Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cryptography > The transport layer security protocol (TLS) > Flashcards

The transport layer security protocol (TLS) Flashcards

1
Q

What is TLS?

A

Cryptographic services protocol based on Public Key Infrastructure (PKI)

Runs primarly over TCP

Consist of 3 higher-level protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is TLS often used for?

A

To allow browsers to establish secure sessions with web servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What 3 higher level protocols does TCP consist of?

A

TLS handshake protocol to set up session

TLS alert protocol to signal events such as failures

TLS change cipher spec protocol to change the cryptographic algorithms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the layers of the TLS: Protocol stack?

A

Handshake - Change cipher spec - alert - http or other

TLS record protocol

TCP

IP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does the TLS alert protocol do?

A

Handles connections by sending an “alert” message of various degrees of severity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the three types of alerts in the alert protocol?

A

Warning alerts

close_notify alert

fatal alerts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What can happen if we have improper handling of alert messages?

A

Truncation attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does the change cipher spec protocol do?

A

Normally used after handshake to indicate commencement of secure traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does TLS ciphersuites do?

A

Specify the public key algorithms used in handshake, and symmetric algo used in record protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Describe the TLS_RSA_WITH_3DES_EDE_CBC_SHA cipher suite

A

Key exchange uses RSA to encrypt a secret chosen by the client

Triple DES (enc-dec-enc) in CBC mode used for encryption

SHA-1 used for the HMAC for data integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What 2 services does the record protocol provide in TLS?

A

Message confidentiality: Ensure message content cannot be read in transit

Message integrity:Ensure receiver can detect if a message is modified in transit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How does the record protocol provide the 2 services?

A

A symmetric encryption algorithm and a MAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Describe the record protocol format

A

Header: Content type, major version, minor version, length

Plaintext (optionally compressed): encrypted

MAC (not a separate field if AEAD is used): encrypted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the Content Type field in the record protocol header?

A

Defines content types. The defined ones are:
- change-cipher-spec
- alert
- handshake
- application data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the length field in the record protocol header?

A

Length in octets of the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the operations of the record protocol (6)?

A

Fragmentation

Compression: optionally applied

Authenticated data

Plaintext: Compressed data and the MAC, if present

Session keys for MAC and encryption algorithms are established during handshake protocols

Encryption and MAC algorithms are specified in the negotiated ciphersuite

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is fragmentation in the record protocol?

A

Each application layer message is fragmented into blocks of 2^14 bytes or less

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is authenticated data in the record protocol?

A

Consist of the (compressed) data, header, and an implicit record sequence number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What crypto algorithms are used in the record protocol?

A

MAC: HMAC, SHA-2 allowed in TLS 1.2

Enc: Either a block in CBC, or stream cipher

AEAD: Allowed instead of enc and MAC in TLS 1.2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the purpose of the handshake protocol?

A

Negotiates the TLS version and crypto algos to be used

Establishes shared session key for use in record protocol

Auths server

Auths client (optional)

Completes session establishment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Name 4 versions of the TLS handshake

A

RSA variant (supported, but not recommended)

Diffie-Hellman (recommended)

Pre-shared key variant

Mutual authentication or server only authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the 4 phases of the TLS handshake protocol?

A

1: Initiates the logical connection and establishes its security capabilites

2 and 3: Performs key exchange with messages and message content depending on the handshake variant negotiated in phase 1

4: Completes the setting up of a secure connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What happens during phase 1 of the TLS handshake?

A

Client and server negotiates version, cipher suite and compression. Exchanges nonces

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What happens during phase 2 of the TLS handshake?

A

Server sends certificate and key exchange message (if it is needed)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What happens during phase 3 of the TLS handshake?

A

Client sends certificate and key exchange message

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What happens during phase 4 of the TLS handshake?

A

Client and server starts secure communications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

How does the RSA-based TLS handshake work?

A

The simplest variation has server-only authentication and the server has a public key suitable for RSA encryption

On completion of phase 1, assume that RSA-based key exchange has been selected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are the 5 main TLS handshake messages?

A

Client hello

Server hello

Server key exchange

Client key exchange

Change cipher spec

29
Q

What does the message “Client hello” do in the TLS handshake?

A

States highest TLS version available

Advertises ciphersuites available to the client

Sends client nonce Nc

30
Q

What does the message “Server hello” do in the TLS handshake?

A

Returns the selected TLS version and ciphersuite

Sends server nonce Ns

31
Q

What does the message “Server key exchange” do in the TLS handshake?

A

Server’s input to the key exchange

32
Q

What does the message “Client key exchange” do in the TLS handshake?

A

Client’s input to the key exchange

33
Q

What does the message “Change cipher spec” do in the TLS handshake?

A

Switch to newly negotiated ciphersuite for record layer

34
Q

What does the “Server key exchange” message do in the Ephemeral DH handshake variant?

A

DH generator, group parameters and the server ephemeral DH value is sent.

All of these values are signed by the server

35
Q

What does the “Client key exchange” message do in the Ephemeral DH handshake variant?

A

Send client ephemeral DH value.

This value is optionally signed by the client, if the client certificate is used

36
Q

What is the shared secret in the Ephemeral DH handshake variant?

A

Pre-master secret (pms)

37
Q

What type of secrecy does the Ephemeral DH handshake variant provide?

A

Forward secrecy

38
Q

What TLS variant is recommended today, and why?

A

The Ephemeral DH handshake variant, because it provides forward secrecy

39
Q

What does the “Server key exchange” message do in the RSA handshake variant?

A

The message is not used

40
Q

What does the “Client key exchange” message do in the RSA handshake variant?

A

Key transport of pre-master secret pms

The client selects a random pms

Client encrypts the pms with the servers public key and sends the ciphertext to the server

The server decrypts the pms using its private key

41
Q

Why is the RSA handshake version not recommended for use in TLS?

A

It does not provide forward secrecy

42
Q

How is the master secret defined in TLS?

A

ms = PRF(pms, “master secret”, Nc || Ns)

43
Q

In TLS how are keying material generated from the master key?

A

k = PRF(ms, “key expansion”, Ns || Nc)

44
Q

In TLS how are independent session keys generated?

A

They are partitioned from k in each direction.

Session keys consist of a read key and write key on each side.

45
Q

Give 3 examples of what keying material may include in TLS (these are dependent on the cipher suite)

A

Encryption key

MAC key

IV

46
Q

What is PRF in TLS?

A

Pseudo random function

47
Q

Describe the PRF in TLS?

A

Built from HMAC with a specified hash function.

TLS 1.0 and 1.1 uses a combination of MD5 and SHA1

TLS 1.2 uses SHA-2 in the PRF

48
Q

What are the inputs to the PRF function in TLS?

A

PRF(K, label, r)

K: Key
r: Nonce, possibly (?)

49
Q

When is static DH used in the TLS handshake, and when is the ephemeral DH used?

A

Static is used with certified keys.

If the client does not have a certificate, ephemeral is used

50
Q

What is the Anonymous DH variant of the TLS handshake? (DH_Anon)

A

The ephemeral DH keys are not signed.

This only protects against passive eavesdropping

51
Q

What is forward secrecy?

A

The property that a compromise of long-term keys should not lead to compromise of session keys established before the long-term key compromise took place.

52
Q

How can forward secrecy be provided in the TLS handshake?

A

Use DH key exchange with the exchange authenticated using signatures from the long-term keys

53
Q

What are a limitation with SSL and TLS?

A

There are multiple ways a man-in-the-middle attacker can attempt to make two entities drop down to the least secure version they support

This can be done if the attacker for example blocks access to the port a secure service runs on, or attempt to get the peers to negotiate an unauthenticated connection.

54
Q

What are the 2 main protocols of TLS?

A

Handshake protocol and Record layer protocol

55
Q

How does TLS assume reliable delivery of messages?

A

This is provided by TCP

56
Q

What is the BEAST attack?

A

Browser Exploit Against SSL/TLS

Exploits a non-standard use of IV in CBC mode. IVs are chained from previous ciphertexts

This attack allows an attacker to recover plaintext byte by byte

57
Q

What has been done to prevent the BEAST attack?

A

TLS 1.1: Only use random IVs

Browsers implement a mitigation strategy based on splitting plaintext into first byte + remainder to force a randomised IV including a MAC computation.

58
Q

What are the CRIME and BREACH attack based on?

A

Compression - different inputs results in different amounts of compression

59
Q

What is the CRIME attack?

A

Compression Ratio Info-leak Made Easy

Exploits compression in TLS

60
Q

What is the BREACH attack?

A

Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext

Exploits compression in HTTP

61
Q

How can you protect against the CRIME and BREACH attack?

A

Turn of compression in TLS

Switching it of in HTTP results in a big performance penalty

62
Q

What is a padding oracle?

A

The source of information about whether or not a message was correctly padded.

63
Q

How can the padding oracle attack be mitigated?

A

Using a uniform error response that does not give any information about whether or not the message was correctly padded.

This way, an attacker cannot distinguish between padding and MAC errors.

64
Q

What is the POODLE attack?

A

Padding Oracle On Downgraded Legacy Encryption

Forces downgrade to SSL 3.0 and then runs a padding oracle attack

65
Q

What is the Heartbleed bug?

A

Implementation error in OpenSSL

Based on missing bounds check in heartbeat messages.

Allows memory leak from server

66
Q

What did the Man-in-the-middle attacks on TLS do?

A

Rely on issuing a new certificate and installing a root certificate in the browser.

67
Q

What is the TLS timing (padding) oracle attack?

A

There is a subtle timing bug in the way that TLS data decryption works when using the standard CBC mode ciphersuite.

TLS first applies a MAC to the plaintext, then adds additional padding bytes to get the message length to be an even number of blocks. Then, the record is CBC-encrypted.

The important part is that the padding is not protected by the MAC.

Record structure:
Header - DATA - MAC - Padding

Because of this, the attacker can tamper with the padding by flipping specific bits in the ciphertext, leading to a padding oracle attack.

The attacker can re-transmit the record to the server. If the attacker learned whether the changes affected the padding, this information can be used to decrypt the whole record.

Researchers showed that a timing attack could be run instead, if error messages were not provided. This was caused by the decryption taking different amount of time when the padding was correct or not. This was due to the implementation first checking the padding and returning immediately if it was incorrect, without checking the MAC.

68
Q

Should you encrypt a message and then apply the MAC, or apply the MAC and then encrypt the message?

A

Encrypt, then apply the MAC to the resulting ciphertext

69
Q

Why is backward compatibility a problem in TLS?

A

Allows for downgrade attacks.

Cryptography (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions