TLS Protocol Quiz

Network Security

• The presentation covers Network Security, specifically Transport Level Security (TLS)
• It was presented by Prof. Dr. Torsten Braun at the University of Bern (18.11.2024 - 25.11.2024)

Transport Layer Security

• TLS is a protocol used for secure communication on the internet.

Table of Contents

• Introduction
• Transport Layer Security
• Datagram Transport Layer Security
• Hypertext Transfer Protocol Secure
• Secure Shell

Threats on the Web

• Integrity: Modification of user data, Trojan horse browsers, modification of memory, modification of message traffic
• Confidentiality: Eavesdropping on the network, theft of information from servers, theft of data from clients, info about network configuration, info about which client talks to server.
• Denial of Service: Killing of user threads, flooding machine with bogus requests, filling up disk or memory, isolating machine by DNS attacks
• Authentication: Impersonation of legitimate users, data forgery (misrepresentation)
• Consequences: Loss of information, machine compromise, vulnerability to other threats, loss of privacy
• Countermeasures: Cryptographic checksums, encryption, Web proxies, difficult to prevent

Web Traffic Security Approaches

• Network Level: HTTP, FTP, SMTP, TCP, IP/IPSec, IP
• Transport Level: HTTP, FTP, SMTP, TCP, SSL or TLS, IP
• Application Level: HTTP, FTP, SMTP, TCP, S/MIME, Kerberos, UDP, IP

Transport Layer Security (TLS) Overview

• Functions: Client and server authentication with public keys, sessions encrypted with symmetric keys, handshake protocol, certificate exchange, generation of a secret session key, record protocol (data exchange), fragmentation, compression and encryption
• Handshake Protocol: Authentication, key exchange,
• Record Protocol: Data exchange

TLS Protocol Stack

• IETF RFC 8446 defines TLS record protocol, providing basic security services
• Higher-layer protocols in TLS include Handshake Protocol, Change Cipher Spec Protocol, Alert Protocol, and Heartbeat Protocol
• These are all defined within the RFC 8446 standard

TLS Connections and Sessions

• Transport-layer connections are between two endpoints; peer-to-peer relationships—transient
• Every connection has one session
• A session is an association between a client and server, created by the Handshake Protocol
• Cryptographic Security Parameters defined
• session identifier
• peer certificate
• compression method

Session State

• Session Id: arbitrary byte sequence
• Peer certificate: X.509 certificate
• Compression method: algorithm
• Cipher Spec: specifies encryption and hash algorithms, and cryptographic attributes such as hash size.
• Resumable Flag: indicates whether a session can be used to initiate new connections.

Connection State

• Server and Client random: byte sequences chosen by client and server for each connection
• Server (Client) write MAC secret: secret keys used for MAC operations on data
• Server (Client) write key: the secret encryption key
• Initialisation Vectors: for block ciphers in CBC mode
• Sequence Numbers: separate numbers maintained for transmitted and received messages for each connection

Record Protocol Services

• Confidentiality: Handshake protocol defines a shared secret key used for conventional encryption of TLS payloads
• Message Integrity: Handshake protocol defines a shared secret key for forming a Message Authentication Code (MAC)

Record Protocol Operation

• Application Data, Fragment, Compress, Add MAC, Encrypt, Append TLS Record Header
• HMAC Algorithm (RFC 2104) - H[(K+⊕opad) || (K+⊕ipad) || M], where H is MD5 or SHA-1, and M is the message. K+ is the secret key padded with 0’s. ipad/opad are 36/5C repeated 64 times
• Encryption: AES-128/256, 3DES, or Stream Cipher (RC4-128).

Record Format

• Content Type: higher-layer protocol used to process the enclosed fragment.
• Major/Minor Version Numbers:
• Compressed Length (16 bits): length of plaintext fragment, or compressed if compressed, is (2^14 + 2048)
• MAC (0, 16 or 20 bytes)

Specific Protocols

• Change Cipher Spec Protocol: copies pending state into current state, to update the cipher suite used in a connection.
• Alert Protocol: conveys TLS-related alerts to the peer entity; levels are warning or fatal (immediate termination), code to indicate alert.

Handshake Protocol Messages

• hello_request, client_hello, server_hello, certificate, server_key_exchange, certificate_request, server_done, certificate_verify, client_key_exchange, finished.

Handshake Protocol Operation, Phase 1

• Client highest version understood, server lowest suggested; highest supported by server.
• Random structure: 32-bit timestamp, 28 bytes; used as nonces for key exchanges. Prevents replay attacks.
• Session ID: variable length; non-zero value indicates client wishes to update existing or create new conncetion; zero value means new conncetion.
• Cipher suites, compression methods

Handshake Protocol Operation, Phase 2

• Server authentication and key exchange
• Anonymous DH, 2 global DH values + server's public DH key, Ephemeral DH, RSA key exchange, temporary public/private RSA key pair.
• server_key_exchange

Handshake Protocol Operation, Phase 3

• Client authentication and key exchange. RSA 48-byte pre-master secret, encrypted using public key for second phase; Ephemeral/Anonymous DH parameters

Handshake Protocol Operation, Phase 4

• Client sends change cipher spec message. Copies pending state into current cipher spec; sends finished message to verify key exchange success.
• Server sends own change cipher spec message, transfers to current cipher spec; sends finished message.
• PRF is used, a function that generates the master secret values

Master Secret Creation

• Shared master secret: 48-byte value
• Stages 1 & 2: RSA and DH (Diffie-Hellman)
• master_secret - PRF(pre_master_secret, “master secret”, ClientHello.Random || ServerHello.Random)
• Cryptopgraphic parameters - MD5(master_secret, ServerHello.random, SHA("A" or "B" || master_secret || ClientHello.random))

TLS Pseudo-Random Function

• Generates pseudo-random key material from a seed value and a cryptographic secret key

Generation of Cryptographic Parameters

• Parameters generated from master secret by hashing, ordered by sufficient length for all parameters

Attacks

• Attacks on Handshake Protocol (e.g., compromising handshake, exploiting formatting)
• Attacks on Record and Application data Protocols (e.g., Browser Exploits, Chosen Plaintext Attack)
• Attacks on PKI (e.g., checking validity of X.509 certificates)

TLSv1.3

• TLSv1.3 removes several options & functions (e.g., compression and ciphers).
• Elliptic Curve DH for key exchange and doesn't permit RSA
• Encrypts all handshake messages after server_hello
• "1 round trip time" handshake order

Datagram Transport Layer Security (DTLS)

• DTLS is a protocol based on TLS, designed for UDP communication. DTLS is closely similar to TLS.
• Uses reliable transmission of handshakes and retransmission for communication

RSA Handshake

• Cookies prevent denial-of-service attacks by requiring a "cookie" from the server to demonstrate ability to handle packets

Hyper Text Transfer Protocol Secure (HTTPS)

• Secure version of HTTP; encrypts communications, provides encryption, data integrity, and authentication.
• Data sent using HTTPS

HTTPS Connection Initiation

• Agent acting as HTTP client also acts as a TLS client. Client initiates a connection, sends TLS client hello to begin TLS handshake.
• After handshake, client sends first HTTP request, all HTTP data sent as TLS application data.

HTTPS Connection Closure

• HTTP indicates closing of the connection; TLS protocol closes the connection with peer TLS entity, this involves closing underlying TCP connection.
• Use Alert Protocol to send close_notify alert to close connections appropriately

Secure Shell (SSH)

• Initial version provided secure remote logon facility. Replaced TELNET and similar protocols.
• SSH provided a more general client/server capability for applications like file transfer and e-mail.

SSH Protocol Stack

• User authentication protocol: authenticates client to server
• SSH Transport Layer Protocol: provides server authentication, confidentiality, integrity and optional compression.
• TCP: Reliable connection end-to-end delivery
• IP: Datagram delivery across multiple networks

SSH Transport Layer Protocol

• Server authentication based on public/private key pair. Server may have multiple host keys for different asymmetric encryption algorithms.
• Multiple hosts may use the same host key. Host key is used during key exchange.

SSH Packet Exchange

• TCP connection established, identification string exchange, algorithm negotiation, key exchange, end of key exchange, SSH messages exchanged, service request.

SSH Cryptographic Algorithms

• Lists various cryptographic algorithms including 3DES, Blowfish, Twofish, AES, Serpent, RC4, and CAST-128. Also lists MAC algorithms and compression algorithms.

SSH Key Generation

• Encryption and MAC keys are generated from shared secret key (K), which comes from DH key exchange, calculated from hash value (H). Session identifier equal to H
• Subsequent key exchange occurs after initial key exchange.

SSH User Authentication Protocol

• Client sends SSH_MSG_USERAUTH_REQUEST with method specified; server validates the user name; responds with SSH_MSG_USERAUTH_FAILURE if validation fails; returns a list of authentication methods used

SSH Authentication Methods

• Public Key: client sends a message containing public key, signed by the client's private key. The server verifies the key (client's public key is acceptable for authentication) and signature
• Password: Client sends a password that's protected by encryption. Authentication on Host-based (client's host, not its client)