Skip to content

Instantly share code, notes, and snippets.

@coin8086

coin8086/tls-in-a-nutshell.md

Last active November 2, 2024 11:46
Show Gist options
  • Save coin8086/1cd0411447066a5a02be6a3e493479e2 to your computer and use it in GitHub Desktop.
Save coin8086/1cd0411447066a5a02be6a3e493479e2 to your computer and use it in GitHub Desktop.
Download ZIP
TLS in a Nutshell
Raw
tls-in-a-nutshell.md

TLS in a Nutshell

TOC

  • What's TLS?
  • TLS Protocol
  • TLS Implementation

What's TLS?

TLS is Transport Layer Security. It provides communications security over a computer network. Some TLS applications:

  • HTTPS
  • SMTPS
  • …
  • Any protocol based on TCP can be secured by TLS.

TLS’ Properties

TLS has the following properties:

  • The connection is private (or secure) because symmetric cryptography is used to encrypt the data transmitted. The keys for this symmetric encryption are generated uniquely for each connection and are based on a shared secret that was negotiated at the start of the session.
  • The identity of the communicating parties can be authenticated using public-key cryptography. 
  • The connection is reliable because each message transmitted includes a message integrity check using a Message Authentication Code(MAC) to prevent undetected loss or alteration of the data during transmission.

TLS Protocol

The protocol defines

  • The Record format to be exchanged between a client and a server.
  • The Handshake procedure to setup a TLS session.

Record

TLS Record

TLS Record Content Type

TLS Version

Record(Handshake)

TLS Record Handshake

TLS Record Handshake Message Type

Record(ChangeCipherSpec)

TLS Record ChangeCipherSpec

Record(Application)

TLS Record Application

Handshake(TLS 1.0 ~ 1.2)

  1. Negotiation phase:
    • A client sends a ClientHello message specifying the highest TLS protocol version it supports, a random number, a list of suggested Cipher Suites and suggested compression methods. 
    • The server responds with a ServerHello message, containing the chosen protocol version, a random number, Cipher Suite and compression method from the choices offered by the client.
    • The server sends its Certificate message(depending on the selected cipher suite, this may be omitted by the server)
    • The server sends its ServerKeyExchange message (depending on the selected cipher suite, this may be omitted by the server)
    • The server sends a ServerHelloDone message, indicating it is done with handshake negotiation.
    • The client responds with a ClientKeyExchange message, which may contain a PreMasterSecret, public key, or nothing. (Again, this depends on the selected cipher.) This PreMasterSecret is encrypted using the public key of the server certificate.
    • The client and server then use the random numbers and PreMasterSecret to compute a common secret, called the "master secret".
  2. The client now sends a ChangeCipherSpec record, essentially telling the server, "Everything I tell you from now on will be authenticated (and encrypted if encryption parameters were present in the server certificate)."
  3. Finally, the server sends a ChangeCipherSpec.
  4. Application phase: at this point, the Handshake is complete and the application protocol is enabled, with content type of 23. 

Handshake: An Example

[INFO] [main] Enabling TLS...
[INFO] [SecureSocket::negotiate_as_server] received:
[MEM] 153 byte(s):
16 03 03 00 94 01 00 00 90 03 03 5F 69 CB 80 1D
34 1C 48 C6 C6 00 23 59 F7 93 29 79 DD 23 74 34
3C 82 6C 94 AC 0D 9A 1D 44 D4 DC 00 00 2A C0 2C
C0 2B C0 30 C0 2F 00 9F 00 9E C0 24 C0 23 C0 28
C0 27 C0 0A C0 09 C0 14 C0 13 00 9D 00 9C 00 3D
00 3C 00 35 00 2F 00 0A 01 00 00 3D 00 0A 00 08
00 06 00 1D 00 17 00 18 00 0B 00 02 01 00 00 0D
00 1A 00 18 08 04 08 05 08 06 04 01 05 01 02 01
04 03 05 03 02 03 02 02 06 01 06 03 00 23 00 00
00 17 00 00 FF 01 00 01 00
[INFO] [SecureSocket::negotiate_as_server] send:
[MEM] 1221 byte(s):
16 03 03 04 C0 02 00 00 51 03 03 5F 69 CB 80 12
DA EE EA C6 F5 34 39 44 2A 93 C4 DA A7 94 D5 93
7B 2F 4F 42 14 4D 1C A1 8A 57 50 20 CD 1F 00 00
2D 39 9C C3 5F 76 3F EB 45 3E AF B6 81 9C 2E D6
……
[INFO] [SecureSocket::negotiate_as_server] SEC_I_CONTINUE_NEEDED
[INFO] [SecureSocket::negotiate_as_server] received:
[MEM] 158 byte(s):
16 03 03 00 66 10 00 00 62 61 04 60 1E 36 D3 C2
09 19 BF 08 26 94 66 FC 04 20 E8 9C 56 5F 4F F5
A2 6C D9 4D DE E5 58 26 F1 6D B8 24 73 A1 D8 F5
83 EB F6 07 D6 8E B1 84 D1 20 62 3E 20 64 DA 27
29 AD 57 C8 B0 9C 52 AF 2B DE 28 65 37 59 CE EA
03 9D A8 D2 73 72 5E E6 DD DD CF 21 41 55 4C D7
1F D6 53 93 FE 4C A1 5D 3E 56 D9 14 03 03 00 01
01 16 03 03 00 28 00 00 00 00 00 00 00 00 79 D6
FE 3A EA 93 B5 38 32 BE 53 E0 75 6E E3 BE 69 42
42 9E DD 39 81 E3 93 E2 64 04 1F 60 FC 26
[INFO] [SecureSocket::negotiate_as_server] send:
[MEM] 51 byte(s):
14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00
00 00 00 86 DD AE 91 4E 02 3F 89 97 83 34 8D 81
9E 95 DB 6E DF 23 C8 46 04 6B D7 92 18 31 8A 61
38 1A 03
[INFO] [SecureSocket::negotiate_as_server] SEC_E_OK
[INFO] [main] TLS is enabled!

References

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment