Cryptography

and Network
Security
Sixth Edition
by William Stallings
 Chapter 17
Transport-Level Security
 Use your mentality
Wake up to reality

—From the song, “I’ve Got You Under

My Skin”,
by Cole Porter
Web Security Considerations
• The World Wide Web is fundamentally a client/server
application running over the Internet and TCP/IP intranets
• The following characteristics of Web usage suggest the need
for tailored security tools:
• Web servers are relatively easy to configure and manage
• Web content is increasingly easy to develop
• The underlying software is extraordinarily complex
• May hide many potential security flaws
• A Web server can be exploited as a launching pad into the
corporation’s or agency’s entire computer complex
• Casual and untrained (in security matters) users are common
clients for Web-based services
• Such users are not necessarily aware of the security
risks that exist and do not have the tools or
knowledge to take effective countermeasures
Table 17.1 A Comparison of Threats on the Web
 Secure Sockets Layer
(SSL)
• One of the most widely used security services

• A general purpose service implemented as a

set of protocols that rely on TCP
• Could be provided as part of the underlying
protocol suite and therefore be transparent to
applications
• Can be embedded in specific packages
 SSL Architecture
• Two important SSL concepts are:

• A transport that provides a suitable type of service

SSL • For SSL such connections are peer-to-peer relationships

• Connections are transient
• Every connection is associated with one session

connection
• An association between a client and a server
• Created by the Handshake Protocol

SSL session
• Define a set of cryptographic security parameters
which can be shared among multiple connections
• Are used to avoid the expensive negotiation of new
security parameters for each connection
A session state is defined by the following parameters:

Session Peer Compressio Cipher Master Is

identifier certificate n method spec secret resumable

Specifies the
bulk data
An arbitrary encryption
byte algorithm A flag
An X509.v3 The
sequence and a hash 48-byte indicating
certificate of algorithm
chosen by algorithm secret shared whether the
the peer; this used to
the server to used for MAC between the session can
element of compress
identify an calculation; client and the be used to
the state data prior to
active or also defines server initiate new
may be null encryption
resumable cryptographi connections
session state c attributes
such as the
hash_size
A connection state is defined by the following parameters:

Server and • Byte sequences that are chosen

• When a block cipher in CBC
client by the server and client for each mode is used, an initialization
connection
random vector (IV) is maintained for
each key
Initializatio • This field is first initialized by
Server • The secret key used in MAC n vectors the SSL Handshake Protocol
• The final ciphertext block from
write MAC operations on data sent by the
each record is preserved for
server
secret use as the IV with the
following record

Client • The secret key used in MAC

write MAC operations on data sent by the
client
secret • Each party maintains separate
sequence numbers for
transmitted and received
• The secret encryption key for
Server data encrypted by the server and
messages for each connection
• When a party sends or
write key decrypted by the client Sequence receives a change cipher spec
numbers message, the appropriate
sequence number is set to
zero
• The symmetric encryption key
Client for data encrypted by the client
• Sequence numbers may not
exceed 264 - 1
write key and decrypted by the server
SSL Record Protocol
The SSL Record
Protocol provides
two services for SSL
connections

Confidentiality Message integrity

The Handshake Protocol The Handshake Protocol

defines a shared secret key also defines a shared
that is used for secret key that is used to
conventional encryption of form a message
SSL payloads authentication code (MAC)
Table 17.2 SSL Handshake Protocol Message Types
Cryptographic Computations
• Two further items are of interest:
• The creation of a shared master secret by means of the key
exchange
• The shared master secret is a one-time 48-byte value generated for
this session by means of secure key exchange

• The generation of cryptographic parameters from the master

secret
• CipherSpecs require a client write MAC secret, a server write MAC
secret, a client write key, a server write key, a client write IV, and a
server write IV which are generated from the master secret in that
order
• These parameters are generated from the master secret by hashing the
master secret into a sequence of secure bytes of sufficient length for all
needed parameters
 Transport Layer Security
(TLS)
• An IETF standardization initiative whose goal is to produce an
Internet standard version of SSL
• Is defined as a Proposed Internet Standard in RFC 5246
• RFC 5246 is very similar to SSLv3
• Differences include:
• Version number
• Message Authentication Code
• Pseudorandom function
• Alert keys
• Cipher suites
• Client certificate types
• Certificate_verify and Finished Messages
• Cryptographic computations
• Padding
Message Authentication Code:
HMACK(M) = H[(K+ ⊕ opads } H[(K+ ⊕ ipads } M]]
where
H = embedded hash function (for TLS, either MD5 or
SHA-1s
M = message input to HMAC
K+ = secret key padded with zeros on the left so that
the result is equal to the block length of the hash
code (for MD5 and SHA-1, block length t 512 bits)
ipad = 00110110 (36 in hexadecimal) repeated 64
times (512 bits)
opad=01011100 (5C in hexadecimal) repeated 64
times (512 bits)
Alert Codes
 record_overflow:
 unknown_ca
 access_denied
 decode_error
 protocol_version:
 insufficient_security:
 internal_error:
 decrypt_error:
 user_canceled
 no_renegotiation
 HTTPS
(HTTP over SSL)
• Refers to the combination of HTTP and SSL to implement secure communication
between a Web browser and a Web server
• The HTTPS capability is built into all modern Web browsers

• A user of a Web browser will see URL addresses that begin with https:// rather than
http://
• If HTTPS is specified, port 443 is used, which invokes SSL

• Documented in RFC 2818, HTTP Over TLS

• There is no fundamental change in using HTTP over either SSL or TLS and both
implementations are referred to as HTTPS

• When HTTPS is used, the following elements of the communication are encrypted:
• URL of the requested document
• Contents of the document
• Contents of browser forms
• Cookies sent from browser to server and from server to browser
• Contents of HTTP header
 Connection Initiation
For HTTPS, the agent
There are three levels
acting as the HTTP
of awareness of a
client also acts as the
connection in HTTPS:
TLS client
At the HTTP level, an HTTP client requests a
The client initiates a connection to the server connection to an HTTP server by sending a
on the appropriate port and then sends the connection request to the next lowest layer
TLS ClientHello to begin the TLS handshake • Typically the next lowest layer is TCP, but is may also be
TLS/SSL

At the level of TLS, a session is established

between a TLS client and a TLS server
When the TLS handshake has finished, the • This session can support one or more connections at
client may then initiate the first HTTP request any time

A TLS request to establish a connection begins

All HTTP data is to be sent as TLS application with the establishment of a TCP connection
data between the TCP entity on the client side and
the TCP entity on the server side
 Connection Closure
• An HTTP client or server can indicate the closing of a connection
by including the line Connection: close in an HTTP record
• The closure of an HTTPS connection requires that TLS close the
connection with the peer TLS entity on the remote side, which
will involve closing the underlying TCP connection
• TLS implementations must initiate an exchange of closure alerts
before closing a connection
• A TLS implementation may, after sending a closure alert, close the
connection without waiting for the peer to send its closure alert,
generating an “incomplete close”

• An unannounced TCP closure could be evidence of some sort of

attack so the HTTPS client should issue some sort of security
warning when this occurs
 Secure Shell (SSH)
A protocol for secure
network communications
designed to be relatively
simple and inexpensive to
SSH client and server implement
applications are widely
available for most
operating systems The initial version, SSH1
• Has become the method was focused on
of choice for remote login providing a secure
and X tunneling remote logon facility to
• Is rapidly becoming one replace TELNET and
of the most pervasive other remote logon
applications for schemes that provided
encryption technology
outside of embedded no security
systems

SSH also provides a

SSH2 fixes a number of more general
security flaws in the client/server capability
original scheme and can be used for
• Is documented as a such network functions
proposed standard in IETF as file transfer and e-
RFCs 4250 through 4256
mail
Transport Layer Protocol
• Server authentication occurs at the transport layer, based
on the server possessing a public/private key pair
• A server may have multiple host keys using multiple
different asymmetric encryption algorithms
• Multiple hosts may share the same host key
• The server host key is used during key exchange to
authenticate the identity of the host
• RFC 4251 dictates two alternative trust models:
• The client has a local database that associates each host
name with the corresponding public host key
• The host name-to-key association is certified by a trusted
certification authority (CA); the client only knows the CA root
key and can verify the validity of all host keys certified by
accepted CAs
 Table 17.3

SSH

Transport

Layer

Cryptographic

Algorithms
* = Required
** = Recommended
 Authentication Methods
• Publickey
• The client sends a message to the server that contains the client’s public
key, with the message signed by the client’s private key
• When the server receives this message, it checks whether the supplied key
is acceptable for authentication and, if so, it checks whether the signature
is correct

• Password
• The client sends a message containing a plaintext password, which is
protected by encryption by the Transport Layer Protocol

• Hostbased
• Authentication is performed on the client’s host rather than the client itself
• This method works by having the client send a signature created with the
private key of the client host
• Rather than directly verifying the user’s identity, the SSH server verifies the
identity of the client host
 Connection Protocol
• The SSH Connection Protocol runs on top of the SSH Transport
Layer Protocol and assumes that a secure authentication
connection is in use
• The secure authentication connection, referred to as a tunnel, is used
by the Connection Protocol to multiplex a number of logical channels

• Channel mechanism
• All types of communication using SSH are supported using separate
channels
• Either side may open a channel
• For each channel, each side associates a unique channel number
• Channels are flow controlled using a window mechanism
• No data may be sent to a channel until a message is received to
indicate that window space is available
• The life of a channel progresses through three stages: opening a
channel, data transfer, and closing a channel
 Channel Types
Four channel types are recognized in the SSH Connection Protocol specification

Session
• The remote execution of a program
• The program may be a shell, an application such as file transfer or e-mail, a system
command, or some built-in subsystem
• Once a session channel is opened, subsequent requests are used to start the remote
program

X11
• Refers to the X Window System, a computer software system and network protocol that
provides a graphical user interface (GUI) for networked computers
• X allows applications to run on a network server but to be displayed on a desktop
machine

Forwarded-tcpip
• Remote port forwarding

Direct-tcpip
• Local port forwarding
 Port Forwarding
• One of the most useful features of SSH

• Provides the ability to convert any insecure TCP

connection into a secure SSH connection (also
referred to as SSH tunneling)
• Incoming TCP traffic is delivered to the
appropriate application on the basis of the port
number (a port is an identifier of a user of TCP)
• An application may employ multiple port numbers
 Summary
• Transport layer security
• Web security considerations
• Version number
• Web security threats
• Message authentication code
• Web traffic security
• Pseudorandom function
approaches
• Alert codes
• Secure sockets layer • Cipher suites
• SSL architecture • Client certificate types
• SSL record protocol • Certificate_verify and
• Change cipher spec protocol finished messages
• Alert protocol • Cryptographic computations
• Handshake protocol • Padding
• Cryptographic computations
• Secure shell (SSH)
• HTTPS • Transport layer protocol
• Connection initiation
• User authentication protocol
• Connection closure
• Communication protocol