maintained separately for read and write states.  The sequence
  9.       number MUST be set to zero whenever a connection state is made the
  10.       active state.  Sequence numbers are of type uint64 and may not
  11.       exceed 2^64-1.  Sequence numbers do not wrap.  If a TLS
  12.       implementation would need to wrap a sequence number, it must
  13.       renegotiate instead.  A sequence number is incremented after each
  14.       record: specifically, the first record transmitted under a
  15.       particular connection state MUST use sequence number 0.

6.2. Record Layer

  1.  
  2.    The TLS record layer receives uninterpreted data from higher layers
  3.    in non-empty blocks of arbitrary size.

6.2.1. Fragmentation

  1.  
  2.    The record layer fragments information blocks into TLSPlaintext
  3.    records carrying data in chunks of 2^14 bytes or less.  Client
  4.    message boundaries are not preserved in the record layer (i.e.,
  5.    multiple client messages of the same ContentType MAY be coalesced
  6.    into a single TLSPlaintext record, or a single message MAY be
  7.    fragmented across several records).
  8.  
  9.       struct {
  10.           uint8 major;
  11.           uint8 minor;
  12.       } ProtocolVersion;
  13.  
  14.       enum {
  15.           change_cipher_spec(20), alert(21), handshake(22),
  16.           application_data(23), (255)
  17.       } ContentType;
  18.  
  19.       struct {
  20.           ContentType type;
  21.           ProtocolVersion version;
  22.           uint16 length;
  23.           opaque fragment[TLSPlaintext.length];
  24.       } TLSPlaintext;
  25.  
  26.    type
  27.       The higher-level protocol used to process the enclosed fragment.
  28.  
  29. Dierks & Rescorla           Standards Track                    [Page 19]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    version
  4.       The version of the protocol being employed.  This document
  5.       describes TLS Version 1.2, which uses the version { 3, 3 }.  The
  6.       version value 3.3 is historical, deriving from the use of {3, 1}
  7.       for TLS 1.0.  (See Appendix A.1.)  Note that a client that
  8.       supports multiple versions of TLS may not know what version will
  9.       be employed before it receives the ServerHello.  See Appendix E
  10.       for discussion about what record layer version number should be
  11.       employed for ClientHello.
  12.  
  13.    length
  14.       The length (in bytes) of the following TLSPlaintext.fragment.  The
  15.       length MUST NOT exceed 2^14.
  16.  
  17.    fragment
  18.       The application data.  This data is transparent and treated as an
  19.       independent block to be dealt with by the higher-level protocol
  20.       specified by the type field.
  21.  
  22.    Implementations MUST NOT send zero-length fragments of Handshake,
  23.    Alert, or ChangeCipherSpec content types.  Zero-length fragments of
  24.    Application data MAY be sent as they are potentially useful as a
  25.    traffic analysis countermeasure.
  26.  
  27.    Note: Data of different TLS record layer content types MAY be
  28.    interleaved.  Application data is generally of lower precedence for
  29.    transmission than other content types.  However, records MUST be
  30.    delivered to the network in the same order as they are protected by
  31.    the record layer.  Recipients MUST receive and process interleaved
  32.    application layer traffic during handshakes subsequent to the first
  33.    one on a connection.

6.2.2. Record Compression and Decompression

  1.  
  2.    All records are compressed using the compression algorithm defined in
  3.    the current session state.  There is always an active compression
  4.    algorithm; however, initially it is defined as
  5.    CompressionMethod.null.  The compression algorithm translates a
  6.    TLSPlaintext structure into a TLSCompressed structure.  Compression
  7.    functions are initialized with default state information whenever a
  8.    connection state is made active.  [RFC3749] describes compression
  9.    algorithms for TLS.
  10.  
  11.    Compression must be lossless and may not increase the content length
  12.    by more than 1024 bytes.  If the decompression function encounters a
  13.    TLSCompressed.fragment that would decompress to a length in excess of
  14.    2^14 bytes, it MUST report a fatal decompression failure error.
  15.  
  16. Dierks & Rescorla           Standards Track                    [Page 20]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.       struct {
  4.           ContentType type;       /* same as TLSPlaintext.type */
  5.           ProtocolVersion version;/* same as TLSPlaintext.version */
  6.           uint16 length;
  7.           opaque fragment[TLSCompressed.length];
  8.       } TLSCompressed;
  9.  
  10.    length
  11.       The length (in bytes) of the following TLSCompressed.fragment.
  12.       The length MUST NOT exceed 2^14 + 1024.
  13.  
  14.    fragment
  15.       The compressed form of TLSPlaintext.fragment.
  16.  
  17.       Note: A CompressionMethod.null operation is an identity operation;
  18.       no fields are altered.
  19.  
  20.       Implementation note: Decompression functions are responsible for
  21.       ensuring that messages cannot cause internal buffer overflows.

6.2.3. Record Payload Protection

  1.  
  2.       The encryption and MAC functions translate a TLSCompressed
  3.       structure into a TLSCiphertext.  The decryption functions reverse
  4.       the process.  The MAC of the record also includes a sequence
  5.       number so that missing, extra, or repeated messages are
  6.       detectable.
  7.  
  8.       struct {
  9.           ContentType type;
  10.           ProtocolVersion version;
  11.           uint16 length;
  12.           select (SecurityParameters.cipher_type) {
  13.               case stream: GenericStreamCipher;
  14.               case block:  GenericBlockCipher;
  15.               case aead:   GenericAEADCipher;
  16.           } fragment;
  17.       } TLSCiphertext;
  18.  
  19.    type
  20.       The type field is identical to TLSCompressed.type.
  21.  
  22.    version
  23.       The version field is identical to TLSCompressed.version.
  24.  
  25.    length
  26.       The length (in bytes) of the following TLSCiphertext.fragment.
  27.       The length MUST NOT exceed 2^14 + 2048.
  28.  
  29. Dierks & Rescorla           Standards Track                    [Page 21]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    fragment
  4.       The encrypted form of TLSCompressed.fragment, with the MAC.
6.2.3.1. Null or Standard Stream Cipher
  1.  
  2.    Stream ciphers (including BulkCipherAlgorithm.null; see Appendix A.6)
  3.    convert TLSCompressed.fragment structures to and from stream
  4.    TLSCiphertext.fragment structures.
  5.  
  6.       stream-ciphered struct {
  7.           opaque content[TLSCompressed.length];
  8.           opaque MAC[SecurityParameters.mac_length];
  9.       } GenericStreamCipher;
  10.  
  11.    The MAC is generated as:
  12.  
  13.       MAC(MAC_write_key, seq_num +
  14.                             TLSCompressed.type +
  15.                             TLSCompressed.version +
  16.                             TLSCompressed.length +
  17.                             TLSCompressed.fragment);
  18.  
  19.    where "+" denotes concatenation.
  20.  
  21.    seq_num
  22.       The sequence number for this record.
  23.  
  24.    MAC
  25.       The MAC algorithm specified by SecurityParameters.mac_algorithm.
  26.  
  27.    Note that the MAC is computed before encryption.  The stream cipher
  28.    encrypts the entire block, including the MAC.  For stream ciphers
  29.    that do not use a synchronization vector (such as RC4), the stream
  30.    cipher state from the end of one record is simply used on the
  31.    subsequent packet.  If the cipher suite is TLS_NULL_WITH_NULL_NULL,
  32.    encryption consists of the identity operation (i.e., the data is not
  33.    encrypted, and the MAC size is zero, implying that no MAC is used).
  34.    For both null and stream ciphers, TLSCiphertext.length is
  35.    TLSCompressed.length plus SecurityParameters.mac_length.
6.2.3.2. CBC Block Cipher
  1.  
  2.    For block ciphers (such as 3DES or AES), the encryption and MAC
  3.    functions convert TLSCompressed.fragment structures to and from block
  4.    TLSCiphertext.fragment structures.
  5.  
  6. Dierks & Rescorla           Standards Track                    [Page 22]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.       struct {
  4.           opaque IV[SecurityParameters.record_iv_length];
  5.           block-ciphered struct {
  6.               opaque content[TLSCompressed.length];
  7.               opaque MAC[SecurityParameters.mac_length];
  8.               uint8 padding[GenericBlockCipher.padding_length];
  9.               uint8 padding_length;
  10.           };
  11.       } GenericBlockCipher;
  12.  
  13.    The MAC is generated as described in Section 6.2.3.1.
  14.  
  15.    IV
  16.       The Initialization Vector (IV) SHOULD be chosen at random, and
  17.       MUST be unpredictable.  Note that in versions of TLS prior to 1.1,
  18.       there was no IV field, and the last ciphertext block of the
  19.       previous record (the "CBC residue") was used as the IV.  This was
  20.       changed to prevent the attacks described in [CBCATT].  For block
  21.       ciphers, the IV length is of length
  22.       SecurityParameters.record_iv_length, which is equal to the
  23.       SecurityParameters.block_size.
  24.  
  25.    padding
  26.       Padding that is added to force the length of the plaintext to be
  27.       an integral multiple of the block cipher's block length.  The
  28.       padding MAY be any length up to 255 bytes, as long as it results
  29.       in the TLSCiphertext.length being an integral multiple of the
  30.       block length.  Lengths longer than necessary might be desirable to
  31.       frustrate attacks on a protocol that are based on analysis of the
  32.       lengths of exchanged messages.  Each uint8 in the padding data
  33.       vector MUST be filled with the padding length value.  The receiver
  34.       MUST check this padding and MUST use the bad_record_mac alert to
  35.       indicate padding errors.
  36.  
  37.    padding_length
  38.       The padding length MUST be such that the total size of the
  39.       GenericBlockCipher structure is a multiple of the cipher's block
  40.       length.  Legal values range from zero to 255, inclusive.  This
  41.       length specifies the length of the padding field exclusive of the
  42.       padding_length field itself.
  43.  
  44.    The encrypted data length (TLSCiphertext.length) is one more than the
  45.    sum of SecurityParameters.block_length, TLSCompressed.length,
  46.    SecurityParameters.mac_length, and padding_length.
  47.  
  48.    Example: If the block length is 8 bytes, the content length
  49.    (TLSCompressed.length) is 61 bytes, and the MAC length is 20 bytes,
  50.    then the length before padding is 82 bytes (this does not include the
  51.  
  52. Dierks & Rescorla           Standards Track                    [Page 23]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    IV.  Thus, the padding length modulo 8 must be equal to 6 in order to
  4.    make the total length an even multiple of 8 bytes (the block length).
  5.    The padding length can be 6, 14, 22, and so on, through 254.  If the
  6.    padding length were the minimum necessary, 6, the padding would be 6
  7.    bytes, each containing the value 6.  Thus, the last 8 octets of the
  8.    GenericBlockCipher before block encryption would be xx 06 06 06 06 06
  9.    06 06, where xx is the last octet of the MAC.
  10.  
  11.    Note: With block ciphers in CBC mode (Cipher Block Chaining), it is
  12.    critical that the entire plaintext of the record be known before any
  13.    ciphertext is transmitted.  Otherwise, it is possible for the
  14.    attacker to mount the attack described in [CBCATT].
  15.  
  16.    Implementation note: Canvel et al. [CBCTIME] have demonstrated a
  17.    timing attack on CBC padding based on the time required to compute
  18.    the MAC.  In order to defend against this attack, implementations
  19.    MUST ensure that record processing time is essentially the same
  20.    whether or not the padding is correct.  In general, the best way to
  21.    do this is to compute the MAC even if the padding is incorrect, and
  22.    only then reject the packet.  For instance, if the pad appears to be
  23.    incorrect, the implementation might assume a zero-length pad and then
  24.    compute the MAC.  This leaves a small timing channel, since MAC
  25.    performance depends to some extent on the size of the data fragment,
  26.    but it is not believed to be large enough to be exploitable, due to
  27.    the large block size of existing MACs and the small size of the
  28.    timing signal.
6.2.3.3. AEAD Ciphers
  1.  
  2.    For AEAD [AEAD] ciphers (such as [CCM] or [GCM]), the AEAD function
  3.    converts TLSCompressed.fragment structures to and from AEAD
  4.    TLSCiphertext.fragment structures.
  5.  
  6.       struct {
  7.          opaque nonce_explicit[SecurityParameters.record_iv_length];
  8.          aead-ciphered struct {
  9.              opaque content[TLSCompressed.length];
  10.          };
  11.       } GenericAEADCipher;
  12.  
  13.    AEAD ciphers take as input a single key, a nonce, a plaintext, and
  14.    "additional data" to be included in the authentication check, as
  15.    described in Section 2.1 of [AEAD].  The key is either the
  16.    client_write_key or the server_write_key.  No MAC key is used.
  17.  
  18.    Each AEAD cipher suite MUST specify how the nonce supplied to the
  19.    AEAD operation is constructed, and what is the length of the
  20.    GenericAEADCipher.nonce_explicit part.  In many cases, it is
  21.  
  22. Dierks & Rescorla           Standards Track                    [Page 24]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    appropriate to use the partially implicit nonce technique described
  4.    in Section 3.2.1 of [AEAD]; with record_iv_length being the length of
  5.    the explicit part.  In this case, the implicit part SHOULD be derived
  6.    from key_block as client_write_iv and server_write_iv (as described
  7.    in Section 6.3), and the explicit part is included in
  8.    GenericAEAEDCipher.nonce_explicit.
  9.  
  10.    The plaintext is the TLSCompressed.fragment.
  11.  
  12.    The additional authenticated data, which we denote as
  13.    additional_data, is defined as follows:
  14.  
  15.       additional_data = seq_num + TLSCompressed.type +
  16.                         TLSCompressed.version + TLSCompressed.length;
  17.  
  18.    where "+" denotes concatenation.
  19.  
  20.    The aead_output consists of the ciphertext output by the AEAD
  21.    encryption operation.  The length will generally be larger than
  22.    TLSCompressed.length, but by an amount that varies with the AEAD
  23.    cipher.  Since the ciphers might incorporate padding, the amount of
  24.    overhead could vary with different TLSCompressed.length values.  Each
  25.    AEAD cipher MUST NOT produce an expansion of greater than 1024 bytes.
  26.    Symbolically,
  27.  
  28.       AEADEncrypted = AEAD-Encrypt(write_key, nonce, plaintext,
  29.                                    additional_data)
  30.  
  31.    In order to decrypt and verify, the cipher takes as input the key,
  32.    nonce, the "additional_data", and the AEADEncrypted value.  The
  33.    output is either the plaintext or an error indicating that the
  34.    decryption failed.  There is no separate integrity check.  That is:
  35.  
  36.       TLSCompressed.fragment = AEAD-Decrypt(write_key, nonce,
  37.                                             AEADEncrypted,
  38.                                             additional_data)
  39.  
  40.    If the decryption fails, a fatal bad_record_mac alert MUST be
  41.    generated.

6.3. Key Calculation

  1.  
  2.    The Record Protocol requires an algorithm to generate keys required
  3.    by the current connection state (see Appendix A.6) from the security
  4.    parameters provided by the handshake protocol.
  5.  
  6. Dierks & Rescorla           Standards Track                    [Page 25]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    The master secret is expanded into a sequence of secure bytes, which
  4.    is then split to a client write MAC key, a server write MAC key, a
  5.    client write encryption key, and a server write encryption key.  Each
  6.    of these is generated from the byte sequence in that order.  Unused
  7.    values are empty.  Some AEAD ciphers may additionally require a
  8.    client write IV and a server write IV (see Section 6.2.3.3).
  9.  
  10.    When keys and MAC keys are generated, the master secret is used as an
  11.    entropy source.
  12.  
  13.    To generate the key material, compute
  14.  
  15.       key_block = PRF(SecurityParameters.master_secret,
  16.                       "key expansion",
  17.                       SecurityParameters.server_random +
  18.                       SecurityParameters.client_random);
  19.  
  20.    until enough output has been generated.  Then, the key_block is
  21.    partitioned as follows:
  22.  
  23.       client_write_MAC_key[SecurityParameters.mac_key_length]
  24.       server_write_MAC_key[SecurityParameters.mac_key_length]
  25.       client_write_key[SecurityParameters.enc_key_length]
  26.       server_write_key[SecurityParameters.enc_key_length]
  27.       client_write_IV[SecurityParameters.fixed_iv_length]
  28.       server_write_IV[SecurityParameters.fixed_iv_length]
  29.  
  30.    Currently, the client_write_IV and server_write_IV are only generated
  31.    for implicit nonce techniques as described in Section 3.2.1 of
  32.    [AEAD].
  33.  
  34.    Implementation note: The currently defined cipher suite which
  35.    requires the most material is AES_256_CBC_SHA256.  It requires 2 x 32
  36.    byte keys and 2 x 32 byte MAC keys, for a total 128 bytes of key
  37.    material.

7. The TLS Handshaking Protocols

  1.  
  2.    TLS has three subprotocols that are used to allow peers to agree upon
  3.    security parameters for the record layer, to authenticate themselves,
  4.    to instantiate negotiated security parameters, and to report error
  5.    conditions to each other.
  6.  
  7.    The Handshake Protocol is responsible for negotiating a session,
  8.    which consists of the following items:
  9.  
  10. Dierks & Rescorla           Standards Track                    [Page 26]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    session identifier
  4.       An arbitrary byte sequence chosen by the server to identify an
  5.       active or resumable session state.
  6.  
  7.    peer certificate
  8.       X509v3 [PKIX] certificate of the peer.  This element of the state
  9.       may be null.
  10.  
  11.    compression method
  12.       The algorithm used to compress data prior to encryption.
  13.  
  14.    cipher spec
  15.       Specifies the pseudorandom function (PRF) used to generate keying
  16.       material, the bulk data encryption algorithm (such as null, AES,
  17.       etc.) and the MAC algorithm (such as HMAC-SHA1).  It also defines
  18.       cryptographic attributes such as the mac_length.  (See Appendix
  19.       A.6 for formal definition.)
  20.  
  21.    master secret
  22.       48-byte secret shared between the client and server.
  23.  
  24.    is resumable
  25.       A flag indicating whether the session can be used to initiate new
  26.       connections.
  27.  
  28.    These items are then used to create security parameters for use by
  29.    the record layer when protecting application data.  Many connections
  30.    can be instantiated using the same session through the resumption
  31.    feature of the TLS Handshake Protocol.

7.1. Change Cipher Spec Protocol

  1.  
  2.    The change cipher spec protocol exists to signal transitions in
  3.    ciphering strategies.  The protocol consists of a single message,
  4.    which is encrypted and compressed under the current (not the pending)
  5.    connection state.  The message consists of a single byte of value 1.
  6.  
  7.       struct {
  8.           enum { change_cipher_spec(1), (255) } type;
  9.       } ChangeCipherSpec;
  10.  
  11.    The ChangeCipherSpec message is sent by both the client and the
  12.    server to notify the receiving party that subsequent records will be
  13.    protected under the newly negotiated CipherSpec and keys.  Reception
  14.    of this message causes the receiver to instruct the record layer to
  15.    immediately copy the read pending state into the read current state.
  16.    Immediately after sending this message, the sender MUST instruct the
  17.    record layer to make the write pending state the write active state.
  18.  
  19. Dierks & Rescorla           Standards Track                    [Page 27]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    (See Section 6.1.)  The ChangeCipherSpec message is sent during the
  4.    handshake after the security parameters have been agreed upon, but
  5.    before the verifying Finished message is sent.
  6.  
  7.    Note: If a rehandshake occurs while data is flowing on a connection,
  8.    the communicating parties may continue to send data using the old
  9.    CipherSpec.  However, once the ChangeCipherSpec has been sent, the
  10.    new CipherSpec MUST be used.  The first side to send the
  11.    ChangeCipherSpec does not know that the other side has finished
  12.    computing the new keying material (e.g., if it has to perform a
  13.    time-consuming public key operation).  Thus, a small window of time,
  14.    during which the recipient must buffer the data, MAY exist.  In
  15.    practice, with modern machines this interval is likely to be fairly
  16.    short.

7.2. Alert Protocol

  1.  
  2.    One of the content types supported by the TLS record layer is the
  3.    alert type.  Alert messages convey the severity of the message
  4.    (warning or fatal) and a description of the alert.  Alert messages
  5.    with a level of fatal result in the immediate termination of the
  6.    connection.  In this case, other connections corresponding to the
  7.    session may continue, but the session identifier MUST be invalidated,
  8.    preventing the failed session from being used to establish new
  9.    connections.  Like other messages, alert messages are encrypted and
  10.    compressed, as specified by the current connection state.
  11.  
  12.       enum { warning(1), fatal(2), (255) } AlertLevel;
  13.  
  14.       enum {
  15.           close_notify(0),
  16.           unexpected_message(10),
  17.           bad_record_mac(20),
  18.           decryption_failed_RESERVED(21),
  19.           record_overflow(22),
  20.           decompression_failure(30),
  21.           handshake_failure(40),
  22.           no_certificate_RESERVED(41),
  23.           bad_certificate(42),
  24.           unsupported_certificate(43),
  25.           certificate_revoked(44),
  26.           certificate_expired(45),
  27.           certificate_unknown(46),
  28.           illegal_parameter(47),
  29.           unknown_ca(48),
  30.           access_denied(49),
  31.           decode_error(50),
  32.           decrypt_error(51),
  33.  
  34. Dierks & Rescorla           Standards Track                    [Page 28]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.           export_restriction_RESERVED(60),
  4.           protocol_version(70),
  5.           insufficient_security(71),
  6.           internal_error(80),
  7.           user_canceled(90),
  8.           no_renegotiation(100),
  9.           unsupported_extension(110),
  10.           (255)
  11.       } AlertDescription;
  12.  
  13.       struct {
  14.           AlertLevel level;
  15.           AlertDescription description;
  16.       } Alert;

7.2.1. Closure Alerts

  1.  
  2.    The client and the server must share knowledge that the connection is
  3.    ending in order to avoid a truncation attack.  Either party may
  4.    initiate the exchange of closing messages.
  5.  
  6.    close_notify
  7.       This message notifies the recipient that the sender will not send
  8.       any more messages on this connection.  Note that as of TLS 1.1,
  9.       failure to properly close a connection no longer requires that a
  10.       session not be resumed.  This is a change from TLS 1.0 to conform
  11.       with widespread implementation practice.
  12.  
  13.    Either party may initiate a close by sending a close_notify alert.
  14.    Any data received after a closure alert is ignored.
  15.  
  16.    Unless some other fatal alert has been transmitted, each party is
  17.    required to send a close_notify alert before closing the write side
  18.    of the connection.  The other party MUST respond with a close_notify
  19.    alert of its own and close down the connection immediately,
  20.    discarding any pending writes.  It is not required for the initiator
  21.    of the close to wait for the responding close_notify alert before
  22.    closing the read side of the connection.
  23.  
  24.    If the application protocol using TLS provides that any data may be
  25.    carried over the underlying transport after the TLS connection is
  26.    closed, the TLS implementation must receive the responding
  27.    close_notify alert before indicating to the application layer that
  28.    the TLS connection has ended.  If the application protocol will not
  29.    transfer any additional data, but will only close the underlying
  30.    transport connection, then the implementation MAY choose to close the
  31.    transport without waiting for the responding close_notify.  No part
  32.  
  33. Dierks & Rescorla           Standards Track                    [Page 29]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    of this standard should be taken to dictate the manner in which a
  4.    usage profile for TLS manages its data transport, including when
  5.    connections are opened or closed.
  6.  
  7.    Note: It is assumed that closing a connection reliably delivers
  8.    pending data before destroying the transport.

7.2.2. Error Alerts

  1.  
  2.    Error handling in the TLS Handshake protocol is very simple.  When an
  3.    error is detected, the detecting party sends a message to the other
  4.    party.  Upon transmission or receipt of a fatal alert message, both
  5.    parties immediately close the connection.  Servers and clients MUST
  6.    forget any session-identifiers, keys, and secrets associated with a
  7.    failed connection.  Thus, any connection terminated with a fatal
  8.    alert MUST NOT be resumed.
  9.  
  10.    Whenever an implementation encounters a condition which is defined as
  11.    a fatal alert, it MUST send the appropriate alert prior to closing
  12.    the connection.  For all errors where an alert level is not
  13.    explicitly specified, the sending party MAY determine at its
  14.    discretion whether to treat this as a fatal error or not.  If the
  15.    implementation chooses to send an alert but intends to close the
  16.    connection immediately afterwards, it MUST send that alert at the
  17.    fatal alert level.
  18.  
  19.    If an alert with a level of warning is sent and received, generally
  20.    the connection can continue normally.  If the receiving party decides
  21.    not to proceed with the connection (e.g., after having received a
  22.    no_renegotiation alert that it is not willing to accept), it SHOULD
  23.    send a fatal alert to terminate the connection.  Given this, the
  24.    sending party cannot, in general, know how the receiving party will
  25.    behave.  Therefore, warning alerts are not very useful when the
  26.    sending party wants to continue the connection, and thus are
  27.    sometimes omitted.  For example, if a peer decides to accept an
  28.    expired certificate (perhaps after confirming this with the user) and
  29.    wants to continue the connection, it would not generally send a
  30.    certificate_expired alert.
  31.  
  32.    The following error alerts are defined:
  33.  
  34.    unexpected_message
  35.       An inappropriate message was received.  This alert is always fatal
  36.       and should never be observed in communication between proper
  37.       implementations.
  38.  
  39. Dierks & Rescorla           Standards Track                    [Page 30]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    bad_record_mac
  4.       This alert is returned if a record is received with an incorrect
  5.       MAC.  This alert also MUST be returned if an alert is sent because
  6.       a TLSCiphertext decrypted in an invalid way: either it wasn't an
  7.       even multiple of the block length, or its padding values, when
  8.       checked, weren't correct.  This message is always fatal and should
  9.       never be observed in communication between proper implementations
  10.       (except when messages were corrupted in the network).
  11.  
  12.    decryption_failed_RESERVED
  13.       This alert was used in some earlier versions of TLS, and may have
  14.       permitted certain attacks against the CBC mode [CBCATT].  It MUST
  15.       NOT be sent by compliant implementations.
  16.  
  17.    record_overflow
  18.       A TLSCiphertext record was received that had a length more than
  19.       2^14+2048 bytes, or a record decrypted to a TLSCompressed record
  20.       with more than 2^14+1024 bytes.  This message is always fatal and
  21.       should never be observed in communication between proper
  22.       implementations (except when messages were corrupted in the
  23.       network).
  24.  
  25.    decompression_failure
  26.       The decompression function received improper input (e.g., data
  27.       that would expand to excessive length).  This message is always
  28.       fatal and should never be observed in communication between proper
  29.       implementations.
  30.  
  31.    handshake_failure
  32.       Reception of a handshake_failure alert message indicates that the
  33.       sender was unable to negotiate an acceptable set of security
  34.       parameters given the options available.  This is a fatal error.
  35.  
  36.    no_certificate_RESERVED
  37.       This alert was used in SSLv3 but not any version of TLS.  It MUST
  38.       NOT be sent by compliant implementations.
  39.  
  40.    bad_certificate
  41.       A certificate was corrupt, contained signatures that did not
  42.       verify correctly, etc.
  43.  
  44.    unsupported_certificate
  45.       A certificate was of an unsupported type.
  46.  
  47.    certificate_revoked
  48.       A certificate was revoked by its signer.
  49.  
  50. Dierks & Rescorla           Standards Track                    [Page 31]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    certificate_expired
  4.       A certificate has expired or is not currently valid.
  5.  
  6.    certificate_unknown
  7.       Some other (unspecified) issue arose in processing the
  8.       certificate, rendering it unacceptable.
  9.  
  10.    illegal_parameter
  11.       A field in the handshake was out of range or inconsistent with
  12.       other fields.  This message is always fatal.
  13.  
  14.    unknown_ca
  15.       A valid certificate chain or partial chain was received, but the
  16.       certificate was not accepted because the CA certificate could not
  17.       be located or couldn't be matched with a known, trusted CA.  This
  18.       message is always fatal.
  19.  
  20.    access_denied
  21.       A valid certificate was received, but when access control was
  22.       applied, the sender decided not to proceed with negotiation.  This
  23.       message is always fatal.
  24.  
  25.    decode_error
  26.       A message could not be decoded because some field was out of the
  27.       specified range or the length of the message was incorrect.  This
  28.       message is always fatal and should never be observed in
  29.       communication between proper implementations (except when messages
  30.       were corrupted in the network).
  31.  
  32.    decrypt_error
  33.       A handshake cryptographic operation failed, including being unable
  34.       to correctly verify a signature or validate a Finished message.
  35.       This message is always fatal.
  36.  
  37.    export_restriction_RESERVED
  38.       This alert was used in some earlier versions of TLS.  It MUST NOT
  39.       be sent by compliant implementations.
  40.  
  41.    protocol_version
  42.       The protocol version the client has attempted to negotiate is
  43.       recognized but not supported.  (For example, old protocol versions
  44.       might be avoided for security reasons.)  This message is always
  45.       fatal.
  46.  
  47. Dierks & Rescorla           Standards Track                    [Page 32]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    insufficient_security
  4.       Returned instead of handshake_failure when a negotiation has
  5.       failed specifically because the server requires ciphers more
  6.       secure than those supported by the client.  This message is always
  7.       fatal.
  8.  
  9.    internal_error
  10.       An internal error unrelated to the peer or the correctness of the
  11.       protocol (such as a memory allocation failure) makes it impossible
  12.       to continue.  This message is always fatal.
  13.  
  14.    user_canceled
  15.       This handshake is being canceled for some reason unrelated to a
  16.       protocol failure.  If the user cancels an operation after the
  17.       handshake is complete, just closing the connection by sending a
  18.       close_notify is more appropriate.  This alert should be followed
  19.       by a close_notify.  This message is generally a warning.
  20.  
  21.    no_renegotiation
  22.       Sent by the client in response to a hello request or by the server
  23.       in response to a client hello after initial handshaking.  Either
  24.       of these would normally lead to renegotiation; when that is not
  25.       appropriate, the recipient should respond with this alert.  At
  26.       that point, the original requester can decide whether to proceed
  27.       with the connection.  One case where this would be appropriate is
  28.       where a server has spawned a process to satisfy a request; the
  29.       process might receive security parameters (key length,
  30.       authentication, etc.) at startup, and it might be difficult to
  31.       communicate changes to these parameters after that point.  This
  32.       message is always a warning.
  33.  
  34.    unsupported_extension
  35.       sent by clients that receive an extended server hello containing
  36.       an extension that they did not put in the corresponding client
  37.       hello.  This message is always fatal.
  38.  
  39.    New Alert values are assigned by IANA as described in Section 12.

7.3. Handshake Protocol Overview

  1.  
  2.    The cryptographic parameters of the session state are produced by the
  3.    TLS Handshake Protocol, which operates on top of the TLS record
  4.    layer.  When a TLS client and server first start communicating, they
  5.    agree on a protocol version, select cryptographic algorithms,
  6.    optionally authenticate each other, and use public-key encryption
  7.    techniques to generate shared secrets.
  8.  
  9. Dierks & Rescorla           Standards Track                    [Page 33]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    The TLS Handshake Protocol involves the following steps:
  4.  
  5.    -  Exchange hello messages to agree on algorithms, exchange random
  6.       values, and check for session resumption.
  7.  
  8.    -  Exchange the necessary cryptographic parameters to allow the
  9.       client and server to agree on a premaster secret.
  10.  
  11.    -  Exchange certificates and cryptographic information to allow the
  12.       client and server to authenticate themselves.
  13.  
  14.    -  Generate a master secret from the premaster secret and exchanged
  15.       random values.
  16.  
  17.    -  Provide security parameters to the record layer.
  18.  
  19.    -  Allow the client and server to verify that their peer has
  20.       calculated the same security parameters and that the handshake
  21.       occurred without tampering by an attacker.
  22.  
  23.    Note that higher layers should not be overly reliant on whether TLS
  24.    always negotiates the strongest possible connection between two
  25.    peers.  There are a number of ways in which a man-in-the-middle
  26.    attacker can attempt to make two entities drop down to the least
  27.    secure method they support.  The protocol has been designed to
  28.    minimize this risk, but there are still attacks available: for
  29.    example, an attacker could block access to the port a secure service
  30.    runs on, or attempt to get the peers to negotiate an unauthenticated
  31.    connection.  The fundamental rule is that higher levels must be
  32.    cognizant of what their security requirements are and never transmit
  33.    information over a channel less secure than what they require.  The
  34.    TLS protocol is secure in that any cipher suite offers its promised
  35.    level of security: if you negotiate 3DES with a 1024-bit RSA key
  36.    exchange with a host whose certificate you have verified, you can
  37.    expect to be that secure.
  38.  
  39.    These goals are achieved by the handshake protocol, which can be
  40.    summarized as follows: The client sends a ClientHello message to
  41.    which the server must respond with a ServerHello message, or else a
  42.    fatal error will occur and the connection will fail.  The ClientHello
  43.    and ServerHello are used to establish security enhancement
  44.    capabilities between client and server.  The ClientHello and
  45.    ServerHello establish the following attributes: Protocol Version,
  46.    Session ID, Cipher Suite, and Compression Method.  Additionally, two
  47.    random values are generated and exchanged: ClientHello.random and
  48.    ServerHello.random.
  49.  
  50. Dierks & Rescorla           Standards Track                    [Page 34]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    The actual key exchange uses up to four messages: the server
  4.    Certificate, the ServerKeyExchange, the client Certificate, and the
  5.    ClientKeyExchange.  New key exchange methods can be created by
  6.    specifying a format for these messages and by defining the use of the
  7.    messages to allow the client and server to agree upon a shared
  8.    secret.  This secret MUST be quite long; currently defined key
  9.    exchange methods exchange secrets that range from 46 bytes upwards.
  10.  
  11.    Following the hello messages, the server will send its certificate in
  12.    a Certificate message if it is to be authenticated.  Additionally, a
  13.    ServerKeyExchange message may be sent, if it is required (e.g., if
  14.    the server has no certificate, or if its certificate is for signing
  15.    only).  If the server is authenticated, it may request a certificate
  16.    from the client, if that is appropriate to the cipher suite selected.
  17.    Next, the server will send the ServerHelloDone message, indicating
  18.    that the hello-message phase of the handshake is complete.  The
  19.    server will then wait for a client response.  If the server has sent
  20.    a CertificateRequest message, the client MUST send the Certificate
  21.    message.  The ClientKeyExchange message is now sent, and the content
  22.    of that message will depend on the public key algorithm selected
  23.    between the ClientHello and the ServerHello.  If the client has sent
  24.    a certificate with signing ability, a digitally-signed
  25.    CertificateVerify message is sent to explicitly verify possession of
  26.    the private key in the certificate.
  27.  
  28.    At this point, a ChangeCipherSpec message is sent by the client, and
  29.    the client copies the pending Cipher Spec into the current Cipher
  30.    Spec.  The client then immediately sends the Finished message under
  31.    the new algorithms, keys, and secrets.  In response, the server will
  32.    send its own ChangeCipherSpec message, transfer the pending to the
  33.    current Cipher Spec, and send its Finished message under the new
  34.    Cipher Spec.  At this point, the handshake is complete, and the
  35.    client and server may begin to exchange application layer data.  (See
  36.    flow chart below.)  Application data MUST NOT be sent prior to the
  37.    completion of the first handshake (before a cipher suite other than
  38.    TLS_NULL_WITH_NULL_NULL is established).
  39.  
  40. Dierks & Rescorla           Standards Track                    [Page 35]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.       Client                                               Server
  4.  
  5.       ClientHello                  -------->
  6.                                                       ServerHello
  7.                                                      Certificate*
  8.                                                ServerKeyExchange*
  9.                                               CertificateRequest*
  10.                                    <--------      ServerHelloDone
  11.       Certificate*
  12.       ClientKeyExchange
  13.       CertificateVerify*
  14.       [ChangeCipherSpec]
  15.       Finished                     -------->
  16.                                                [ChangeCipherSpec]
  17.                                    <--------             Finished
  18.       Application Data             <------->     Application Data
  19.  
  20.              Figure 1.  Message flow for a full handshake
  21.  
  22.    * Indicates optional or situation-dependent messages that are not
  23.    always sent.
  24.  
  25.    Note: To help avoid pipeline stalls, ChangeCipherSpec is an
  26.    independent TLS protocol content type, and is not actually a TLS
  27.    handshake message.
  28.  
  29.    When the client and server decide to resume a previous session or
  30.    duplicate an existing session (instead of negotiating new security
  31.    parameters), the message flow is as follows:
  32.  
  33.    The client sends a ClientHello using the Session ID of the session to
  34.    be resumed.  The server then checks its session cache for a match.
  35.    If a match is found, and the server is willing to re-establish the
  36.    connection under the specified session state, it will send a
  37.    ServerHello with the same Session ID value.  At this point, both
  38.    client and server MUST send ChangeCipherSpec messages and proceed
  39.    directly to Finished messages.  Once the re-establishment is
  40.    complete, the client and server MAY begin to exchange application
  41.    layer data.  (See flow chart below.)  If a Session ID match is not
  42.    found, the server generates a new session ID, and the TLS client and
  43.    server perform a full handshake.
  44.  
  45. Dierks & Rescorla           Standards Track                    [Page 36]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.       Client                                                Server
  4.  
  5.       ClientHello                   -------->
  6.                                                        ServerHello
  7.                                                 [ChangeCipherSpec]
  8.                                     <--------             Finished
  9.       [ChangeCipherSpec]
  10.       Finished                      -------->
  11.       Application Data              <------->     Application Data
  12.  
  13.           Figure 2.  Message flow for an abbreviated handshake
  14.  
  15.    The contents and significance of each message will be presented in
  16.    detail in the following sections.

7.4. Handshake Protocol

  1.  
  2.    The TLS Handshake Protocol is one of the defined higher-level clients
  3.    of the TLS Record Protocol.  This protocol is used to negotiate the
  4.    secure attributes of a session.  Handshake messages are supplied to
  5.    the TLS record layer, where they are encapsulated within one or more
  6.    TLSPlaintext structures, which are processed and transmitted as
  7.    specified by the current active session state.
  8.  
  9.       enum {
  10.           hello_request(0), client_hello(1), server_hello(2),
  11.           certificate(11), server_key_exchange (12),
  12.           certificate_request(13), server_hello_done(14),
  13.           certificate_verify(15), client_key_exchange(16),
  14.           finished(20), (255)
  15.       } HandshakeType;
  16.  
  17.       struct {
  18.           HandshakeType msg_type;    /* handshake type */
  19.           uint24 length;             /* bytes in message */
  20.           select (HandshakeType) {
  21.               case hello_request:       HelloRequest;
  22.               case client_hello:        ClientHello;
  23.               case server_hello:        ServerHello;
  24.               case certificate:         Certificate;
  25.               case server_key_exchange: ServerKeyExchange;
  26.               case certificate_request: CertificateRequest;
  27.               case server_hello_done:   ServerHelloDone;
  28.               case certificate_verify:  CertificateVerify;
  29.               case client_key_exchange: ClientKeyExchange;
  30.               case finished:            Finished;
  31.           } body;
  32.       } Handshake;
  33.  
  34. Dierks & Rescorla           Standards Track                    [Page 37]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    The handshake protocol messages are presented below in the order they
  4.    MUST be sent; sending handshake messages in an unexpected order
  5.    results in a fatal error.  Unneeded handshake messages can be
  6.    omitted, however.  Note one exception to the ordering: the
  7.    Certificate message is used twice in the handshake (from server to
  8.    client, then from client to server), but described only in its first
  9.    position.  The one message that is not bound by these ordering rules
  10.    is the HelloRequest message, which can be sent at any time, but which
  11.    SHOULD be ignored by the client if it arrives in the middle of a
  12.    handshake.
  13.  
  14.    New handshake message types are assigned by IANA as described in
  15.    Section 12.

7.4.1. Hello Messages

  1.  
  2.    The hello phase messages are used to exchange security enhancement
  3.    capabilities between the client and server.  When a new session
  4.    begins, the record layer's connection state encryption, hash, and
  5.    compression algorithms are initialized to null.  The current
  6.    connection state is used for renegotiation messages.
7.4.1.1. Hello Request
  1.  
  2.    When this message will be sent:
  3.  
  4.       The HelloRequest message MAY be sent by the server at any time.
  5.  
  6.    Meaning of this message:
  7.  
  8.       HelloRequest is a simple notification that the client should begin
  9.       the negotiation process anew.  In response, the client should send
  10.       a ClientHello message when convenient.  This message is not
  11.       intended to establish which side is the client or server but
  12.       merely to initiate a new negotiation.  Servers SHOULD NOT send a
  13.       HelloRequest immediately upon the client's initial connection.  It
  14.       is the client's job to send a ClientHello at that time.
  15.  
  16.       This message will be ignored by the client if the client is
  17.       currently negotiating a session.  This message MAY be ignored by
  18.       the client if it does not wish to renegotiate a session, or the
  19.       client may, if it wishes, respond with a no_renegotiation alert.
  20.       Since handshake messages are intended to have transmission
  21.       precedence over application data, it is expected that the
  22.       negotiation will begin before no more than a few records are
  23.       received from the client.  If the server sends a HelloRequest but
  24.       does not receive a ClientHello in response, it may close the
  25.       connection with a fatal alert.
  26.  
  27. Dierks & Rescorla           Standards Track                    [Page 38]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.       After sending a HelloRequest, servers SHOULD NOT repeat the
  4.       request until the subsequent handshake negotiation is complete.
  5.  
  6.    Structure of this message:
  7.  
  8.       struct { } HelloRequest;
  9.  
  10.    This message MUST NOT be included in the message hashes that are
  11.    maintained throughout the handshake and used in the Finished messages
  12.    and the certificate verify message.
7.4.1.2. Client Hello
  1.  
  2.    When this message will be sent:
  3.  
  4.       When a client first connects to a server, it is required to send
  5.       the ClientHello as its first message.  The client can also send a
  6.       ClientHello in response to a HelloRequest or on its own initiative
  7.       in order to renegotiate the security parameters in an existing
  8.       connection.
  9.  
  10.    Structure of this message:
  11.  
  12.       The ClientHello message includes a random structure, which is used
  13.       later in the protocol.
  14.  
  15.          struct {
  16.              uint32 gmt_unix_time;
  17.              opaque random_bytes[28];
  18.          } Random;
  19.  
  20.       gmt_unix_time
  21.          The current time and date in standard UNIX 32-bit format
  22.          (seconds since the midnight starting Jan 1, 1970, UTC, ignoring
  23.          leap seconds) according to the sender's internal clock.  Clocks
  24.          are not required to be set correctly by the basic TLS protocol;
  25.          higher-level or application protocols may define additional
  26.          requirements.  Note that, for historical reasons, the data
  27.          element is named using GMT, the predecessor of the current
  28.          worldwide time base, UTC.
  29.  
  30.       random_bytes
  31.          28 bytes generated by a secure random number generator.
  32.  
  33.    The ClientHello message includes a variable-length session
  34.    identifier.  If not empty, the value identifies a session between the
  35.    same client and server whose security parameters the client wishes to
  36.    reuse.  The session identifier MAY be from an earlier connection,
  37.  
  38. Dierks & Rescorla           Standards Track                    [Page 39]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    this connection, or from another currently active connection.  The
  4.    second option is useful if the client only wishes to update the
  5.    random structures and derived values of a connection, and the third
  6.    option makes it possible to establish several independent secure
  7.    connections without repeating the full handshake protocol.  These
  8.    independent connections may occur sequentially or simultaneously; a
  9.    SessionID becomes valid when the handshake negotiating it completes
  10.    with the exchange of Finished messages and persists until it is
  11.    removed due to aging or because a fatal error was encountered on a
  12.    connection associated with the session.  The actual contents of the
  13.    SessionID are defined by the server.
  14.  
  15.       opaque SessionID<0..32>;
  16.  
  17.    Warning: Because the SessionID is transmitted without encryption or
  18.    immediate MAC protection, servers MUST NOT place confidential
  19.    information in session identifiers or let the contents of fake
  20.    session identifiers cause any breach of security.  (Note that the
  21.    content of the handshake as a whole, including the SessionID, is
  22.    protected by the Finished messages exchanged at the end of the
  23.    handshake.)
  24.  
  25.    The cipher suite list, passed from the client to the server in the
  26.    ClientHello message, contains the combinations of cryptographic
  27.    algorithms supported by the client in order of the client's
  28.    preference (favorite choice first).  Each cipher suite defines a key
  29.    exchange algorithm, a bulk encryption algorithm (including secret key
  30.    length), a MAC algorithm, and a PRF.  The server will select a cipher
  31.    suite or, if no acceptable choices are presented, return a handshake
  32.    failure alert and close the connection.  If the list contains cipher
  33.    suites the server does not recognize, support, or wish to use, the
  34.    server MUST ignore those cipher suites, and process the remaining
  35.    ones as usual.
  36.  
  37.       uint8 CipherSuite[2];    /* Cryptographic suite selector */
  38.  
  39.    The ClientHello includes a list of compression algorithms supported
  40.    by the client, ordered according to the client's preference.
  41.  
  42.       enum { null(0), (255) } CompressionMethod;
  43.  
  44. Dierks & Rescorla           Standards Track                    [Page 40]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.       struct {
  4.           ProtocolVersion client_version;
  5.           Random random;
  6.           SessionID session_id;
  7.           CipherSuite cipher_suites<2..2^16-2>;
  8.           CompressionMethod compression_methods<1..2^8-1>;
  9.           select (extensions_present) {
  10.               case false:
  11.                   struct {};
  12.               case true:
  13.                   Extension extensions<0..2^16-1>;
  14.           };
  15.       } ClientHello;
  16.  
  17.    TLS allows extensions to follow the compression_methods field in an
  18.    extensions block.  The presence of extensions can be detected by
  19.    determining whether there are bytes following the compression_methods
  20.    at the end of the ClientHello.  Note that this method of detecting
  21.    optional data differs from the normal TLS method of having a
  22.    variable-length field, but it is used for compatibility with TLS
  23.    before extensions were defined.
  24.  
  25.    client_version
  26.       The version of the TLS protocol by which the client wishes to
  27.       communicate during this session.  This SHOULD be the latest
  28.       (highest valued) version supported by the client.  For this
  29.       version of the specification, the version will be 3.3 (see
  30.       Appendix E for details about backward compatibility).
  31.  
  32.    random
  33.       A client-generated random structure.
  34.  
  35.    session_id
  36.       The ID of a session the client wishes to use for this connection.
  37.       This field is empty if no session_id is available, or if the
  38.       client wishes to generate new security parameters.
  39.  
  40.    cipher_suites
  41.       This is a list of the cryptographic options supported by the
  42.       client, with the client's first preference first.  If the
  43.       session_id field is not empty (implying a session resumption
  44.       request), this vector MUST include at least the cipher_suite from
  45.       that session.  Values are defined in Appendix A.5.
  46.  
  47.    compression_methods
  48.       This is a list of the compression methods supported by the client,
  49.       sorted by client preference.  If the session_id field is not empty
  50.       (implying a session resumption request), it MUST include the
  51.  
  52. Dierks & Rescorla           Standards Track                    [Page 41]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.       compression_method from that session.  This vector MUST contain,
  4.       and all implementations MUST support, CompressionMethod.null.
  5.       Thus, a client and server will always be able to agree on a
  6.       compression method.
  7.  
  8.    extensions
  9.       Clients MAY request extended functionality from servers by sending
  10.       data in the extensions field.  The actual "Extension" format is
  11.       defined in Section 7.4.1.4.
  12.  
  13.    In the event that a client requests additional functionality using
  14.    extensions, and this functionality is not supplied by the server, the
  15.    client MAY abort the handshake.  A server MUST accept ClientHello
  16.    messages both with and without the extensions field, and (as for all
  17.    other messages) it MUST check that the amount of data in the message
  18.    precisely matches one of these formats; if not, then it MUST send a
  19.    fatal "decode_error" alert.
  20.  
  21.    After sending the ClientHello message, the client waits for a
  22.    ServerHello message.  Any handshake message returned by the server,
  23.    except for a HelloRequest, is treated as a fatal error.
7.4.1.3. Server Hello
  1.  
  2.    When this message will be sent:
  3.  
  4.       The server will send this message in response to a ClientHello
  5.       message when it was able to find an acceptable set of algorithms.
  6.       If it cannot find such a match, it will respond with a handshake
  7.       failure alert.
  8.  
  9.    Structure of this message:
  10.  
  11.       struct {
  12.           ProtocolVersion server_version;
  13.           Random random;
  14.           SessionID session_id;
  15.           CipherSuite cipher_suite;
  16.           CompressionMethod compression_method;
  17.           select (extensions_present) {
  18.               case false:
  19.                   struct {};
  20.               case true:
  21.                   Extension extensions<0..2^16-1>;
  22.           };
  23.       } ServerHello;
  24.  
  25. Dierks & Rescorla           Standards Track                    [Page 42]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    The presence of extensions can be detected by determining whether
  4.    there are bytes following the compression_method field at the end of
  5.    the ServerHello.
  6.  
  7.    server_version
  8.       This field will contain the lower of that suggested by the client
  9.       in the client hello and the highest supported by the server.  For
  10.       this version of the specification, the version is 3.3.  (See
  11.       Appendix E for details about backward compatibility.)
  12.  
  13.    random
  14.       This structure is generated by the server and MUST be
  15.       independently generated from the ClientHello.random.
  16.  
  17.    session_id
  18.       This is the identity of the session corresponding to this
  19.       connection.  If the ClientHello.session_id was non-empty, the
  20.       server will look in its session cache for a match.  If a match is
  21.       found and the server is willing to establish the new connection
  22.       using the specified session state, the server will respond with
  23.       the same value as was supplied by the client.  This indicates a
  24.       resumed session and dictates that the parties must proceed
  25.       directly to the Finished messages.  Otherwise, this field will
  26.       contain a different value identifying the new session.  The server
  27.       may return an empty session_id to indicate that the session will
  28.       not be cached and therefore cannot be resumed.  If a session is
  29.       resumed, it must be resumed using the same cipher suite it was
  30.       originally negotiated with.  Note that there is no requirement
  31.       that the server resume any session even if it had formerly
  32.       provided a session_id.  Clients MUST be prepared to do a full
  33.       negotiation -- including negotiating new cipher suites -- during
  34.       any handshake.
  35.  
  36.    cipher_suite
  37.       The single cipher suite selected by the server from the list in
  38.       ClientHello.cipher_suites.  For resumed sessions, this field is
  39.       the value from the state of the session being resumed.
  40.  
  41.    compression_method
  42.       The single compression algorithm selected by the server from the
  43.       list in ClientHello.compression_methods.  For resumed sessions,
  44.       this field is the value from the resumed session state.
  45.  
  46.    extensions
  47.       A list of extensions.  Note that only extensions offered by the
  48.       client can appear in the server's list.
  49.  
  50. Dierks & Rescorla           Standards Track                    [Page 43]
  1. RFC 5246                          TLS                        August 2008
7.4.1.4. Hello Extensions
  1.  
  2.    The extension format is:
  3.  
  4.       struct {
  5.           ExtensionType extension_type;
  6.           opaque extension_data<0..2^16-1>;
  7.       } Extension;
  8.  
  9.       enum {
  10.           signature_algorithms(13), (65535)
  11.       } ExtensionType;
  12.  
  13.    Here:
  14.  
  15.    -  "extension_type" identifies the particular extension type.
  16.  
  17.    -  "extension_data" contains information specific to the particular
  18.       extension type.
  19.  
  20.    The initial set of extensions is defined in a companion document
  21.    [TLSEXT].  The list of extension types is maintained by IANA as
  22.    described in Section 12.
  23.  
  24.    An extension type MUST NOT appear in the ServerHello unless the same
  25.    extension type appeared in the corresponding ClientHello.  If a
  26.    client receives an extension type in ServerHello that it did not
  27.    request in the associated ClientHello, it MUST abort the handshake
  28.    with an unsupported_extension fatal alert.
  29.  
  30.    Nonetheless, "server-oriented" extensions may be provided in the
  31.    future within this framework.  Such an extension (say, of type x)
  32.    would require the client to first send an extension of type x in a
  33.    ClientHello with empty extension_data to indicate that it supports
  34.    the extension type.  In this case, the client is offering the
  35.    capability to understand the extension type, and the server is taking
  36.    the client up on its offer.
  37.  
  38.    When multiple extensions of different types are present in the
  39.    ClientHello or ServerHello messages, the extensions MAY appear in any
  40.    order.  There MUST NOT be more than one extension of the same type.
  41.  
  42.    Finally, note that extensions can be sent both when starting a new
  43.    session and when requesting session resumption.  Indeed, a client
  44.    that requests session resumption does not in general know whether the
  45.    server will accept this request, and therefore it SHOULD send the
  46.    same extensions as it would send if it were not attempting
  47.    resumption.
  48.  
  49. Dierks & Rescorla           Standards Track                    [Page 44]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    In general, the specification of each extension type needs to
  4.    describe the effect of the extension both during full handshake and
  5.    session resumption.  Most current TLS extensions are relevant only
  6.    when a session is initiated: when an older session is resumed, the
  7.    server does not process these extensions in Client Hello, and does
  8.    not include them in Server Hello.  However, some extensions may
  9.    specify different behavior during session resumption.
  10.  
  11.    There are subtle (and not so subtle) interactions that may occur in
  12.    this protocol between new features and existing features which may
  13.    result in a significant reduction in overall security.  The following
  14.    considerations should be taken into account when designing new
  15.    extensions:
  16.  
  17.    -  Some cases where a server does not agree to an extension are error
  18.       conditions, and some are simply refusals to support particular
  19.       features.  In general, error alerts should be used for the former,
  20.       and a field in the server extension response for the latter.
  21.  
  22.    -  Extensions should, as far as possible, be designed to prevent any
  23.       attack that forces use (or non-use) of a particular feature by
  24.       manipulation of handshake messages.  This principle should be
  25.       followed regardless of whether the feature is believed to cause a
  26.       security problem.
  27.  
  28.       Often the fact that the extension fields are included in the
  29.       inputs to the Finished message hashes will be sufficient, but
  30.       extreme care is needed when the extension changes the meaning of
  31.       messages sent in the handshake phase.  Designers and implementors
  32.       should be aware of the fact that until the handshake has been
  33.       authenticated, active attackers can modify messages and insert,
  34.       remove, or replace extensions.
  35.  
  36.    -  It would be technically possible to use extensions to change major
  37.       aspects of the design of TLS; for example the design of cipher
  38.       suite negotiation.  This is not recommended; it would be more
  39.       appropriate to define a new version of TLS -- particularly since
  40.       the TLS handshake algorithms have specific protection against
  41.       version rollback attacks based on the version number, and the
  42.       possibility of version rollback should be a significant
  43.       consideration in any major design change.
7.4.1.4.1. Signature Algorithms
  1.  
  2.    The client uses the "signature_algorithms" extension to indicate to
  3.    the server which signature/hash algorithm pairs may be used in
  4.    digital signatures.  The "extension_data" field of this extension
  5.    contains a "supported_signature_algorithms" value.
  6.  
  7. Dierks & Rescorla           Standards Track                    [Page 45]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.       enum {
  4.           none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
  5.           sha512(6), (255)
  6.       } HashAlgorithm;
  7.  
  8.       enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
  9.         SignatureAlgorithm;
  10.  
  11.       struct {
  12.             HashAlgorithm hash;
  13.             SignatureAlgorithm signature;
  14.       } SignatureAndHashAlgorithm;
  15.  
  16.       SignatureAndHashAlgorithm
  17.         supported_signature_algorithms<2..2^16-2>;
  18.  
  19.    Each SignatureAndHashAlgorithm value lists a single hash/signature
  20.    pair that the client is willing to verify.  The values are indicated
  21.    in descending order of preference.
  22.  
  23.    Note: Because not all signature algorithms and hash algorithms may be
  24.    accepted by an implementation (e.g., DSA with SHA-1, but not
  25.    SHA-256), algorithms here are listed in pairs.
  26.  
  27.    hash
  28.       This field indicates the hash algorithm which may be used.  The
  29.       values indicate support for unhashed data, MD5 [MD5], SHA-1,
  30.       SHA-224, SHA-256, SHA-384, and SHA-512 [SHS], respectively.  The
  31.       "none" value is provided for future extensibility, in case of a
  32.       signature algorithm which does not require hashing before signing.
  33.  
  34.    signature
  35.       This field indicates the signature algorithm that may be used.
  36.       The values indicate anonymous signatures, RSASSA-PKCS1-v1_5
  37.       [PKCS1] and DSA [DSS], and ECDSA [ECDSA], respectively.  The
  38.       "anonymous" value is meaningless in this context but used in
  39.       Section 7.4.3.  It MUST NOT appear in this extension.
  40.  
  41.    The semantics of this extension are somewhat complicated because the
  42.    cipher suite indicates permissible signature algorithms but not hash
  43.    algorithms.  Sections 7.4.2 and 7.4.3 describe the appropriate rules.
  44.  
  45.    If the client supports only the default hash and signature algorithms
  46.    (listed in this section), it MAY omit the signature_algorithms
  47.    extension.  If the client does not support the default algorithms, or
  48.    supports other hash and signature algorithms (and it is willing to
  49.    use them for verifying messages sent by the server, i.e., server
  50.    certificates and server key exchange), it MUST send the
  51.  
  52. Dierks & Rescorla           Standards Track                    [Page 46]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    signature_algorithms extension, listing the algorithms it is willing
  4.    to accept.
  5.  
  6.    If the client does not send the signature_algorithms extension, the
  7.    server MUST do the following:
  8.  
  9.    -  If the negotiated key exchange algorithm is one of (RSA, DHE_RSA,
  10.       DH_RSA, RSA_PSK, ECDH_RSA, ECDHE_RSA), behave as if client had
  11.       sent the value {sha1,rsa}.
  12.  
  13.    -  If the negotiated key exchange algorithm is one of (DHE_DSS,
  14.       DH_DSS), behave as if the client had sent the value {sha1,dsa}.
  15.  
  16.    -  If the negotiated key exchange algorithm is one of (ECDH_ECDSA,
  17.       ECDHE_ECDSA), behave as if the client had sent value {sha1,ecdsa}.
  18.  
  19.    Note: this is a change from TLS 1.1 where there are no explicit
  20.    rules, but as a practical matter one can assume that the peer
  21.    supports MD5 and SHA-1.
  22.  
  23.    Note: this extension is not meaningful for TLS versions prior to 1.2.
  24.    Clients MUST NOT offer it if they are offering prior versions.
  25.    However, even if clients do offer it, the rules specified in [TLSEXT]
  26.    require servers to ignore extensions they do not understand.
  27.  
  28.    Servers MUST NOT send this extension.  TLS servers MUST support
  29.    receiving this extension.
  30.  
  31.    When performing session resumption, this extension is not included in
  32.    Server Hello, and the server ignores the extension in Client Hello
  33.    (if present).

7.4.2. Server Certificate

  1.  
  2.    When this message will be sent:
  3.  
  4.       The server MUST send a Certificate message whenever the agreed-
  5.       upon key exchange method uses certificates for authentication
  6.       (this includes all key exchange methods defined in this document
  7.       except DH_anon).  This message will always immediately follow the
  8.       ServerHello message.
  9.  
  10.    Meaning of this message:
  11.  
  12.       This message conveys the server's certificate chain to the client.
  13.  
  14.       The certificate MUST be appropriate for the negotiated cipher
  15.       suite's key exchange algorithm and any negotiated extensions.
  16.  
  17. Dierks & Rescorla           Standards Track                    [Page 47]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    Structure of this message:
  4.  
  5.       opaque ASN.1Cert<1..2^24-1>;
  6.  
  7.       struct {
  8.           ASN.1Cert certificate_list<0..2^24-1>;
  9.       } Certificate;
  10.  
  11.    certificate_list
  12.       This is a sequence (chain) of certificates.  The sender's
  13.       certificate MUST come first in the list.  Each following
  14.       certificate MUST directly certify the one preceding it.  Because
  15.       certificate validation requires that root keys be distributed
  16.       independently, the self-signed certificate that specifies the root
  17.       certificate authority MAY be omitted from the chain, under the
  18.       assumption that the remote end must already possess it in order to
  19.       validate it in any case.
  20.  
  21.    The same message type and structure will be used for the client's
  22.    response to a certificate request message.  Note that a client MAY
  23.    send no certificates if it does not have an appropriate certificate
  24.    to send in response to the server's authentication request.
  25.  
  26.    Note: PKCS #7 [PKCS7] is not used as the format for the certificate
  27.    vector because PKCS #6 [PKCS6] extended certificates are not used.
  28.    Also, PKCS #7 defines a SET rather than a SEQUENCE, making the task
  29.    of parsing the list more difficult.
  30.  
  31.    The following rules apply to the certificates sent by the server:
  32.  
  33.    -  The certificate type MUST be X.509v3, unless explicitly negotiated
  34.       otherwise (e.g., [TLSPGP]).
  35.  
  36.    -  The end entity certificate's public key (and associated
  37.       restrictions) MUST be compatible with the selected key exchange
  38.       algorithm.
  39.  
  40.       Key Exchange Alg.  Certificate Key Type
  41.  
  42.       RSA                RSA public key; the certificate MUST allow the
  43.       RSA_PSK            key to be used for encryption (the
  44.                          keyEncipherment bit MUST be set if the key
  45.                          usage extension is present).
  46.                          Note: RSA_PSK is defined in [TLSPSK].
  47.  
  48. Dierks & Rescorla           Standards Track                    [Page 48]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.       DHE_RSA            RSA public key; the certificate MUST allow the
  4.       ECDHE_RSA          key to be used for signing (the
  5.                          digitalSignature bit MUST be set if the key
  6.                          usage extension is present) with the signature
  7.                          scheme and hash algorithm that will be employed
  8.                          in the server key exchange message.
  9.                          Note: ECDHE_RSA is defined in [TLSECC].
  10.  
  11.       DHE_DSS            DSA public key; the certificate MUST allow the
  12.                          key to be used for signing with the hash
  13.                          algorithm that will be employed in the server
  14.                          key exchange message.
  15.  
  16.       DH_DSS             Diffie-Hellman public key; the keyAgreement bit
  17.       DH_RSA             MUST be set if the key usage extension is
  18.                          present.
  19.  
  20.       ECDH_ECDSA         ECDH-capable public key; the public key MUST
  21.       ECDH_RSA           use a curve and point format supported by the
  22.                          client, as described in [TLSECC].
  23.  
  24.       ECDHE_ECDSA        ECDSA-capable public key; the certificate MUST
  25.                          allow the key to be used for signing with the
  26.                          hash algorithm that will be employed in the
  27.                          server key exchange message.  The public key
  28.                          MUST use a curve and point format supported by
  29.                          the client, as described in  [TLSECC].
  30.  
  31.    -  The "server_name" and "trusted_ca_keys" extensions [TLSEXT] are
  32.       used to guide certificate selection.
  33.  
  34.    If the client provided a "signature_algorithms" extension, then all
  35.    certificates provided by the server MUST be signed by a
  36.    hash/signature algorithm pair that appears in that extension.  Note
  37.    that this implies that a certificate containing a key for one
  38.    signature algorithm MAY be signed using a different signature
  39.    algorithm (for instance, an RSA key signed with a DSA key).  This is
  40.    a departure from TLS 1.1, which required that the algorithms be the
  41.    same.  Note that this also implies that the DH_DSS, DH_RSA,
  42.    ECDH_ECDSA, and ECDH_RSA key exchange algorithms do not restrict the
  43.    algorithm used to sign the certificate.  Fixed DH certificates MAY be
  44.    signed with any hash/signature algorithm pair appearing in the
  45.    extension.  The names DH_DSS, DH_RSA, ECDH_ECDSA, and ECDH_RSA are
  46.    historical.
  47.  
  48. Dierks & Rescorla           Standards Track                    [Page 49]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    If the server has multiple certificates, it chooses one of them based
  4.    on the above-mentioned criteria (in addition to other criteria, such
  5.    as transport layer endpoint, local configuration and preferences,
  6.    etc.).  If the server has a single certificate, it SHOULD attempt to
  7.    validate that it meets these criteria.
  8.  
  9.    Note that there are certificates that use algorithms and/or algorithm
  10.    combinations that cannot be currently used with TLS.  For example, a
  11.    certificate with RSASSA-PSS signature key (id-RSASSA-PSS OID in
  12.    SubjectPublicKeyInfo) cannot be used because TLS defines no
  13.    corresponding signature algorithm.
  14.  
  15.    As cipher suites that specify new key exchange methods are specified
  16.    for the TLS protocol, they will imply the certificate format and the
  17.    required encoded keying information.

7.4.3. Server Key Exchange Message

  1.  
  2.    When this message will be sent:
  3.  
  4.       This message will be sent immediately after the server Certificate
  5.       message (or the ServerHello message, if this is an anonymous
  6.       negotiation).
  7.  
  8.       The ServerKeyExchange message is sent by the server only when the
  9.       server Certificate message (if sent) does not contain enough data
  10.       to allow the client to exchange a premaster secret.  This is true
  11.       for the following key exchange methods:
  12.  
  13.          DHE_DSS
  14.          DHE_RSA
  15.          DH_anon
  16.  
  17.       It is not legal to send the ServerKeyExchange message for the
  18.       following key exchange methods:
  19.  
  20.          RSA
  21.          DH_DSS
  22.          DH_RSA
  23.  
  24.       Other key exchange algorithms, such as those defined in [TLSECC],
  25.       MUST specify whether the ServerKeyExchange message is sent or not;
  26.       and if the message is sent, its contents.
  27.  
  28. Dierks & Rescorla           Standards Track                    [Page 50]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    Meaning of this message:
  4.  
  5.       This message conveys cryptographic information to allow the client
  6.       to communicate the premaster secret: a Diffie-Hellman public key
  7.       with which the client can complete a key exchange (with the result
  8.       being the premaster secret) or a public key for some other
  9.       algorithm.
  10.  
  11.    Structure of this message:
  12.  
  13.       enum { dhe_dss, dhe_rsa, dh_anon, rsa, dh_dss, dh_rsa
  14.             /* may be extended, e.g., for ECDH -- see [TLSECC] */
  15.            } KeyExchangeAlgorithm;
  16.  
  17.       struct {
  18.           opaque dh_p<1..2^16-1>;
  19.           opaque dh_g<1..2^16-1>;
  20.           opaque dh_Ys<1..2^16-1>;
  21.       } ServerDHParams;     /* Ephemeral DH parameters */
  22.  
  23.       dh_p
  24.          The prime modulus used for the Diffie-Hellman operation.
  25.  
  26.       dh_g
  27.          The generator used for the Diffie-Hellman operation.
  28.  
  29.       dh_Ys
  30.          The server's Diffie-Hellman public value (g^X mod p).
  31.  
  32. Dierks & Rescorla           Standards Track                    [Page 51]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.       struct {
  4.           select (KeyExchangeAlgorithm) {
  5.               case dh_anon:
  6.                   ServerDHParams params;
  7.               case dhe_dss:
  8.               case dhe_rsa:
  9.                   ServerDHParams params;
  10.                   digitally-signed struct {
  11.                       opaque client_random[32];
  12.                       opaque server_random[32];
  13.                       ServerDHParams params;
  14.                   } signed_params;
  15.               case rsa:
  16.               case dh_dss:
  17.               case dh_rsa:
  18.                   struct {} ;
  19.                  /* message is omitted for rsa, dh_dss, and dh_rsa */
  20.               /* may be extended, e.g., for ECDH -- see [TLSECC] */
  21.           };
  22.       } ServerKeyExchange;
  23.  
  24.       params
  25.          The server's key exchange parameters.
  26.  
  27.       signed_params
  28.          For non-anonymous key exchanges, a signature over the server's
  29.          key exchange parameters.
  30.  
  31.    If the client has offered the "signature_algorithms" extension, the
  32.    signature algorithm and hash algorithm MUST be a pair listed in that
  33.    extension.  Note that there is a possibility for inconsistencies
  34.    here.  For instance, the client might offer DHE_DSS key exchange but
  35.    omit any DSA pairs from its "signature_algorithms" extension.  In
  36.    order to negotiate correctly, the server MUST check any candidate
  37.    cipher suites against the "signature_algorithms" extension before
  38.    selecting them.  This is somewhat inelegant but is a compromise
  39.    designed to minimize changes to the original cipher suite design.
  40.  
  41.    In addition, the hash and signature algorithms MUST be compatible
  42.    with the key in the server's end-entity certificate.  RSA keys MAY be
  43.    used with any permitted hash algorithm, subject to restrictions in
  44.    the certificate, if any.
  45.  
  46.    Because DSA signatures do not contain any secure indication of hash
  47.    algorithm, there is a risk of hash substitution if multiple hashes
  48.    may be used with any key.  Currently, DSA [DSS] may only be used with
  49.    SHA-1.  Future revisions of DSS [DSS-3] are expected to allow the use
  50.    of other digest algorithms with DSA, as well as guidance as to which
  51.  
  52. Dierks & Rescorla           Standards Track                    [Page 52]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    digest algorithms should be used with each key size.  In addition,
  4.    future revisions of [PKIX] may specify mechanisms for certificates to
  5.    indicate which digest algorithms are to be used with DSA.
  6.  
  7.    As additional cipher suites are defined for TLS that include new key
  8.    exchange algorithms, the server key exchange message will be sent if
  9.    and only if the certificate type associated with the key exchange
  10.    algorithm does not provide enough information for the client to
  11.    exchange a premaster secret.

7.4.4. Certificate Request

  1.  
  2.    When this message will be sent:
  3.  
  4.        A non-anonymous server can optionally request a certificate from
  5.        the client, if appropriate for the selected cipher suite.  This
  6.        message, if sent, will immediately follow the ServerKeyExchange
  7.        message (if it is sent; otherwise, this message follows the
  8.        server's Certificate message).
  9.  
  10.    Structure of this message:
  11.  
  12.       enum {
  13.           rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
  14.           rsa_ephemeral_dh_RESERVED(5), dss_ephemeral_dh_RESERVED(6),
  15.           fortezza_dms_RESERVED(20), (255)
  16.       } ClientCertificateType;
  17.  
  18.       opaque DistinguishedName<1..2^16-1>;
  19.  
  20.       struct {
  21.           ClientCertificateType certificate_types<1..2^8-1>;
  22.           SignatureAndHashAlgorithm
  23.             supported_signature_algorithms<2^16-1>;
  24.           DistinguishedName certificate_authorities<0..2^16-1>;
  25.       } CertificateRequest;
  26.  
  27.    certificate_types
  28.       A list of the types of certificate types that the client may
  29.       offer.
  30.  
  31.          rsa_sign        a certificate containing an RSA key
  32.          dss_sign        a certificate containing a DSA key
  33.          rsa_fixed_dh    a certificate containing a static DH key.
  34.          dss_fixed_dh    a certificate containing a static DH key
  35.  
  36. Dierks & Rescorla           Standards Track                    [Page 53]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    supported_signature_algorithms
  4.       A list of the hash/signature algorithm pairs that the server is
  5.       able to verify, listed in descending order of preference.
  6.  
  7.    certificate_authorities
  8.       A list of the distinguished names [X501] of acceptable
  9.       certificate_authorities, represented in DER-encoded format.  These
  10.       distinguished names may specify a desired distinguished name for a
  11.       root CA or for a subordinate CA; thus, this message can be used to
  12.       describe known roots as well as a desired authorization space.  If
  13.       the certificate_authorities list is empty, then the client MAY
  14.       send any certificate of the appropriate ClientCertificateType,
  15.       unless there is some external arrangement to the contrary.
  16.  
  17.    The interaction of the certificate_types and
  18.    supported_signature_algorithms fields is somewhat complicated.
  19.    certificate_types has been present in TLS since SSLv3, but was
  20.    somewhat underspecified.  Much of its functionality is superseded by
  21.    supported_signature_algorithms.  The following rules apply:
  22.  
  23.    -  Any certificates provided by the client MUST be signed using a
  24.       hash/signature algorithm pair found in
  25.       supported_signature_algorithms.
  26.  
  27.    -  The end-entity certificate provided by the client MUST contain a
  28.       key that is compatible with certificate_types.  If the key is a
  29.       signature key, it MUST be usable with some hash/signature
  30.       algorithm pair in supported_signature_algorithms.
  31.  
  32.    -  For historical reasons, the names of some client certificate types
  33.       include the algorithm used to sign the certificate.  For example,
  34.       in earlier versions of TLS, rsa_fixed_dh meant a certificate
  35.       signed with RSA and containing a static DH key.  In TLS 1.2, this
  36.       functionality has been obsoleted by the
  37.       supported_signature_algorithms, and the certificate type no longer
  38.       restricts the algorithm used to sign the certificate.  For
  39.       example, if the server sends dss_fixed_dh certificate type and
  40.       {{sha1, dsa}, {sha1, rsa}} signature types, the client MAY reply
  41.       with a certificate containing a static DH key, signed with RSA-
  42.       SHA1.
  43.  
  44.    New ClientCertificateType values are assigned by IANA as described in
  45.    Section 12.
  46.  
  47.    Note: Values listed as RESERVED may not be used.  They were used in
  48.    SSLv3.
  49.  
  50. Dierks & Rescorla           Standards Track                    [Page 54]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    Note: It is a fatal handshake_failure alert for an anonymous server
  4.    to request client authentication.

7.4.5. Server Hello Done

  1.  
  2.    When this message will be sent:
  3.  
  4.       The ServerHelloDone message is sent by the server to indicate the
  5.       end of the ServerHello and associated messages.  After sending
  6.       this message, the server will wait for a client response.
  7.  
  8.    Meaning of this message:
  9.  
  10.       This message means that the server is done sending messages to
  11.       support the key exchange, and the client can proceed with its
  12.       phase of the key exchange.
  13.  
  14.       Upon receipt of the ServerHelloDone message, the client SHOULD
  15.       verify that the server provided a valid certificate, if required,
  16.       and check that the server hello parameters are acceptable.
  17.  
  18.    Structure of this message:
  19.  
  20.       struct { } ServerHelloDone;

7.4.6. Client Certificate

  1.  
  2.    When this message will be sent:
  3.  
  4.       This is the first message the client can send after receiving a
  5.       ServerHelloDone message.  This message is only sent if the server
  6.       requests a certificate.  If no suitable certificate is available,
  7.       the client MUST send a certificate message containing no
  8.       certificates.  That is, the certificate_list structure has a
  9.       length of zero.  If the client does not send any certificates, the
  10.       server MAY at its discretion either continue the handshake without
  11.       client authentication, or respond with a fatal handshake_failure
  12.       alert.  Also, if some aspect of the certificate chain was
  13.       unacceptable (e.g., it was not signed by a known, trusted CA), the
  14.       server MAY at its discretion either continue the handshake
  15.       (considering the client unauthenticated) or send a fatal alert.
  16.  
  17.       Client certificates are sent using the Certificate structure
  18.       defined in Section 7.4.2.
  19.  
  20. Dierks & Rescorla           Standards Track                    [Page 55]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    Meaning of this message:
  4.  
  5.       This message conveys the client's certificate chain to the server;
  6.       the server will use it when verifying the CertificateVerify
  7.       message (when the client authentication is based on signing) or
  8.       calculating the premaster secret (for non-ephemeral Diffie-
  9.       Hellman).  The certificate MUST be appropriate for the negotiated
  10.       cipher suite's key exchange algorithm, and any negotiated
  11.       extensions.
  12.  
  13.    In particular:
  14.  
  15.    -  The certificate type MUST be X.509v3, unless explicitly negotiated
  16.       otherwise (e.g., [TLSPGP]).
  17.  
  18.    -  The end-entity certificate's public key (and associated
  19.       restrictions) has to be compatible with the certificate types
  20.       listed in CertificateRequest:
  21.  
  22.       Client Cert. Type   Certificate Key Type
  23.  
  24.       rsa_sign            RSA public key; the certificate MUST allow the
  25.                           key to be used for signing with the signature
  26.                           scheme and hash algorithm that will be
  27.                           employed in the certificate verify message.
  28.  
  29.       dss_sign            DSA public key; the certificate MUST allow the
  30.                           key to be used for signing with the hash
  31.                           algorithm that will be employed in the
  32.                           certificate verify message.
  33.  
  34.       ecdsa_sign          ECDSA-capable public key; the certificate MUST
  35.                           allow the key to be used for signing with the
  36.                           hash algorithm that will be employed in the
  37.                           certificate verify message; the public key
  38.                           MUST use a curve and point format supported by
  39.                           the server.
  40.  
  41.       rsa_fixed_dh        Diffie-Hellman public key; MUST use the same
  42.       dss_fixed_dh        parameters as server's key.
  43.  
  44.       rsa_fixed_ecdh      ECDH-capable public key; MUST use the
  45.       ecdsa_fixed_ecdh    same curve as the server's key, and MUST use a
  46.                           point format supported by the server.
  47.  
  48.    -  If the certificate_authorities list in the certificate request
  49.       message was non-empty, one of the certificates in the certificate
  50.       chain SHOULD be issued by one of the listed CAs.
  51.  
  52. Dierks & Rescorla           Standards Track                    [Page 56]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    -  The certificates MUST be signed using an acceptable hash/
  4.       signature algorithm pair, as described in Section 7.4.4.  Note
  5.       that this relaxes the constraints on certificate-signing
  6.       algorithms found in prior versions of TLS.
  7.  
  8.    Note that, as with the server certificate, there are certificates
  9.    that use algorithms/algorithm combinations that cannot be currently
  10.    used with TLS.

7.4.7. Client Key Exchange Message

  1.  
  2.    When this message will be sent:
  3.  
  4.       This message is always sent by the client.  It MUST immediately
  5.       follow the client certificate message, if it is sent.  Otherwise,
  6.       it MUST be the first message sent by the client after it receives
  7.       the ServerHelloDone message.
  8.  
  9.    Meaning of this message:
  10.  
  11.       With this message, the premaster secret is set, either by direct
  12.       transmission of the RSA-encrypted secret or by the transmission of
  13.       Diffie-Hellman parameters that will allow each side to agree upon
  14.       the same premaster secret.
  15.  
  16.       When the client is using an ephemeral Diffie-Hellman exponent,
  17.       then this message contains the client's Diffie-Hellman public
  18.       value.  If the client is sending a certificate containing a static
  19.       DH exponent (i.e., it is doing fixed_dh client authentication),
  20.       then this message MUST be sent but MUST be empty.
  21.  
  22.    Structure of this message:
  23.  
  24.       The choice of messages depends on which key exchange method has
  25.       been selected.  See Section 7.4.3 for the KeyExchangeAlgorithm
  26.       definition.
  27.  
  28. Dierks & Rescorla           Standards Track                    [Page 57]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.       struct {
  4.           select (KeyExchangeAlgorithm) {
  5.               case rsa:
  6.                   EncryptedPreMasterSecret;
  7.               case dhe_dss:
  8.               case dhe_rsa:
  9.               case dh_dss:
  10.               case dh_rsa:
  11.               case dh_anon:
  12.                   ClientDiffieHellmanPublic;
  13.           } exchange_keys;
  14.       } ClientKeyExchange;
7.4.7.1. RSA-Encrypted Premaster Secret Message
  1.  
  2.    Meaning of this message:
  3.  
  4.       If RSA is being used for key agreement and authentication, the
  5.       client generates a 48-byte premaster secret, encrypts it using the
  6.       public key from the server's certificate, and sends the result in
  7.       an encrypted premaster secret message.  This structure is a
  8.       variant of the ClientKeyExchange message and is not a message in
  9.       itself.
  10.  
  11.    Structure of this message:
  12.  
  13.       struct {
  14.           ProtocolVersion client_version;
  15.           opaque random[46];
  16.       } PreMasterSecret;
  17.  
  18.       client_version
  19.          The latest (newest) version supported by the client.  This is
  20.          used to detect version rollback attacks.
  21.  
  22.       random
  23.          46 securely-generated random bytes.
  24.  
  25.       struct {
  26.           public-key-encrypted PreMasterSecret pre_master_secret;
  27.       } EncryptedPreMasterSecret;
  28.  
  29.       pre_master_secret
  30.          This random value is generated by the client and is used to
  31.          generate the master secret, as specified in Section 8.1.
  32.  
  33. Dierks & Rescorla           Standards Track                    [Page 58]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    Note: The version number in the PreMasterSecret is the version
  4.    offered by the client in the ClientHello.client_version, not the
  5.    version negotiated for the connection.  This feature is designed to
  6.    prevent rollback attacks.  Unfortunately, some old implementations
  7.    use the negotiated version instead, and therefore checking the
  8.    version number may lead to failure to interoperate with such
  9.    incorrect client implementations.
  10.  
  11.    Client implementations MUST always send the correct version number in
  12.    PreMasterSecret.  If ClientHello.client_version is TLS 1.1 or higher,
  13.    server implementations MUST check the version number as described in
  14.    the note below.  If the version number is TLS 1.0 or earlier, server
  15.    implementations SHOULD check the version number, but MAY have a
  16.    configuration option to disable the check.  Note that if the check
  17.    fails, the PreMasterSecret SHOULD be randomized as described below.
  18.  
  19.    Note: Attacks discovered by Bleichenbacher [BLEI] and Klima et al.
  20.    [KPR03] can be used to attack a TLS server that reveals whether a
  21.    particular message, when decrypted, is properly PKCS#1 formatted,
  22.    contains a valid PreMasterSecret structure, or has the correct
  23.    version number.
  24.  
  25.    As described by Klima [KPR03], these vulnerabilities can be avoided
  26.    by treating incorrectly formatted message blocks and/or mismatched
  27.    version numbers in a manner indistinguishable from correctly
  28.    formatted RSA blocks.  In other words:
  29.  
  30.       1. Generate a string R of 46 random bytes
  31.  
  32.       2. Decrypt the message to recover the plaintext M
  33.  
  34.       3. If the PKCS#1 padding is not correct, or the length of message
  35.          M is not exactly 48 bytes:
  36.             pre_master_secret = ClientHello.client_version || R
  37.          else If ClientHello.client_version <= TLS 1.0, and version
  38.          number check is explicitly disabled:
  39.             pre_master_secret = M
  40.          else:
  41.             pre_master_secret = ClientHello.client_version || M[2..47]
  42.  
  43.    Note that explicitly constructing the pre_master_secret with the
  44.    ClientHello.client_version produces an invalid master_secret if the
  45.    client has sent the wrong version in the original pre_master_secret.
  46.  
  47.    An alternative approach is to treat a version number mismatch as a
  48.    PKCS-1 formatting error and randomize the premaster secret
  49.    completely:
  50.  
  51. Dierks & Rescorla           Standards Track                    [Page 59]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.       1. Generate a string R of 48 random bytes
  4.  
  5.       2. Decrypt the message to recover the plaintext M
  6.  
  7.       3. If the PKCS#1 padding is not correct, or the length of message
  8.          M is not exactly 48 bytes:
  9.             pre_master_secret = R
  10.          else If ClientHello.client_version <= TLS 1.0, and version
  11.          number check is explicitly disabled:
  12.             premaster secret = M
  13.          else If M[0..1] != ClientHello.client_version:
  14.             premaster secret = R
  15.          else:
  16.             premaster secret = M
  17.  
  18.    Although no practical attacks against this construction are known,
  19.    Klima et al. [KPR03] describe some theoretical attacks, and therefore
  20.    the first construction described is RECOMMENDED.
  21.  
  22.    In any case, a TLS server MUST NOT generate an alert if processing an
  23.    RSA-encrypted premaster secret message fails, or the version number
  24.    is not as expected.  Instead, it MUST continue the handshake with a
  25.    randomly generated premaster secret.  It may be useful to log the
  26.    real cause of failure for troubleshooting purposes; however, care
  27.    must be taken to avoid leaking the information to an attacker
  28.    (through, e.g., timing, log files, or other channels.)
  29.  
  30.    The RSAES-OAEP encryption scheme defined in [PKCS1] is more secure
  31.    against the Bleichenbacher attack.  However, for maximal
  32.    compatibility with earlier versions of TLS, this specification uses
  33.    the RSAES-PKCS1-v1_5 scheme.  No variants of the Bleichenbacher
  34.    attack are known to exist provided that the above recommendations are
  35.    followed.
  36.  
  37.    Implementation note: Public-key-encrypted data is represented as an
  38.    opaque vector <0..2^16-1> (see Section 4.7).  Thus, the RSA-encrypted
  39.    PreMasterSecret in a ClientKeyExchange is preceded by two length
  40.    bytes.  These bytes are redundant in the case of RSA because the
  41.    EncryptedPreMasterSecret is the only data in the ClientKeyExchange
  42.    and its length can therefore be unambiguously determined.  The SSLv3
  43.    specification was not clear about the encoding of public-key-
  44.    encrypted data, and therefore many SSLv3 implementations do not
  45.    include the length bytes -- they encode the RSA-encrypted data
  46.    directly in the ClientKeyExchange message.
  47.  
  48.    This specification requires correct encoding of the
  49.    EncryptedPreMasterSecret complete with length bytes.  The resulting
  50.    PDU is incompatible with many SSLv3 implementations.  Implementors
  51.  
  52. Dierks & Rescorla           Standards Track                    [Page 60]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    upgrading from SSLv3 MUST modify their implementations to generate
  4.    and accept the correct encoding.  Implementors who wish to be
  5.    compatible with both SSLv3 and TLS should make their implementation's
  6.    behavior dependent on the protocol version.
  7.  
  8.    Implementation note: It is now known that remote timing-based attacks
  9.    on TLS are possible, at least when the client and server are on the
  10.    same LAN.  Accordingly, implementations that use static RSA keys MUST
  11.    use RSA blinding or some other anti-timing technique, as described in
  12.    [TIMING].
7.4.7.2. Client Diffie-Hellman Public Value
  1.  
  2.    Meaning of this message:
  3.  
  4.       This structure conveys the client's Diffie-Hellman public value
  5.       (Yc) if it was not already included in the client's certificate.
  6.       The encoding used for Yc is determined by the enumerated
  7.       PublicValueEncoding.  This structure is a variant of the client
  8.       key exchange message, and not a message in itself.
  9.  
  10.    Structure of this message:
  11.  
  12.       enum { implicit, explicit } PublicValueEncoding;
  13.  
  14.       implicit
  15.          If the client has sent a certificate which contains a suitable
  16.          Diffie-Hellman key (for fixed_dh client authentication), then
  17.          Yc is implicit and does not need to be sent again.  In this
  18.          case, the client key exchange message will be sent, but it MUST
  19.          be empty.
  20.  
  21.       explicit
  22.          Yc needs to be sent.
  23.  
  24.       struct {
  25.           select (PublicValueEncoding) {
  26.               case implicit: struct { };
  27.               case explicit: opaque dh_Yc<1..2^16-1>;
  28.           } dh_public;
  29.       } ClientDiffieHellmanPublic;
  30.  
  31.       dh_Yc
  32.          The client's Diffie-Hellman public value (Yc).
  33.  
  34. Dierks & Rescorla           Standards Track                    [Page 61]
  1. RFC 5246                          TLS                        August 2008

7.4.8. Certificate Verify

  1.  
  2.    When this message will be sent:
  3.  
  4.       This message is used to provide explicit verification of a client
  5.       certificate.  This message is only sent following a client
  6.       certificate that has signing capability (i.e., all certificates
  7.       except those containing fixed Diffie-Hellman parameters).  When
  8.       sent, it MUST immediately follow the client key exchange message.
  9.  
  10.    Structure of this message:
  11.  
  12.       struct {
  13.            digitally-signed struct {
  14.                opaque handshake_messages[handshake_messages_length];
  15.            }
  16.       } CertificateVerify;
  17.  
  18.       Here handshake_messages refers to all handshake messages sent or
  19.       received, starting at client hello and up to, but not including,
  20.       this message, including the type and length fields of the
  21.       handshake messages.  This is the concatenation of all the
  22.       Handshake structures (as defined in Section 7.4) exchanged thus
  23.       far.  Note that this requires both sides to either buffer the
  24.       messages or compute running hashes for all potential hash
  25.       algorithms up to the time of the CertificateVerify computation.
  26.       Servers can minimize this computation cost by offering a
  27.       restricted set of digest algorithms in the CertificateRequest
  28.       message.
  29.  
  30.       The hash and signature algorithms used in the signature MUST be
  31.       one of those present in the supported_signature_algorithms field
  32.       of the CertificateRequest message.  In addition, the hash and
  33.       signature algorithms MUST be compatible with the key in the
  34.       client's end-entity certificate.  RSA keys MAY be used with any
  35.       permitted hash algorithm, subject to restrictions in the
  36.       certificate, if any.
  37.  
  38.       Because DSA signatures do not contain any secure indication of
  39.       hash algorithm, there is a risk of hash substitution if multiple
  40.       hashes may be used with any key.  Currently, DSA [DSS] may only be
  41.       used with SHA-1.  Future revisions of DSS [DSS-3] are expected to
  42.       allow the use of other digest algorithms with DSA, as well as
  43.       guidance as to which digest algorithms should be used with each
  44.       key size.  In addition, future revisions of [PKIX] may specify
  45.       mechanisms for certificates to indicate which digest algorithms
  46.       are to be used with DSA.
  47.  
  48. Dierks & Rescorla           Standards Track                    [Page 62]
  1. RFC 5246                          TLS                        August 2008

7.4.9. Finished

  1.  
  2.    When this message will be sent:
  3.  
  4.       A Finished message is always sent immediately after a change
  5.       cipher spec message to verify that the key exchange and
  6.       authentication processes were successful.  It is essential that a
  7.       change cipher spec message be received between the other handshake
  8.       messages and the Finished message.
  9.  
  10.    Meaning of this message:
  11.  
  12.       The Finished message is the first one protected with the just
  13.       negotiated algorithms, keys, and secrets.  Recipients of Finished
  14.       messages MUST verify that the contents are correct.  Once a side
  15.       has sent its Finished message and received and validated the
  16.       Finished message from its peer, it may begin to send and receive
  17.       application data over the connection.
  18.  
  19.    Structure of this message:
  20.  
  21.       struct {
  22.           opaque verify_data[verify_data_length];
  23.       } Finished;
  24.  
  25.       verify_data
  26.          PRF(master_secret, finished_label, Hash(handshake_messages))
  27.             [0..verify_data_length-1];
  28.  
  29.       finished_label
  30.          For Finished messages sent by the client, the string
  31.          "client finished".  For Finished messages sent by the server,
  32.          the string "server finished".
  33.  
  34.       Hash denotes a Hash of the handshake messages.  For the PRF
  35.       defined in Section 5, the Hash MUST be the Hash used as the basis
  36.       for the PRF.  Any cipher suite which defines a different PRF MUST
  37.       also define the Hash to use in the Finished computation.
  38.  
  39.       In previous versions of TLS, the verify_data was always 12 octets
  40.       long.  In the current version of TLS, it depends on the cipher
  41.       suite.  Any cipher suite which does not explicitly specify
  42.       verify_data_length has a verify_data_length equal to 12.  This
  43.       includes all existing cipher suites.  Note that this
  44.       representation has the same encoding as with previous versions.
  45.       Future cipher suites MAY specify other lengths but such length
  46.       MUST be at least 12 bytes.
  47.  
  48. Dierks & Rescorla           Standards Track                    [Page 63]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.       handshake_messages
  4.          All of the data from all messages in this handshake (not
  5.          including any HelloRequest messages) up to, but not including,
  6.          this message.  This is only data visible at the handshake layer
  7.          and does not include record layer headers.  This is the
  8.          concatenation of all the Handshake structures as defined in
  9.          Section 7.4, exchanged thus far.
  10.  
  11.    It is a fatal error if a Finished message is not preceded by a
  12.    ChangeCipherSpec message at the appropriate point in the handshake.
  13.  
  14.    The value handshake_messages includes all handshake messages starting
  15.    at ClientHello up to, but not including, this Finished message.  This
  16.    may be different from handshake_messages in Section 7.4.8 because it
  17.    would include the CertificateVerify message (if sent).  Also, the
  18.    handshake_messages for the Finished message sent by the client will
  19.    be different from that for the Finished message sent by the server,
  20.    because the one that is sent second will include the prior one.
  21.  
  22.    Note: ChangeCipherSpec messages, alerts, and any other record types
  23.    are not handshake messages and are not included in the hash
  24.    computations.  Also, HelloRequest messages are omitted from handshake
  25.    hashes.

8. Cryptographic Computations

  1.  
  2.    In order to begin connection protection, the TLS Record Protocol
  3.    requires specification of a suite of algorithms, a master secret, and
  4.    the client and server random values.  The authentication, encryption,
  5.    and MAC algorithms are determined by the cipher_suite selected by the
  6.    server and revealed in the ServerHello message.  The compression
  7.    algorithm is negotiated in the hello messages, and the random values
  8.    are exchanged in the hello messages.  All that remains is to
  9.    calculate the master secret.

8.1. Computing the Master Secret

  1.  
  2.    For all key exchange methods, the same algorithm is used to convert
  3.    the pre_master_secret into the master_secret.  The pre_master_secret
  4.    should be deleted from memory once the master_secret has been
  5.    computed.
  6.  
  7.       master_secret = PRF(pre_master_secret, "master secret",
  8.                           ClientHello.random + ServerHello.random)
  9.                           [0..47];
  10.  
  11.    The master secret is always exactly 48 bytes in length.  The length
  12.    of the premaster secret will vary depending on key exchange method.
  13.  
  14. Dierks & Rescorla           Standards Track                    [Page 64]
  1. RFC 5246                          TLS                        August 2008

8.1.1. RSA

  1.  
  2.    When RSA is used for server authentication and key exchange, a 48-
  3.    byte pre_master_secret is generated by the client, encrypted under
  4.    the server's public key, and sent to the server.  The server uses its
  5.    private key to decrypt the pre_master_secret.  Both parties then
  6.    convert the pre_master_secret into the master_secret, as specified
  7.    above.

8.1.2. Diffie-Hellman

  1.  
  2.    A conventional Diffie-Hellman computation is performed.  The
  3.    negotiated key (Z) is used as the pre_master_secret, and is converted
  4.    into the master_secret, as specified above.  Leading bytes of Z that
  5.    contain all zero bits are stripped before it is used as the
  6.    pre_master_secret.
  7.  
  8.    Note: Diffie-Hellman parameters are specified by the server and may
  9.    be either ephemeral or contained within the server's certificate.

9. Mandatory Cipher Suites

  1.  
  2.    In the absence of an application profile standard specifying
  3.    otherwise, a TLS-compliant application MUST implement the cipher
  4.    suite TLS_RSA_WITH_AES_128_CBC_SHA (see Appendix A.5 for the
  5.    definition).

10. Application Data Protocol

  1.  
  2.    Application data messages are carried by the record layer and are
  3.    fragmented, compressed, and encrypted based on the current connection
  4.    state.  The messages are treated as transparent data to the record
  5.    layer.

11. Security Considerations

  1.  
  2.    Security issues are discussed throughout this memo, especially in
  3.    Appendices D, E, and F.

12. IANA Considerations

  1.  
  2.    This document uses several registries that were originally created in
  3.    [TLS1.1].  IANA has updated these to reference this document.  The
  4.    registries and their allocation policies (unchanged from [TLS1.1])
  5.    are listed below.
  6.  
  7. Dierks & Rescorla           Standards Track                    [Page 65]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    -  TLS ClientCertificateType Identifiers Registry: Future values in
  4.       the range 0-63 (decimal) inclusive are assigned via Standards
  5.       Action [RFC2434].  Values in the range 64-223 (decimal) inclusive
  6.       are assigned via Specification Required [RFC2434].  Values from
  7.       224-255 (decimal) inclusive are reserved for Private Use
  8.       [RFC2434].
  9.  
  10.    -  TLS Cipher Suite Registry: Future values with the first byte in
  11.       the range 0-191 (decimal) inclusive are assigned via Standards
  12.       Action [RFC2434].  Values with the first byte in the range 192-254
  13.       (decimal) are assigned via Specification Required [RFC2434].
  14.       Values with the first byte 255 (decimal) are reserved for Private
  15.       Use [RFC2434].
  16.  
  17.    -  This document defines several new HMAC-SHA256-based cipher suites,
  18.       whose values (in Appendix A.5) have been allocated from the TLS
  19.       Cipher Suite registry.
  20.  
  21.    -  TLS ContentType Registry: Future values are allocated via
  22.       Standards Action [RFC2434].
  23.  
  24.    -  TLS Alert Registry: Future values are allocated via Standards
  25.       Action [RFC2434].
  26.  
  27.    -  TLS HandshakeType Registry: Future values are allocated via
  28.       Standards Action [RFC2434].
  29.  
  30.    This document also uses a registry originally created in [RFC4366].
  31.    IANA has updated it to reference this document.  The registry and its
  32.    allocation policy (unchanged from [RFC4366]) is listed below:
  33.  
  34.    -  TLS ExtensionType Registry: Future values are allocated via IETF
  35.       Consensus [RFC2434].  IANA has updated this registry to include
  36.       the signature_algorithms extension and its corresponding value
  37.       (see Section 7.4.1.4).
  38.  
  39.    In addition, this document defines two new registries to be
  40.    maintained by IANA:
  41.  
  42.    -  TLS SignatureAlgorithm Registry: The registry has been initially
  43.       populated with the values described in Section 7.4.1.4.1.  Future
  44.       values in the range 0-63 (decimal) inclusive are assigned via
  45.       Standards Action [RFC2434].  Values in the range 64-223 (decimal)
  46.       inclusive are assigned via Specification Required [RFC2434].
  47.       Values from 224-255 (decimal) inclusive are reserved for Private
  48.       Use [RFC2434].
  49.  
  50. Dierks & Rescorla           Standards Track                    [Page 66]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    -  TLS HashAlgorithm Registry: The registry has been initially
  4.       populated with the values described in Section 7.4.1.4.1.  Future
  5.       values in the range 0-63 (decimal) inclusive are assigned via
  6.       Standards Action [RFC2434].  Values in the range 64-223 (decimal)
  7.       inclusive are assigned via Specification Required [RFC2434].
  8.       Values from 224-255 (decimal) inclusive are reserved for Private
  9.       Use [RFC2434].
  10.  
  11.       This document also uses the TLS Compression Method Identifiers
  12.       Registry, defined in [RFC3749].  IANA has allocated value 0 for
  13.       the "null" compression method.
  14.  
  15. Dierks & Rescorla           Standards Track                    [Page 67]
  1. RFC 5246                          TLS                        August 2008

Appendix A. Protocol Data Structures and Constant Values

  1.  
  2.    This section describes protocol types and constants.

A.1. Record Layer

  1.  
  2.    struct {
  3.        uint8 major;
  4.        uint8 minor;
  5.    } ProtocolVersion;
  6.  
  7.    ProtocolVersion version = { 3, 3 };     /* TLS v1.2*/
  8.  
  9.    enum {
  10.        change_cipher_spec(20), alert(21), handshake(22),
  11.        application_data(23), (255)
  12.    } ContentType;
  13.  
  14.    struct {
  15.        ContentType type;
  16.        ProtocolVersion version;
  17.        uint16 length;
  18.        opaque fragment[TLSPlaintext.length];
  19.    } TLSPlaintext;
  20.  
  21.    struct {
  22.        ContentType type;
  23.        ProtocolVersion version;
  24.        uint16 length;
  25.        opaque fragment[TLSCompressed.length];
  26.    } TLSCompressed;
  27.  
  28.    struct {
  29.        ContentType type;
  30.        ProtocolVersion version;
  31.        uint16 length;
  32.        select (SecurityParameters.cipher_type) {
  33.            case stream: GenericStreamCipher;
  34.            case block:  GenericBlockCipher;
  35.            case aead:   GenericAEADCipher;
  36.        } fragment;
  37.    } TLSCiphertext;
  38.  
  39.    stream-ciphered struct {
  40.        opaque content[TLSCompressed.length];
  41.        opaque MAC[SecurityParameters.mac_length];
  42.    } GenericStreamCipher;
  43.  
  44. Dierks & Rescorla           Standards Track                    [Page 68]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    struct {
  4.        opaque IV[SecurityParameters.record_iv_length];
  5.        block-ciphered struct {
  6.            opaque content[TLSCompressed.length];
  7.            opaque MAC[SecurityParameters.mac_length];
  8.            uint8 padding[GenericBlockCipher.padding_length];
  9.            uint8 padding_length;
  10.        };
  11.    } GenericBlockCipher;
  12.  
  13.    struct {
  14.       opaque nonce_explicit[SecurityParameters.record_iv_length];
  15.       aead-ciphered struct {
  16.           opaque content[TLSCompressed.length];
  17.       };
  18.    } GenericAEADCipher;

A.2. Change Cipher Specs Message

  1.  
  2.    struct {
  3.        enum { change_cipher_spec(1), (255) } type;
  4.    } ChangeCipherSpec;

A.3. Alert Messages

  1.  
  2.    enum { warning(1), fatal(2), (255) } AlertLevel;
  3.  
  4.    enum {
  5.        close_notify(0),
  6.        unexpected_message(10),
  7.        bad_record_mac(20),
  8.        decryption_failed_RESERVED(21),
  9.        record_overflow(22),
  10.        decompression_failure(30),
  11.        handshake_failure(40),
  12.        no_certificate_RESERVED(41),
  13.        bad_certificate(42),
  14.        unsupported_certificate(43),
  15.        certificate_revoked(44),
  16.        certificate_expired(45),
  17.        certificate_unknown(46),
  18.        illegal_parameter(47),
  19.        unknown_ca(48),
  20.        access_denied(49),
  21.        decode_error(50),
  22.        decrypt_error(51),
  23.        export_restriction_RESERVED(60),
  24.        protocol_version(70),
  25.  
  26. Dierks & Rescorla           Standards Track                    [Page 69]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.        insufficient_security(71),
  4.        internal_error(80),
  5.        user_canceled(90),
  6.        no_renegotiation(100),
  7.        unsupported_extension(110),           /* new */
  8.        (255)
  9.    } AlertDescription;
  10.  
  11.    struct {
  12.        AlertLevel level;
  13.        AlertDescription description;
  14.    } Alert;

A.4. Handshake Protocol

  1.  
  2.    enum {
  3.        hello_request(0), client_hello(1), server_hello(2),
  4.        certificate(11), server_key_exchange (12),
  5.        certificate_request(13), server_hello_done(14),
  6.        certificate_verify(15), client_key_exchange(16),
  7.        finished(20)
  8.        (255)
  9.    } HandshakeType;
  10.  
  11.    struct {
  12.        HandshakeType msg_type;
  13.        uint24 length;
  14.        select (HandshakeType) {
  15.            case hello_request:       HelloRequest;
  16.            case client_hello:        ClientHello;
  17.            case server_hello:        ServerHello;
  18.            case certificate:         Certificate;
  19.            case server_key_exchange: ServerKeyExchange;
  20.            case certificate_request: CertificateRequest;
  21.            case server_hello_done:   ServerHelloDone;
  22.            case certificate_verify:  CertificateVerify;
  23.            case client_key_exchange: ClientKeyExchange;
  24.            case finished:            Finished;
  25.        } body;
  26.    } Handshake;
  27.  
  28. Dierks & Rescorla           Standards Track                    [Page 70]
  1. RFC 5246                          TLS                        August 2008

A.4.1. Hello Messages

  1.  
  2.    struct { } HelloRequest;
  3.  
  4.    struct {
  5.        uint32 gmt_unix_time;
  6.        opaque random_bytes[28];
  7.    } Random;
  8.  
  9.    opaque SessionID<0..32>;
  10.  
  11.    uint8 CipherSuite[2];
  12.  
  13.    enum { null(0), (255) } CompressionMethod;
  14.  
  15.    struct {
  16.        ProtocolVersion client_version;
  17.        Random random;
  18.        SessionID session_id;
  19.        CipherSuite cipher_suites<2..2^16-2>;
  20.        CompressionMethod compression_methods<1..2^8-1>;
  21.        select (extensions_present) {
  22.            case false:
  23.                struct {};
  24.            case true:
  25.                Extension extensions<0..2^16-1>;
  26.        };
  27.    } ClientHello;
  28.  
  29.    struct {
  30.        ProtocolVersion server_version;
  31.        Random random;
  32.        SessionID session_id;
  33.        CipherSuite cipher_suite;
  34.        CompressionMethod compression_method;
  35.        select (extensions_present) {
  36.            case false:
  37.                struct {};
  38.            case true:
  39.                Extension extensions<0..2^16-1>;
  40.        };
  41.    } ServerHello;
  42.  
  43.    struct {
  44.        ExtensionType extension_type;
  45.        opaque extension_data<0..2^16-1>;
  46.    } Extension;
  47.  
  48. Dierks & Rescorla           Standards Track                    [Page 71]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    enum {
  4.        signature_algorithms(13), (65535)
  5.    } ExtensionType;
  6.  
  7.    enum{
  8.        none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
  9.        sha512(6), (255)
  10.    } HashAlgorithm;
  11.    enum {
  12.       anonymous(0), rsa(1), dsa(2), ecdsa(3), (255)
  13.    } SignatureAlgorithm;
  14.  
  15.    struct {
  16.          HashAlgorithm hash;
  17.          SignatureAlgorithm signature;
  18.    } SignatureAndHashAlgorithm;
  19.  
  20.    SignatureAndHashAlgorithm
  21.     supported_signature_algorithms<2..2^16-1>;

A.4.2. Server Authentication and Key Exchange Messages

  1.  
  2.    opaque ASN.1Cert<2^24-1>;
  3.  
  4.    struct {
  5.        ASN.1Cert certificate_list<0..2^24-1>;
  6.    } Certificate;
  7.  
  8.    enum { dhe_dss, dhe_rsa, dh_anon, rsa,dh_dss, dh_rsa
  9.           /* may be extended, e.g., for ECDH -- see [TLSECC] */
  10.         } KeyExchangeAlgorithm;
  11.  
  12.    struct {
  13.        opaque dh_p<1..2^16-1>;
  14.        opaque dh_g<1..2^16-1>;
  15.        opaque dh_Ys<1..2^16-1>;
  16.    } ServerDHParams;     /* Ephemeral DH parameters */
  17.  
  18. Dierks & Rescorla           Standards Track                    [Page 72]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    struct {
  4.        select (KeyExchangeAlgorithm) {
  5.            case dh_anon:
  6.                ServerDHParams params;
  7.            case dhe_dss:
  8.            case dhe_rsa:
  9.                ServerDHParams params;
  10.                digitally-signed struct {
  11.                    opaque client_random[32];
  12.                    opaque server_random[32];
  13.                    ServerDHParams params;
  14.                } signed_params;
  15.            case rsa:
  16.            case dh_dss:
  17.            case dh_rsa:
  18.                struct {} ;
  19.               /* message is omitted for rsa, dh_dss, and dh_rsa */
  20.            /* may be extended, e.g., for ECDH -- see [TLSECC] */
  21.    } ServerKeyExchange;
  22.  
  23.    enum {
  24.        rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
  25.        rsa_ephemeral_dh_RESERVED(5), dss_ephemeral_dh_RESERVED(6),
  26.        fortezza_dms_RESERVED(20),
  27.        (255)
  28.    } ClientCertificateType;
  29.  
  30.    opaque DistinguishedName<1..2^16-1>;
  31.  
  32.    struct {
  33.        ClientCertificateType certificate_types<1..2^8-1>;
  34.        DistinguishedName certificate_authorities<0..2^16-1>;
  35.    } CertificateRequest;
  36.  
  37.    struct { } ServerHelloDone;
  38.  
  39. Dierks & Rescorla           Standards Track                    [Page 73]
  1. RFC 5246                          TLS                        August 2008

A.4.3. Client Authentication and Key Exchange Messages

  1.  
  2.    struct {
  3.        select (KeyExchangeAlgorithm) {
  4.            case rsa:
  5.                EncryptedPreMasterSecret;
  6.            case dhe_dss:
  7.            case dhe_rsa:
  8.            case dh_dss:
  9.            case dh_rsa:
  10.            case dh_anon:
  11.                ClientDiffieHellmanPublic;
  12.        } exchange_keys;
  13.    } ClientKeyExchange;
  14.  
  15.    struct {
  16.        ProtocolVersion client_version;
  17.        opaque random[46];
  18.    } PreMasterSecret;
  19.  
  20.    struct {
  21.        public-key-encrypted PreMasterSecret pre_master_secret;
  22.    } EncryptedPreMasterSecret;
  23.  
  24.    enum { implicit, explicit } PublicValueEncoding;
  25.  
  26.    struct {
  27.        select (PublicValueEncoding) {
  28.            case implicit: struct {};
  29.            case explicit: opaque DH_Yc<1..2^16-1>;
  30.        } dh_public;
  31.    } ClientDiffieHellmanPublic;
  32.  
  33.    struct {
  34.         digitally-signed struct {
  35.             opaque handshake_messages[handshake_messages_length];
  36.         }
  37.    } CertificateVerify;

A.4.4. Handshake Finalization Message

  1.  
  2.    struct {
  3.        opaque verify_data[verify_data_length];
  4.    } Finished;
  5.  
  6. Dierks & Rescorla           Standards Track                    [Page 74]
  1. RFC 5246                          TLS                        August 2008

A.5. The Cipher Suite

  1.  
  2.    The following values define the cipher suite codes used in the
  3.    ClientHello and ServerHello messages.
  4.  
  5.    A cipher suite defines a cipher specification supported in TLS
  6.    Version 1.2.
  7.  
  8.    TLS_NULL_WITH_NULL_NULL is specified and is the initial state of a
  9.    TLS connection during the first handshake on that channel, but MUST
  10.    NOT be negotiated, as it provides no more protection than an
  11.    unsecured connection.
  12.  
  13.       CipherSuite TLS_NULL_WITH_NULL_NULL               = { 0x00,0x00 };
  14.  
  15.    The following CipherSuite definitions require that the server provide
  16.    an RSA certificate that can be used for key exchange.  The server may
  17.    request any signature-capable certificate in the certificate request
  18.    message.
  19.  
  20.       CipherSuite TLS_RSA_WITH_NULL_MD5                 = { 0x00,0x01 };
  21.       CipherSuite TLS_RSA_WITH_NULL_SHA                 = { 0x00,0x02 };
  22.       CipherSuite TLS_RSA_WITH_NULL_SHA256              = { 0x00,0x3B };
  23.       CipherSuite TLS_RSA_WITH_RC4_128_MD5              = { 0x00,0x04 };
  24.       CipherSuite TLS_RSA_WITH_RC4_128_SHA              = { 0x00,0x05 };
  25.       CipherSuite TLS_RSA_WITH_3DES_EDE_CBC_SHA         = { 0x00,0x0A };
  26.       CipherSuite TLS_RSA_WITH_AES_128_CBC_SHA          = { 0x00,0x2F };
  27.       CipherSuite TLS_RSA_WITH_AES_256_CBC_SHA          = { 0x00,0x35 };
  28.       CipherSuite TLS_RSA_WITH_AES_128_CBC_SHA256       = { 0x00,0x3C };
  29.       CipherSuite TLS_RSA_WITH_AES_256_CBC_SHA256       = { 0x00,0x3D };
  30.  
  31.    The following cipher suite definitions are used for server-
  32.    authenticated (and optionally client-authenticated) Diffie-Hellman.
  33.    DH denotes cipher suites in which the server's certificate contains
  34.    the Diffie-Hellman parameters signed by the certificate authority
  35.    (CA).  DHE denotes ephemeral Diffie-Hellman, where the Diffie-Hellman
  36.    parameters are signed by a signature-capable certificate, which has
  37.    been signed by the CA.  The signing algorithm used by the server is
  38.    specified after the DHE component of the CipherSuite name.  The
  39.    server can request any signature-capable certificate from the client
  40.    for client authentication, or it may request a Diffie-Hellman
  41.    certificate.  Any Diffie-Hellman certificate provided by the client
  42.    must use the parameters (group and generator) described by the
  43.    server.
  44.  
  45. Dierks & Rescorla           Standards Track                    [Page 75]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.       CipherSuite TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA      = { 0x00,0x0D };
  4.       CipherSuite TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA      = { 0x00,0x10 };
  5.       CipherSuite TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA     = { 0x00,0x13 };
  6.       CipherSuite TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA     = { 0x00,0x16 };
  7.       CipherSuite TLS_DH_DSS_WITH_AES_128_CBC_SHA       = { 0x00,0x30 };
  8.       CipherSuite TLS_DH_RSA_WITH_AES_128_CBC_SHA       = { 0x00,0x31 };
  9.       CipherSuite TLS_DHE_DSS_WITH_AES_128_CBC_SHA      = { 0x00,0x32 };
  10.       CipherSuite TLS_DHE_RSA_WITH_AES_128_CBC_SHA      = { 0x00,0x33 };
  11.       CipherSuite TLS_DH_DSS_WITH_AES_256_CBC_SHA       = { 0x00,0x36 };
  12.       CipherSuite TLS_DH_RSA_WITH_AES_256_CBC_SHA       = { 0x00,0x37 };
  13.       CipherSuite TLS_DHE_DSS_WITH_AES_256_CBC_SHA      = { 0x00,0x38 };
  14.       CipherSuite TLS_DHE_RSA_WITH_AES_256_CBC_SHA      = { 0x00,0x39 };
  15.       CipherSuite TLS_DH_DSS_WITH_AES_128_CBC_SHA256    = { 0x00,0x3E };
  16.       CipherSuite TLS_DH_RSA_WITH_AES_128_CBC_SHA256    = { 0x00,0x3F };
  17.       CipherSuite TLS_DHE_DSS_WITH_AES_128_CBC_SHA256   = { 0x00,0x40 };
  18.       CipherSuite TLS_DHE_RSA_WITH_AES_128_CBC_SHA256   = { 0x00,0x67 };
  19.       CipherSuite TLS_DH_DSS_WITH_AES_256_CBC_SHA256    = { 0x00,0x68 };
  20.       CipherSuite TLS_DH_RSA_WITH_AES_256_CBC_SHA256    = { 0x00,0x69 };
  21.       CipherSuite TLS_DHE_DSS_WITH_AES_256_CBC_SHA256   = { 0x00,0x6A };
  22.       CipherSuite TLS_DHE_RSA_WITH_AES_256_CBC_SHA256   = { 0x00,0x6B };
  23.  
  24.    The following cipher suites are used for completely anonymous
  25.    Diffie-Hellman communications in which neither party is
  26.    authenticated.  Note that this mode is vulnerable to man-in-the-
  27.    middle attacks.  Using this mode therefore is of limited use: These
  28.    cipher suites MUST NOT be used by TLS 1.2 implementations unless the
  29.    application layer has specifically requested to allow anonymous key
  30.    exchange.  (Anonymous key exchange may sometimes be acceptable, for
  31.    example, to support opportunistic encryption when no set-up for
  32.    authentication is in place, or when TLS is used as part of more
  33.    complex security protocols that have other means to ensure
  34.    authentication.)
  35.  
  36.       CipherSuite TLS_DH_anon_WITH_RC4_128_MD5          = { 0x00,0x18 };
  37.       CipherSuite TLS_DH_anon_WITH_3DES_EDE_CBC_SHA     = { 0x00,0x1B };
  38.       CipherSuite TLS_DH_anon_WITH_AES_128_CBC_SHA      = { 0x00,0x34 };
  39.       CipherSuite TLS_DH_anon_WITH_AES_256_CBC_SHA      = { 0x00,0x3A };
  40.       CipherSuite TLS_DH_anon_WITH_AES_128_CBC_SHA256   = { 0x00,0x6C };
  41.       CipherSuite TLS_DH_anon_WITH_AES_256_CBC_SHA256   = { 0x00,0x6D };
  42.  
  43.    Note that using non-anonymous key exchange without actually verifying
  44.    the key exchange is essentially equivalent to anonymous key exchange,
  45.    and the same precautions apply.  While non-anonymous key exchange
  46.    will generally involve a higher computational and communicational
  47.    cost than anonymous key exchange, it may be in the interest of
  48.    interoperability not to disable non-anonymous key exchange when the
  49.    application layer is allowing anonymous key exchange.
  50.  
  51. Dierks & Rescorla           Standards Track                    [Page 76]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    New cipher suite values have been assigned by IANA as described in
  4.    Section 12.
  5.  
  6.    Note: The cipher suite values { 0x00, 0x1C } and { 0x00, 0x1D } are
  7.    reserved to avoid collision with Fortezza-based cipher suites in
  8.    SSL 3.

A.6. The Security Parameters

  1.  
  2.    These security parameters are determined by the TLS Handshake
  3.    Protocol and provided as parameters to the TLS record layer in order
  4.    to initialize a connection state.  SecurityParameters includes:
  5.  
  6.    enum { null(0), (255) } CompressionMethod;
  7.  
  8.    enum { server, client } ConnectionEnd;
  9.  
  10.    enum { tls_prf_sha256 } PRFAlgorithm;
  11.  
  12.    enum { null, rc4, 3des, aes } BulkCipherAlgorithm;
  13.  
  14.    enum { stream, block, aead } CipherType;
  15.  
  16.    enum { null, hmac_md5, hmac_sha1, hmac_sha256, hmac_sha384,
  17.      hmac_sha512} MACAlgorithm;
  18.  
  19.    /* Other values may be added to the algorithms specified in
  20.    CompressionMethod, PRFAlgorithm, BulkCipherAlgorithm, and
  21.    MACAlgorithm. */
  22.  
  23.    struct {
  24.        ConnectionEnd          entity;
  25.        PRFAlgorithm           prf_algorithm;
  26.        BulkCipherAlgorithm    bulk_cipher_algorithm;
  27.        CipherType             cipher_type;
  28.        uint8                  enc_key_length;
  29.        uint8                  block_length;
  30.        uint8                  fixed_iv_length;
  31.        uint8                  record_iv_length;
  32.        MACAlgorithm           mac_algorithm;
  33.        uint8                  mac_length;
  34.        uint8                  mac_key_length;
  35.        CompressionMethod      compression_algorithm;
  36.        opaque                 master_secret[48];
  37.        opaque                 client_random[32];
  38.        opaque                 server_random[32];
  39.    } SecurityParameters;
  40.  
  41. Dierks & Rescorla           Standards Track                    [Page 77]
  1. RFC 5246                          TLS                        August 2008

A.7. Changes to RFC 4492

  1.  
  2.    RFC 4492 [TLSECC] adds Elliptic Curve cipher suites to TLS.  This
  3.    document changes some of the structures used in that document.  This
  4.    section details the required changes for implementors of both RFC
  5.    4492 and TLS 1.2.  Implementors of TLS 1.2 who are not implementing
  6.    RFC 4492 do not need to read this section.
  7.  
  8.    This document adds a "signature_algorithm" field to the digitally-
  9.    signed element in order to identify the signature and digest
  10.    algorithms used to create a signature.  This change applies to
  11.    digital signatures formed using ECDSA as well, thus allowing ECDSA
  12.    signatures to be used with digest algorithms other than SHA-1,
  13.    provided such use is compatible with the certificate and any
  14.    restrictions imposed by future revisions of [PKIX].
  15.  
  16.    As described in Sections 7.4.2 and 7.4.6, the restrictions on the
  17.    signature algorithms used to sign certificates are no longer tied to
  18.    the cipher suite (when used by the server) or the
  19.    ClientCertificateType (when used by the client).  Thus, the
  20.    restrictions on the algorithm used to sign certificates specified in
  21.    Sections 2 and 3 of RFC 4492 are also relaxed.  As in this document,
  22.    the restrictions on the keys in the end-entity certificate remain.

Appendix B. Glossary

  1.  
  2.    Advanced Encryption Standard (AES)
  3.       AES [AES] is a widely used symmetric encryption algorithm.  AES is
  4.       a block cipher with a 128-, 192-, or 256-bit keys and a 16-byte
  5.       block size.  TLS currently only supports the 128- and 256-bit key
  6.       sizes.
  7.  
  8.    application protocol
  9.       An application protocol is a protocol that normally layers
  10.       directly on top of the transport layer (e.g., TCP/IP).  Examples
  11.       include HTTP, TELNET, FTP, and SMTP.
  12.  
  13.    asymmetric cipher
  14.       See public key cryptography.
  15.  
  16.    authenticated encryption with additional data (AEAD)
  17.       A symmetric encryption algorithm that simultaneously provides
  18.       confidentiality and message integrity.
  19.  
  20.    authentication
  21.       Authentication is the ability of one entity to determine the
  22.       identity of another entity.
  23.  
  24. Dierks & Rescorla           Standards Track                    [Page 78]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    block cipher
  4.       A block cipher is an algorithm that operates on plaintext in
  5.       groups of bits, called blocks.  64 bits was, and 128 bits is, a
  6.       common block size.
  7.  
  8.    bulk cipher
  9.       A symmetric encryption algorithm used to encrypt large quantities
  10.       of data.
  11.  
  12.    cipher block chaining (CBC)
  13.       CBC is a mode in which every plaintext block encrypted with a
  14.       block cipher is first exclusive-ORed with the previous ciphertext
  15.       block (or, in the case of the first block, with the initialization
  16.       vector).  For decryption, every block is first decrypted, then
  17.       exclusive-ORed with the previous ciphertext block (or IV).
  18.  
  19.    certificate
  20.       As part of the X.509 protocol (a.k.a. ISO Authentication
  21.       framework), certificates are assigned by a trusted Certificate
  22.       Authority and provide a strong binding between a party's identity
  23.       or some other attributes and its public key.
  24.  
  25.    client
  26.       The application entity that initiates a TLS connection to a
  27.       server.  This may or may not imply that the client initiated the
  28.       underlying transport connection.  The primary operational
  29.       difference between the server and client is that the server is
  30.       generally authenticated, while the client is only optionally
  31.       authenticated.
  32.  
  33.    client write key
  34.       The key used to encrypt data written by the client.
  35.  
  36.    client write MAC key
  37.       The secret data used to authenticate data written by the client.
  38.  
  39.    connection
  40.       A connection is a transport (in the OSI layering model definition)
  41.       that provides a suitable type of service.  For TLS, such
  42.       connections are peer-to-peer relationships.  The connections are
  43.       transient.  Every connection is associated with one session.
  44.  
  45.    Data Encryption Standard
  46.       DES [DES] still is a very widely used symmetric encryption
  47.       algorithm although it is considered as rather weak now.  DES is a
  48.       block cipher with a 56-bit key and an 8-byte block size.  Note
  49.       that in TLS, for key generation purposes, DES is treated as having
  50.       an 8-byte key length (64 bits), but it still only provides 56 bits
  51.  
  52. Dierks & Rescorla           Standards Track                    [Page 79]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.       of protection.  (The low bit of each key byte is presumed to be
  4.       set to produce odd parity in that key byte.)  DES can also be
  5.       operated in a mode [3DES] where three independent keys and three
  6.       encryptions are used for each block of data; this uses 168 bits of
  7.       key (24 bytes in the TLS key generation method) and provides the
  8.       equivalent of 112 bits of security.
  9.  
  10.    Digital Signature Standard (DSS)
  11.       A standard for digital signing, including the Digital Signing
  12.       Algorithm, approved by the National Institute of Standards and
  13.       Technology, defined in NIST FIPS PUB 186-2, "Digital Signature
  14.       Standard", published January 2000 by the U.S. Department of
  15.       Commerce [DSS].  A significant update [DSS-3] has been drafted and
  16.       was published in March 2006.
  17.  
  18.    digital signatures
  19.       Digital signatures utilize public key cryptography and one-way
  20.       hash functions to produce a signature of the data that can be
  21.       authenticated, and is difficult to forge or repudiate.
  22.  
  23.    handshake An initial negotiation between client and server that
  24.       establishes the parameters of their transactions.
  25.  
  26.    Initialization Vector (IV)
  27.       When a block cipher is used in CBC mode, the initialization vector
  28.       is exclusive-ORed with the first plaintext block prior to
  29.       encryption.
  30.  
  31.    Message Authentication Code (MAC)
  32.       A Message Authentication Code is a one-way hash computed from a
  33.       message and some secret data.  It is difficult to forge without
  34.       knowing the secret data.  Its purpose is to detect if the message
  35.       has been altered.
  36.  
  37.    master secret
  38.       Secure secret data used for generating encryption keys, MAC
  39.       secrets, and IVs.
  40.  
  41.    MD5
  42.       MD5 [MD5] is a hashing function that converts an arbitrarily long
  43.       data stream into a hash of fixed size (16 bytes).  Due to
  44.       significant progress in cryptanalysis, at the time of publication
  45.       of this document, MD5 no longer can be considered a 'secure'
  46.       hashing function.
  47.  
  48. Dierks & Rescorla           Standards Track                    [Page 80]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    public key cryptography
  4.       A class of cryptographic techniques employing two-key ciphers.
  5.       Messages encrypted with the public key can only be decrypted with
  6.       the associated private key.  Conversely, messages signed with the
  7.       private key can be verified with the public key.
  8.  
  9.    one-way hash function
  10.       A one-way transformation that converts an arbitrary amount of data
  11.       into a fixed-length hash.  It is computationally hard to reverse
  12.       the transformation or to find collisions.  MD5 and SHA are
  13.       examples of one-way hash functions.
  14.  
  15.    RC4
  16.       A stream cipher invented by Ron Rivest.  A compatible cipher is
  17.       described in [SCH].
  18.  
  19.    RSA
  20.       A very widely used public key algorithm that can be used for
  21.       either encryption or digital signing.  [RSA]
  22.  
  23.    server
  24.       The server is the application entity that responds to requests for
  25.       connections from clients.  See also "client".
  26.  
  27.    session
  28.       A TLS session is an association between a client and a server.
  29.       Sessions are created by the handshake protocol.  Sessions define a
  30.       set of cryptographic security parameters that can be shared among
  31.       multiple connections.  Sessions are used to avoid the expensive
  32.       negotiation of new security parameters for each connection.
  33.  
  34.    session identifier
  35.       A session identifier is a value generated by a server that
  36.       identifies a particular session.
  37.  
  38.    server write key
  39.       The key used to encrypt data written by the server.
  40.  
  41.    server write MAC key
  42.       The secret data used to authenticate data written by the server.
  43.  
  44.    SHA
  45.       The Secure Hash Algorithm [SHS] is defined in FIPS PUB 180-2.  It
  46.       produces a 20-byte output.  Note that all references to SHA
  47.       (without a numerical suffix) actually use the modified SHA-1
  48.       algorithm.
  49.  
  50. Dierks & Rescorla           Standards Track                    [Page 81]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    SHA-256
  4.       The 256-bit Secure Hash Algorithm is defined in FIPS PUB 180-2.
  5.       It produces a 32-byte output.
  6.  
  7.    SSL
  8.       Netscape's Secure Socket Layer protocol [SSL3].  TLS is based on
  9.       SSL Version 3.0.
  10.  
  11.    stream cipher
  12.       An encryption algorithm that converts a key into a
  13.       cryptographically strong keystream, which is then exclusive-ORed
  14.       with the plaintext.
  15.  
  16.    symmetric cipher
  17.       See bulk cipher.
  18.  
  19.    Transport Layer Security (TLS)
  20.       This protocol; also, the Transport Layer Security working group of
  21.       the Internet Engineering Task Force (IETF).  See "Working Group
  22.       Information" at the end of this document (see page 99).
  23.  
  24. Dierks & Rescorla           Standards Track                    [Page 82]
  1. RFC 5246                          TLS                        August 2008

