Transport Layer Security

Transport Layer Security
An Introduction

Prof. David Bernstein
James Madison University

Computer Science Department

bernstdh@jmu.edu

Overview

History

Handshaking

Establish Security Capabilities:
- Client sends timestamp, pseudo-random number, supported cipher and compression suites
- Server responds wih timestamp, pseudo-random number, selected cipher and compression algorithms
Server Authentication and Key Exchange:
- Optional: Server sends certificate
- Optional: Server sends key
- Optional: Server requests certificate
Client Authentication and Key Exchange:
- Optional: Client responds with certificate
- Client sends key
- Optional: Client sends verification of identity
Finish

Overhead

Handshake Phase:
- Encryption on client (using the server's public key)
- Decryption on server (using the server's private key)
- Clients waiting on servers
Data Transfer Phase:
- Symmetric key encryption

Overhead (cont.)

TCP over TLS can take 2-10 times as long as raw TCP!

Session State Information (Partial List)

Connection State Information (Partial List)

Records

Popular Applications