Appendix C. Cipher Suite Definitions

  1.  
  2. Cipher Suite                            Key        Cipher         Mac
  3.                                         Exchange
  4.  
  5. TLS_NULL_WITH_NULL_NULL                 NULL         NULL         NULL
  6. TLS_RSA_WITH_NULL_MD5                   RSA          NULL         MD5
  7. TLS_RSA_WITH_NULL_SHA                   RSA          NULL         SHA
  8. TLS_RSA_WITH_NULL_SHA256                RSA          NULL         SHA256
  9. TLS_RSA_WITH_RC4_128_MD5                RSA          RC4_128      MD5
  10. TLS_RSA_WITH_RC4_128_SHA                RSA          RC4_128      SHA
  11. TLS_RSA_WITH_3DES_EDE_CBC_SHA           RSA          3DES_EDE_CBC SHA
  12. TLS_RSA_WITH_AES_128_CBC_SHA            RSA          AES_128_CBC  SHA
  13. TLS_RSA_WITH_AES_256_CBC_SHA            RSA          AES_256_CBC  SHA
  14. TLS_RSA_WITH_AES_128_CBC_SHA256         RSA          AES_128_CBC  SHA256
  15. TLS_RSA_WITH_AES_256_CBC_SHA256         RSA          AES_256_CBC  SHA256
  16. TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA        DH_DSS       3DES_EDE_CBC SHA
  17. TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA        DH_RSA       3DES_EDE_CBC SHA
  18. TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA       DHE_DSS      3DES_EDE_CBC SHA
  19. TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA       DHE_RSA      3DES_EDE_CBC SHA
  20. TLS_DH_anon_WITH_RC4_128_MD5            DH_anon      RC4_128      MD5
  21. TLS_DH_anon_WITH_3DES_EDE_CBC_SHA       DH_anon      3DES_EDE_CBC SHA
  22. TLS_DH_DSS_WITH_AES_128_CBC_SHA         DH_DSS       AES_128_CBC  SHA
  23. TLS_DH_RSA_WITH_AES_128_CBC_SHA         DH_RSA       AES_128_CBC  SHA
  24. TLS_DHE_DSS_WITH_AES_128_CBC_SHA        DHE_DSS      AES_128_CBC  SHA
  25. TLS_DHE_RSA_WITH_AES_128_CBC_SHA        DHE_RSA      AES_128_CBC  SHA
  26. TLS_DH_anon_WITH_AES_128_CBC_SHA        DH_anon      AES_128_CBC  SHA
  27. TLS_DH_DSS_WITH_AES_256_CBC_SHA         DH_DSS       AES_256_CBC  SHA
  28. TLS_DH_RSA_WITH_AES_256_CBC_SHA         DH_RSA       AES_256_CBC  SHA
  29. TLS_DHE_DSS_WITH_AES_256_CBC_SHA        DHE_DSS      AES_256_CBC  SHA
  30. TLS_DHE_RSA_WITH_AES_256_CBC_SHA        DHE_RSA      AES_256_CBC  SHA
  31. TLS_DH_anon_WITH_AES_256_CBC_SHA        DH_anon      AES_256_CBC  SHA
  32. TLS_DH_DSS_WITH_AES_128_CBC_SHA256      DH_DSS       AES_128_CBC  SHA256
  33. TLS_DH_RSA_WITH_AES_128_CBC_SHA256      DH_RSA       AES_128_CBC  SHA256
  34. TLS_DHE_DSS_WITH_AES_128_CBC_SHA256     DHE_DSS      AES_128_CBC  SHA256
  35. TLS_DHE_RSA_WITH_AES_128_CBC_SHA256     DHE_RSA      AES_128_CBC  SHA256
  36. TLS_DH_anon_WITH_AES_128_CBC_SHA256     DH_anon      AES_128_CBC  SHA256
  37. TLS_DH_DSS_WITH_AES_256_CBC_SHA256      DH_DSS       AES_256_CBC  SHA256
  38. TLS_DH_RSA_WITH_AES_256_CBC_SHA256      DH_RSA       AES_256_CBC  SHA256
  39. TLS_DHE_DSS_WITH_AES_256_CBC_SHA256     DHE_DSS      AES_256_CBC  SHA256
  40. TLS_DHE_RSA_WITH_AES_256_CBC_SHA256     DHE_RSA      AES_256_CBC  SHA256
  41. TLS_DH_anon_WITH_AES_256_CBC_SHA256     DH_anon      AES_256_CBC  SHA256
  42.  
  43. Dierks & Rescorla           Standards Track                    [Page 83]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.                         Key      IV   Block
  4. Cipher        Type    Material  Size  Size
  5. ------------  ------  --------  ----  -----
  6. NULL          Stream      0       0    N/A
  7. RC4_128       Stream     16       0    N/A
  8. 3DES_EDE_CBC  Block      24       8      8
  9. AES_128_CBC   Block      16      16     16
  10. AES_256_CBC   Block      32      16     16
  11.  
  12. MAC       Algorithm    mac_length  mac_key_length
  13. --------  -----------  ----------  --------------
  14. NULL      N/A              0             0
  15. MD5       HMAC-MD5        16            16
  16. SHA       HMAC-SHA1       20            20
  17. SHA256    HMAC-SHA256     32            32
  18.  
  19.    Type
  20.       Indicates whether this is a stream cipher or a block cipher
  21.       running in CBC mode.
  22.  
  23.    Key Material
  24.       The number of bytes from the key_block that are used for
  25.       generating the write keys.
  26.  
  27.    IV Size
  28.       The amount of data needed to be generated for the initialization
  29.       vector.  Zero for stream ciphers; equal to the block size for
  30.       block ciphers (this is equal to
  31.       SecurityParameters.record_iv_length).
  32.  
  33.    Block Size
  34.       The amount of data a block cipher enciphers in one chunk; a block
  35.       cipher running in CBC mode can only encrypt an even multiple of
  36.       its block size.
  37.  
  38. Dierks & Rescorla           Standards Track                    [Page 84]
  1. RFC 5246                          TLS                        August 2008

Appendix D. Implementation Notes

  1.  
  2.    The TLS protocol cannot prevent many common security mistakes.  This
  3.    section provides several recommendations to assist implementors.

D.1. Random Number Generation and Seeding

  1.  
  2.    TLS requires a cryptographically secure pseudorandom number generator
  3.    (PRNG).  Care must be taken in designing and seeding PRNGs.  PRNGs
  4.    based on secure hash operations, most notably SHA-1, are acceptable,
  5.    but cannot provide more security than the size of the random number
  6.    generator state.
  7.  
  8.    To estimate the amount of seed material being produced, add the
  9.    number of bits of unpredictable information in each seed byte.  For
  10.    example, keystroke timing values taken from a PC compatible's 18.2 Hz
  11.    timer provide 1 or 2 secure bits each, even though the total size of
  12.    the counter value is 16 bits or more.  Seeding a 128-bit PRNG would
  13.    thus require approximately 100 such timer values.
  14.  
  15.    [RANDOM] provides guidance on the generation of random values.

D.2. Certificates and Authentication

  1.  
  2.    Implementations are responsible for verifying the integrity of
  3.    certificates and should generally support certificate revocation
  4.    messages.  Certificates should always be verified to ensure proper
  5.    signing by a trusted Certificate Authority (CA).  The selection and
  6.    addition of trusted CAs should be done very carefully.  Users should
  7.    be able to view information about the certificate and root CA.

D.3. Cipher Suites

  1.  
  2.    TLS supports a range of key sizes and security levels, including some
  3.    that provide no or minimal security.  A proper implementation will
  4.    probably not support many cipher suites.  For instance, anonymous
  5.    Diffie-Hellman is strongly discouraged because it cannot prevent man-
  6.    in-the-middle attacks.  Applications should also enforce minimum and
  7.    maximum key sizes.  For example, certificate chains containing 512-
  8.    bit RSA keys or signatures are not appropriate for high-security
  9.    applications.

D.4. Implementation Pitfalls

  1.  
  2.    Implementation experience has shown that certain parts of earlier TLS
  3.    specifications are not easy to understand, and have been a source of
  4.    interoperability and security problems.  Many of these areas have
  5.  
  6. Dierks & Rescorla           Standards Track                    [Page 85]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    been clarified in this document, but this appendix contains a short
  4.    list of the most important things that require special attention from
  5.    implementors.
  6.  
  7.    TLS protocol issues:
  8.  
  9.    -  Do you correctly handle handshake messages that are fragmented to
  10.       multiple TLS records (see Section 6.2.1)? Including corner cases
  11.       like a ClientHello that is split to several small fragments? Do
  12.       you fragment handshake messages that exceed the maximum fragment
  13.       size? In particular, the certificate and certificate request
  14.       handshake messages can be large enough to require fragmentation.
  15.  
  16.    -  Do you ignore the TLS record layer version number in all TLS
  17.       records before ServerHello (see Appendix E.1)?
  18.  
  19.    -  Do you handle TLS extensions in ClientHello correctly, including
  20.       omitting the extensions field completely?
  21.  
  22.    -  Do you support renegotiation, both client and server initiated?
  23.       While renegotiation is an optional feature, supporting it is
  24.       highly recommended.
  25.  
  26.    -  When the server has requested a client certificate, but no
  27.       suitable certificate is available, do you correctly send an empty
  28.       Certificate message, instead of omitting the whole message (see
  29.       Section 7.4.6)?
  30.  
  31.    Cryptographic details:
  32.  
  33.    -  In the RSA-encrypted Premaster Secret, do you correctly send and
  34.       verify the version number? When an error is encountered, do you
  35.       continue the handshake to avoid the Bleichenbacher attack (see
  36.       Section 7.4.7.1)?
  37.  
  38.    -  What countermeasures do you use to prevent timing attacks against
  39.       RSA decryption and signing operations (see Section 7.4.7.1)?
  40.  
  41.    -  When verifying RSA signatures, do you accept both NULL and missing
  42.       parameters (see Section 4.7)? Do you verify that the RSA padding
  43.       doesn't have additional data after the hash value?  [FI06]
  44.  
  45.    -  When using Diffie-Hellman key exchange, do you correctly strip
  46.       leading zero bytes from the negotiated key (see Section 8.1.2)?
  47.  
  48.    -  Does your TLS client check that the Diffie-Hellman parameters sent
  49.       by the server are acceptable (see Section F.1.1.3)?
  50.  
  51. Dierks & Rescorla           Standards Track                    [Page 86]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    -  How do you generate unpredictable IVs for CBC mode ciphers (see
  4.       Section 6.2.3.2)?
  5.  
  6.    -  Do you accept long CBC mode padding (up to 255 bytes; see Section
  7.       6.2.3.2)?
  8.  
  9.    -  How do you address CBC mode timing attacks (Section 6.2.3.2)?
  10.  
  11.    -  Do you use a strong and, most importantly, properly seeded random
  12.       number generator (see Appendix D.1) for generating the premaster
  13.       secret (for RSA key exchange), Diffie-Hellman private values, the
  14.       DSA "k" parameter, and other security-critical values?

Appendix E. Backward Compatibility

E.1. Compatibility with TLS 1.0/1.1 and SSL 3.0

  1.  
  2.    Since there are various versions of TLS (1.0, 1.1, 1.2, and any
  3.    future versions) and SSL (2.0 and 3.0), means are needed to negotiate
  4.    the specific protocol version to use.  The TLS protocol provides a
  5.    built-in mechanism for version negotiation so as not to bother other
  6.    protocol components with the complexities of version selection.
  7.  
  8.    TLS versions 1.0, 1.1, and 1.2, and SSL 3.0 are very similar, and use
  9.    compatible ClientHello messages; thus, supporting all of them is
  10.    relatively easy.  Similarly, servers can easily handle clients trying
  11.    to use future versions of TLS as long as the ClientHello format
  12.    remains compatible, and the client supports the highest protocol
  13.    version available in the server.
  14.  
  15.    A TLS 1.2 client who wishes to negotiate with such older servers will
  16.    send a normal TLS 1.2 ClientHello, containing { 3, 3 } (TLS 1.2) in
  17.    ClientHello.client_version.  If the server does not support this
  18.    version, it will respond with a ServerHello containing an older
  19.    version number.  If the client agrees to use this version, the
  20.    negotiation will proceed as appropriate for the negotiated protocol.
  21.  
  22.    If the version chosen by the server is not supported by the client
  23.    (or not acceptable), the client MUST send a "protocol_version" alert
  24.    message and close the connection.
  25.  
  26.    If a TLS server receives a ClientHello containing a version number
  27.    greater than the highest version supported by the server, it MUST
  28.    reply according to the highest version supported by the server.
  29.  
  30.    A TLS server can also receive a ClientHello containing a version
  31.    number smaller than the highest supported version.  If the server
  32.    wishes to negotiate with old clients, it will proceed as appropriate
  33.  
  34. Dierks & Rescorla           Standards Track                    [Page 87]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    for the highest version supported by the server that is not greater
  4.    than ClientHello.client_version.  For example, if the server supports
  5.    TLS 1.0, 1.1, and 1.2, and client_version is TLS 1.0, the server will
  6.    proceed with a TLS 1.0 ServerHello.  If server supports (or is
  7.    willing to use) only versions greater than client_version, it MUST
  8.    send a "protocol_version" alert message and close the connection.
  9.  
  10.    Whenever a client already knows the highest protocol version known to
  11.    a server (for example, when resuming a session), it SHOULD initiate
  12.    the connection in that native protocol.
  13.  
  14.    Note: some server implementations are known to implement version
  15.    negotiation incorrectly.  For example, there are buggy TLS 1.0
  16.    servers that simply close the connection when the client offers a
  17.    version newer than TLS 1.0.  Also, it is known that some servers will
  18.    refuse the connection if any TLS extensions are included in
  19.    ClientHello.  Interoperability with such buggy servers is a complex
  20.    topic beyond the scope of this document, and may require multiple
  21.    connection attempts by the client.
  22.  
  23.    Earlier versions of the TLS specification were not fully clear on
  24.    what the record layer version number (TLSPlaintext.version) should
  25.    contain when sending ClientHello (i.e., before it is known which
  26.    version of the protocol will be employed).  Thus, TLS servers
  27.    compliant with this specification MUST accept any value {03,XX} as
  28.    the record layer version number for ClientHello.
  29.  
  30.    TLS clients that wish to negotiate with older servers MAY send any
  31.    value {03,XX} as the record layer version number.  Typical values
  32.    would be {03,00}, the lowest version number supported by the client,
  33.    and the value of ClientHello.client_version.  No single value will
  34.    guarantee interoperability with all old servers, but this is a
  35.    complex topic beyond the scope of this document.

E.2. Compatibility with SSL 2.0

  1.  
  2.    TLS 1.2 clients that wish to support SSL 2.0 servers MUST send
  3.    version 2.0 CLIENT-HELLO messages defined in [SSL2].  The message
  4.    MUST contain the same version number as would be used for ordinary
  5.    ClientHello, and MUST encode the supported TLS cipher suites in the
  6.    CIPHER-SPECS-DATA field as described below.
  7.  
  8.    Warning: The ability to send version 2.0 CLIENT-HELLO messages will
  9.    be phased out with all due haste, since the newer ClientHello format
  10.    provides better mechanisms for moving to newer versions and
  11.    negotiating extensions.  TLS 1.2 clients SHOULD NOT support SSL 2.0.
  12.  
  13. Dierks & Rescorla           Standards Track                    [Page 88]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    However, even TLS servers that do not support SSL 2.0 MAY accept
  4.    version 2.0 CLIENT-HELLO messages.  The message is presented below in
  5.    sufficient detail for TLS server implementors; the true definition is
  6.    still assumed to be [SSL2].
  7.  
  8.    For negotiation purposes, 2.0 CLIENT-HELLO is interpreted the same
  9.    way as a ClientHello with a "null" compression method and no
  10.    extensions.  Note that this message MUST be sent directly on the
  11.    wire, not wrapped as a TLS record.  For the purposes of calculating
  12.    Finished and CertificateVerify, the msg_length field is not
  13.    considered to be a part of the handshake message.
  14.  
  15.       uint8 V2CipherSpec[3];
  16.       struct {
  17.           uint16 msg_length;
  18.           uint8 msg_type;
  19.           Version version;
  20.           uint16 cipher_spec_length;
  21.           uint16 session_id_length;
  22.           uint16 challenge_length;
  23.           V2CipherSpec cipher_specs[V2ClientHello.cipher_spec_length];
  24.           opaque session_id[V2ClientHello.session_id_length];
  25.           opaque challenge[V2ClientHello.challenge_length;
  26.       } V2ClientHello;
  27.  
  28.    msg_length
  29.       The highest bit MUST be 1; the remaining bits contain the length
  30.       of the following data in bytes.
  31.  
  32.    msg_type
  33.       This field, in conjunction with the version field, identifies a
  34.       version 2 ClientHello message.  The value MUST be 1.
  35.  
  36.    version
  37.       Equal to ClientHello.client_version.
  38.  
  39.    cipher_spec_length
  40.       This field is the total length of the field cipher_specs.  It
  41.       cannot be zero and MUST be a multiple of the V2CipherSpec length
  42.       (3).
  43.  
  44.    session_id_length
  45.       This field MUST have a value of zero for a client that claims to
  46.       support TLS 1.2.
  47.  
  48. Dierks & Rescorla           Standards Track                    [Page 89]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    challenge_length
  4.       The length in bytes of the client's challenge to the server to
  5.       authenticate itself.  Historically, permissible values are between
  6.       16 and 32 bytes inclusive.  When using the SSLv2 backward-
  7.       compatible handshake the client SHOULD use a 32-byte challenge.
  8.  
  9.    cipher_specs
  10.       This is a list of all CipherSpecs the client is willing and able
  11.       to use.  In addition to the 2.0 cipher specs defined in [SSL2],
  12.       this includes the TLS cipher suites normally sent in
  13.       ClientHello.cipher_suites, with each cipher suite prefixed by a
  14.       zero byte.  For example, the TLS cipher suite {0x00,0x0A} would be
  15.       sent as {0x00,0x00,0x0A}.
  16.  
  17.    session_id
  18.       This field MUST be empty.
  19.  
  20.    challenge
  21.       Corresponds to ClientHello.random.  If the challenge length is
  22.       less than 32, the TLS server will pad the data with leading (note:
  23.       not trailing) zero bytes to make it 32 bytes long.
  24.  
  25.    Note: Requests to resume a TLS session MUST use a TLS client hello.

E.3. Avoiding Man-in-the-Middle Version Rollback

  1.  
  2.    When TLS clients fall back to Version 2.0 compatibility mode, they
  3.    MUST use special PKCS#1 block formatting.  This is done so that TLS
  4.    servers will reject Version 2.0 sessions with TLS-capable clients.
  5.  
  6.    When a client negotiates SSL 2.0 but also supports TLS, it MUST set
  7.    the right-hand (least-significant) 8 random bytes of the PKCS padding
  8.    (not including the terminal null of the padding) for the RSA
  9.    encryption of the ENCRYPTED-KEY-DATA field of the CLIENT-MASTER-KEY
  10.    to 0x03 (the other padding bytes are random).
  11.  
  12.    When a TLS-capable server negotiates SSL 2.0 it SHOULD, after
  13.    decrypting the ENCRYPTED-KEY-DATA field, check that these 8 padding
  14.    bytes are 0x03.  If they are not, the server SHOULD generate a random
  15.    value for SECRET-KEY-DATA, and continue the handshake (which will
  16.    eventually fail since the keys will not match).  Note that reporting
  17.    the error situation to the client could make the server vulnerable to
  18.    attacks described in [BLEI].
  19.  
  20. Dierks & Rescorla           Standards Track                    [Page 90]
  1. RFC 5246                          TLS                        August 2008

Appendix F. Security Analysis

  1.  
  2.    The TLS protocol is designed to establish a secure connection between
  3.    a client and a server communicating over an insecure channel.  This
  4.    document makes several traditional assumptions, including that
  5.    attackers have substantial computational resources and cannot obtain
  6.    secret information from sources outside the protocol.  Attackers are
  7.    assumed to have the ability to capture, modify, delete, replay, and
  8.    otherwise tamper with messages sent over the communication channel.
  9.    This appendix outlines how TLS has been designed to resist a variety
  10.    of attacks.

F.1. Handshake Protocol

  1.  
  2.    The handshake protocol is responsible for selecting a cipher spec and
  3.    generating a master secret, which together comprise the primary
  4.    cryptographic parameters associated with a secure session.  The
  5.    handshake protocol can also optionally authenticate parties who have
  6.    certificates signed by a trusted certificate authority.

F.1.1. Authentication and Key Exchange

  1.  
  2.    TLS supports three authentication modes: authentication of both
  3.    parties, server authentication with an unauthenticated client, and
  4.    total anonymity.  Whenever the server is authenticated, the channel
  5.    is secure against man-in-the-middle attacks, but completely anonymous
  6.    sessions are inherently vulnerable to such attacks.  Anonymous
  7.    servers cannot authenticate clients.  If the server is authenticated,
  8.    its certificate message must provide a valid certificate chain
  9.    leading to an acceptable certificate authority.  Similarly,
  10.    authenticated clients must supply an acceptable certificate to the
  11.    server.  Each party is responsible for verifying that the other's
  12.    certificate is valid and has not expired or been revoked.
  13.  
  14.    The general goal of the key exchange process is to create a
  15.    pre_master_secret known to the communicating parties and not to
  16.    attackers.  The pre_master_secret will be used to generate the
  17.    master_secret (see Section 8.1).  The master_secret is required to
  18.    generate the Finished messages, encryption keys, and MAC keys (see
  19.    Sections 7.4.9 and 6.3).  By sending a correct Finished message,
  20.    parties thus prove that they know the correct pre_master_secret.
F.1.1.1. Anonymous Key Exchange
  1.  
  2.    Completely anonymous sessions can be established using Diffie-Hellman
  3.    for key exchange.  The server's public parameters are contained in
  4.    the server key exchange message, and the client's are sent in the
  5.  
  6. Dierks & Rescorla           Standards Track                    [Page 91]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    client key exchange message.  Eavesdroppers who do not know the
  4.    private values should not be able to find the Diffie-Hellman result
  5.    (i.e., the pre_master_secret).
  6.  
  7.    Warning: Completely anonymous connections only provide protection
  8.    against passive eavesdropping.  Unless an independent tamper-proof
  9.    channel is used to verify that the Finished messages were not
  10.    replaced by an attacker, server authentication is required in
  11.    environments where active man-in-the-middle attacks are a concern.
F.1.1.2. RSA Key Exchange and Authentication
  1.  
  2.    With RSA, key exchange and server authentication are combined.  The
  3.    public key is contained in the server's certificate.  Note that
  4.    compromise of the server's static RSA key results in a loss of
  5.    confidentiality for all sessions protected under that static key.
  6.    TLS users desiring Perfect Forward Secrecy should use DHE cipher
  7.    suites.  The damage done by exposure of a private key can be limited
  8.    by changing one's private key (and certificate) frequently.
  9.  
  10.    After verifying the server's certificate, the client encrypts a
  11.    pre_master_secret with the server's public key.  By successfully
  12.    decoding the pre_master_secret and producing a correct Finished
  13.    message, the server demonstrates that it knows the private key
  14.    corresponding to the server certificate.
  15.  
  16.    When RSA is used for key exchange, clients are authenticated using
  17.    the certificate verify message (see Section 7.4.8).  The client signs
  18.    a value derived from all preceding handshake messages.  These
  19.    handshake messages include the server certificate, which binds the
  20.    signature to the server, and ServerHello.random, which binds the
  21.    signature to the current handshake process.
F.1.1.3. Diffie-Hellman Key Exchange with Authentication
  1.  
  2.    When Diffie-Hellman key exchange is used, the server can either
  3.    supply a certificate containing fixed Diffie-Hellman parameters or
  4.    use the server key exchange message to send a set of temporary
  5.    Diffie-Hellman parameters signed with a DSA or RSA certificate.
  6.    Temporary parameters are hashed with the hello.random values before
  7.    signing to ensure that attackers do not replay old parameters.  In
  8.    either case, the client can verify the certificate or signature to
  9.    ensure that the parameters belong to the server.
  10.  
  11.    If the client has a certificate containing fixed Diffie-Hellman
  12.    parameters, its certificate contains the information required to
  13.    complete the key exchange.  Note that in this case the client and
  14.    server will generate the same Diffie-Hellman result (i.e.,
  15.  
  16. Dierks & Rescorla           Standards Track                    [Page 92]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    pre_master_secret) every time they communicate.  To prevent the
  4.    pre_master_secret from staying in memory any longer than necessary,
  5.    it should be converted into the master_secret as soon as possible.
  6.    Client Diffie-Hellman parameters must be compatible with those
  7.    supplied by the server for the key exchange to work.
  8.  
  9.    If the client has a standard DSA or RSA certificate or is
  10.    unauthenticated, it sends a set of temporary parameters to the server
  11.    in the client key exchange message, then optionally uses a
  12.    certificate verify message to authenticate itself.
  13.  
  14.    If the same DH keypair is to be used for multiple handshakes, either
  15.    because the client or server has a certificate containing a fixed DH
  16.    keypair or because the server is reusing DH keys, care must be taken
  17.    to prevent small subgroup attacks.  Implementations SHOULD follow the
  18.    guidelines found in [SUBGROUP].
  19.  
  20.    Small subgroup attacks are most easily avoided by using one of the
  21.    DHE cipher suites and generating a fresh DH private key (X) for each
  22.    handshake.  If a suitable base (such as 2) is chosen, g^X mod p can
  23.    be computed very quickly; therefore, the performance cost is
  24.    minimized.  Additionally, using a fresh key for each handshake
  25.    provides Perfect Forward Secrecy.  Implementations SHOULD generate a
  26.    new X for each handshake when using DHE cipher suites.
  27.  
  28.    Because TLS allows the server to provide arbitrary DH groups, the
  29.    client should verify that the DH group is of suitable size as defined
  30.    by local policy.  The client SHOULD also verify that the DH public
  31.    exponent appears to be of adequate size.  [KEYSIZ] provides a useful
  32.    guide to the strength of various group sizes.  The server MAY choose
  33.    to assist the client by providing a known group, such as those
  34.    defined in [IKEALG] or [MODP].  These can be verified by simple
  35.    comparison.

F.1.2. Version Rollback Attacks

  1.  
  2.    Because TLS includes substantial improvements over SSL Version 2.0,
  3.    attackers may try to make TLS-capable clients and servers fall back
  4.    to Version 2.0.  This attack can occur if (and only if) two TLS-
  5.    capable parties use an SSL 2.0 handshake.
  6.  
  7.    Although the solution using non-random PKCS #1 block type 2 message
  8.    padding is inelegant, it provides a reasonably secure way for Version
  9.    3.0 servers to detect the attack.  This solution is not secure
  10.    against attackers who can brute-force the key and substitute a new
  11.    ENCRYPTED-KEY-DATA message containing the same key (but with normal
  12.    padding) before the application-specified wait threshold has expired.
  13.    Altering the padding of the least-significant 8 bytes of the PKCS
  14.  
  15. Dierks & Rescorla           Standards Track                    [Page 93]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    padding does not impact security for the size of the signed hashes
  4.    and RSA key lengths used in the protocol, since this is essentially
  5.    equivalent to increasing the input block size by 8 bytes.

F.1.3. Detecting Attacks Against the Handshake Protocol

  1.  
  2.    An attacker might try to influence the handshake exchange to make the
  3.    parties select different encryption algorithms than they would
  4.    normally choose.
  5.  
  6.    For this attack, an attacker must actively change one or more
  7.    handshake messages.  If this occurs, the client and server will
  8.    compute different values for the handshake message hashes.  As a
  9.    result, the parties will not accept each others' Finished messages.
  10.    Without the master_secret, the attacker cannot repair the Finished
  11.    messages, so the attack will be discovered.

F.1.4. Resuming Sessions

  1.  
  2.    When a connection is established by resuming a session, new
  3.    ClientHello.random and ServerHello.random values are hashed with the
  4.    session's master_secret.  Provided that the master_secret has not
  5.    been compromised and that the secure hash operations used to produce
  6.    the encryption keys and MAC keys are secure, the connection should be
  7.    secure and effectively independent from previous connections.
  8.    Attackers cannot use known encryption keys or MAC secrets to
  9.    compromise the master_secret without breaking the secure hash
  10.    operations.
  11.  
  12.    Sessions cannot be resumed unless both the client and server agree.
  13.    If either party suspects that the session may have been compromised,
  14.    or that certificates may have expired or been revoked, it should
  15.    force a full handshake.  An upper limit of 24 hours is suggested for
  16.    session ID lifetimes, since an attacker who obtains a master_secret
  17.    may be able to impersonate the compromised party until the
  18.    corresponding session ID is retired.  Applications that may be run in
  19.    relatively insecure environments should not write session IDs to
  20.    stable storage.

F.2. Protecting Application Data

  1.  
  2.    The master_secret is hashed with the ClientHello.random and
  3.    ServerHello.random to produce unique data encryption keys and MAC
  4.    secrets for each connection.
  5.  
  6.    Outgoing data is protected with a MAC before transmission.  To
  7.    prevent message replay or modification attacks, the MAC is computed
  8.    from the MAC key, the sequence number, the message length, the
  9.  
  10. Dierks & Rescorla           Standards Track                    [Page 94]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    message contents, and two fixed character strings.  The message type
  4.    field is necessary to ensure that messages intended for one TLS
  5.    record layer client are not redirected to another.  The sequence
  6.    number ensures that attempts to delete or reorder messages will be
  7.    detected.  Since sequence numbers are 64 bits long, they should never
  8.    overflow.  Messages from one party cannot be inserted into the
  9.    other's output, since they use independent MAC keys.  Similarly, the
  10.    server write and client write keys are independent, so stream cipher
  11.    keys are used only once.
  12.  
  13.    If an attacker does break an encryption key, all messages encrypted
  14.    with it can be read.  Similarly, compromise of a MAC key can make
  15.    message-modification attacks possible.  Because MACs are also
  16.    encrypted, message-alteration attacks generally require breaking the
  17.    encryption algorithm as well as the MAC.
  18.  
  19.    Note: MAC keys may be larger than encryption keys, so messages can
  20.    remain tamper resistant even if encryption keys are broken.

F.3. Explicit IVs

  1.  
  2.    [CBCATT] describes a chosen plaintext attack on TLS that depends on
  3.    knowing the IV for a record.  Previous versions of TLS [TLS1.0] used
  4.    the CBC residue of the previous record as the IV and therefore
  5.    enabled this attack.  This version uses an explicit IV in order to
  6.    protect against this attack.

F.4. Security of Composite Cipher Modes

  1.  
  2.    TLS secures transmitted application data via the use of symmetric
  3.    encryption and authentication functions defined in the negotiated
  4.    cipher suite.  The objective is to protect both the integrity and
  5.    confidentiality of the transmitted data from malicious actions by
  6.    active attackers in the network.  It turns out that the order in
  7.    which encryption and authentication functions are applied to the data
  8.    plays an important role for achieving this goal [ENCAUTH].
  9.  
  10.    The most robust method, called encrypt-then-authenticate, first
  11.    applies encryption to the data and then applies a MAC to the
  12.    ciphertext.  This method ensures that the integrity and
  13.    confidentiality goals are obtained with ANY pair of encryption and
  14.    MAC functions, provided that the former is secure against chosen
  15.    plaintext attacks and that the MAC is secure against chosen-message
  16.    attacks.  TLS uses another method, called authenticate-then-encrypt,
  17.    in which first a MAC is computed on the plaintext and then the
  18.    concatenation of plaintext and MAC is encrypted.  This method has
  19.    been proven secure for CERTAIN combinations of encryption functions
  20.    and MAC functions, but it is not guaranteed to be secure in general.
  21.  
  22. Dierks & Rescorla           Standards Track                    [Page 95]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    In particular, it has been shown that there exist perfectly secure
  4.    encryption functions (secure even in the information-theoretic sense)
  5.    that combined with any secure MAC function, fail to provide the
  6.    confidentiality goal against an active attack.  Therefore, new cipher
  7.    suites and operation modes adopted into TLS need to be analyzed under
  8.    the authenticate-then-encrypt method to verify that they achieve the
  9.    stated integrity and confidentiality goals.
  10.  
  11.    Currently, the security of the authenticate-then-encrypt method has
  12.    been proven for some important cases.  One is the case of stream
  13.    ciphers in which a computationally unpredictable pad of the length of
  14.    the message, plus the length of the MAC tag, is produced using a
  15.    pseudorandom generator and this pad is exclusive-ORed with the
  16.    concatenation of plaintext and MAC tag.  The other is the case of CBC
  17.    mode using a secure block cipher.  In this case, security can be
  18.    shown if one applies one CBC encryption pass to the concatenation of
  19.    plaintext and MAC and uses a new, independent, and unpredictable IV
  20.    for each new pair of plaintext and MAC.  In versions of TLS prior to
  21.    1.1, CBC mode was used properly EXCEPT that it used a predictable IV
  22.    in the form of the last block of the previous ciphertext.  This made
  23.    TLS open to chosen plaintext attacks.  This version of the protocol
  24.    is immune to those attacks.  For exact details in the encryption
  25.    modes proven secure, see [ENCAUTH].

F.5. Denial of Service

  1.  
  2.    TLS is susceptible to a number of denial-of-service (DoS) attacks.
  3.    In particular, an attacker who initiates a large number of TCP
  4.    connections can cause a server to consume large amounts of CPU for
  5.    doing RSA decryption.  However, because TLS is generally used over
  6.    TCP, it is difficult for the attacker to hide his point of origin if
  7.    proper TCP SYN randomization is used [SEQNUM] by the TCP stack.
  8.  
  9.    Because TLS runs over TCP, it is also susceptible to a number of DoS
  10.    attacks on individual connections.  In particular, attackers can
  11.    forge RSTs, thereby terminating connections, or forge partial TLS
  12.    records, thereby causing the connection to stall.  These attacks
  13.    cannot in general be defended against by a TCP-using protocol.
  14.    Implementors or users who are concerned with this class of attack
  15.    should use IPsec AH [AH] or ESP [ESP].

F.6. Final Notes

  1.  
  2.    For TLS to be able to provide a secure connection, both the client
  3.    and server systems, keys, and applications must be secure.  In
  4.    addition, the implementation must be free of security errors.
  5.  
  6. Dierks & Rescorla           Standards Track                    [Page 96]
  1. RFC 5246                          TLS                        August 2008
  2.  
  3.    The system is only as strong as the weakest key exchange and
  4.    authentication algorithm supported, and only trustworthy
  5.    cryptographic functions should be used.  Short public keys and
  6.    anonymous servers should be used with great caution.  Implementations
  7.    and users must be careful when deciding which certificates and
  8.    certificate authorities are acceptable; a dishonest certificate
  9.    authority can do tremendous damage.

Reference:

http://www.fenesky.com/blog/2014/07/19/how-https-works.html

http://www.fenesky.com/blog/2014/07/25/how-premaster-secret.html

http://www.fenesky.com/blog/2014/07/25/how-session-secret.html

https://www.openssl.org/

http://www.ruanyifeng.com/blog/2014/02/ssl_tls.html

https://tools.ietf.org/html/rfc5246

https://s.how/nginx-ssl/

http://www.ruanyifeng.com/blog/2011/02/seven_myths_about_https.html

https://tlswg.github.io/tls13-spec/

https那些事儿的更多相关文章

  1. HTTPS那些事儿(一)-HTTPS原理

    HTTPS那些事儿(一) 近期看了<http权威指南>的几个章节.对HTTPS有了部分了解,同一时候在网上查阅了一些资料,遂打算记录一下心得,写的仓促,肯定有非常多错误的地方.欢迎大家指正 ...

  2. HTTPS那个东西(一)-HTTPS原理

    HTTPS那个东西(一) 最近看了<http权威指南>几个章节,对HTTPS随着节,了一些资料,遂打算记录一下心得.写的仓促,肯定有非常多错误的地方,欢迎大家指正. 1.HTTP是什么 那 ...

  3. JSP和Servlet那些事儿系列--HTTPS

    原文:http://qingkangxu.iteye.com/blog/1614053 <JSP和Servlet那些事儿 >系列文章旨在阐述Servlet(Struts和Spring的MV ...

  4. Javascript中关于cookie的那些事儿

    Javascript-cookie 什么是cookie? 指某些网站为了辨别用户身份.进行session跟踪而储存在用户本地终端上的数据(通常经过加密).简单点来说就是:浏览器缓存. cookie由什 ...

  5. StartCom 申请 SSL 证书及 Nginx HTTPS 支持配置全攻略

    来源:https://www.williamyao.com/index.php/archives/1397/ 前言 最近收到 StartCom 的邮件,数字证书即将过期,想到去年在 StartSSL ...

  6. 从 HTTP 到 HTTPS - IIS 部署免费 HTTPS

    这篇文章首发于我的个人网站:听说 - https://tasaid.com/,建议在我的个人网站阅读,拥有更好的阅读体验. 这篇文章与 博客园 和 Segmentfault 共享. 前端开发QQ群:3 ...

  7. 结合个人经历总结的前端入门方法 (转自https://github.com/qiu-deqing/FE-learning)

    结合个人经历总结的前端入门方法 (https://github.com/qiu-deqing/FE-learning),里面有很详细的介绍. 之前一直想学习前端的,都不知道怎么下手都一年了啥也没学到, ...

  8. MVC之前的那点事儿系列（7）：WebActivator的实现原理详解

    文章内容 上篇文章,我们分析如何动态注册HttpModule的实现,本篇我们来分析一下通过上篇代码原理实现的WebActivator类库,WebActivator提供了3种功能,允许我们分别在Http ...

  9. JSP的那些事儿（2）---- DWR2.0 的配置和使用

    JSP的那些事儿(2)----DWR2.0 的配置和使用 分类: Web开发 JAVA 2009-04-23 15:43 999人阅读 评论(0) 收藏 举报 jspdwrjavascriptserv ...

随机推荐

  1. [安卓][转]internal(com.android.internal)和hidden(@hide)APIs简介及在应用程序中的调用方法

    转自:http://www.cnblogs.com/xirihanlin/archive/2011/06/05/2073118.html [引言]:我在做android softap的时候看到andr ...

  2. Android文件Apk下载变ZIP压缩包

    在azure云存储中 上传apk文件 使用ie下载 变成zip压缩包 解决方法 编辑 blob 属性和元数据 修改 内容类型 为 application/vnd.android.package-arc ...

  3. PHP ceil() 函数

    定义和用法 ceil() 函数向上舍入为最接近的整数. 语法 ceil(x) 参数 描述 x 必需.一个数. 说明 返回不小于 x 的下一个整数,x 如果有小数部分则进一位.ceil() 返回的类型仍 ...

  4. poj3356 dp

    //Accepted 4100 KB 0 ms //类似poj1080 //dp[i][j]表示s1用前i个,s2用前j个的最少匹配步数 //dp[i][j]=min(dp[i][j-1]+1,dp[ ...

  5. powershell命令大全

    Name Category Synopsis ---- -------- -------- ac Alias Add-Content asnp Alias Add-PSSnapin clc Alias ...

  6. (转)IOS之Info.plist文件简介

    原文:IOS之Info.plist文件简介 http://www.apkbus.com/android-130240-1-1.html (出处: Android开发论坛 - 安卓开发论坛 - Andr ...

  7. GSM Hacking：如何对GSM/GPRS网络测试进行测试

    写在前面 这里需要介绍的是GSM / GPRS网络测试的一些方法,随着现在硬件设备连网现象的普遍存在,例如智能电表.自动变速箱控制单元(TCU).POS机.报警系统等.这些设备通常需要与网络连接,GS ...

  8. 极客DIY：打造属于自己的无线移动渗透测试箱

    本文中介绍的工具.技术带有一定的攻击性,请合理合法使用. 你想不想拥有一款属于自己的移动无线渗透测试箱,如果你感兴趣,下面介绍的设备将会对你很有帮助.这个箱子被称为“MiTM(中间人攻击)WiFi箱” ...

  9. Interview----最长连续乘积字串

    题目描述: 给一个浮点数序列,取最大乘积连续子串的值,例如 -2.5,4,0,3,0.5,8,-1,则取出的最大乘积连续子串为3,0.5,8. 也就是说,上述数组中,3 0.5 8这3个数的乘积3*0 ...

  10. cocos2dx 搭建 android 平台 -2

    1.配置Cocos2d-x for Xcode. 这一块比较简单, 可以参见其他文章. 重点:install-templates-xcode.sh 2.配置普通Android开发环境 这一块包括JDK ...