TLS Protocol

Question 1

Static vs ephermeral DH

Answer 1

static DH: always use same private DH key
EDH: use new private DH key for every new connection -> forward security
Same for ECDH and ECDHE

Question 2

RSA authentication

Answer 2

1. client checks validity of certificate (follow cert. chain to root of trust)
2. Use public key extracted from cert to auth the private-key-signed message
3. encrypt the premastersecret with the public key –> only the server knowing the private key can decrypt it.

Question 3

FRAGE: Replay attack knowing nonce

Answer 3

Cannot decrypt message, but replay to trigger non idempotent operations (like transferring money)

Question 4

explain aufbau cipher TLS_DH_WITH_AES_256_CBC_SHA

Answer 4

DH: Key exchange
AES_256_CBC: encryption
SHA: MAC

Question 5

Problematic ciphers Key exhange

Answer 5

DH, DH_anon, ECDH -> no forward secrecy, no auth

RSA-> no forward secrecy

Question 6

Problematic ciphers encryption

Answer 6

Block ciphers are ill advised: CBC: padding oracle attack: POODLE
DES: not secure

Question 7

Problematic MAC algo

Answer 7

SHA: not collision resistant
MD5: broken

Question 8

Role of ClientFinished / ServerFinished

Answer 8

ClientFinished= PRF(ms, transcript) used to compare views of the protocol, prevents downgrade attacks

Question 9

Role of nonce in client Hello

Answer 9

used to prevent replay attack. attacker that can guess the nonce can replay a handshake with the same nonce

Question 10

Main Goals of TLS Handshake

Answer 10

1. Protects negotiation of all cryptographic parameters (TLS version number, algorithms etc)
2. Provides Authentication of server (usually) / client (rarely)
3. Establish keys used in record protocol -> mastersecret and derive all other keys from that

Question 11

Draw RSA vs DH based key establishement protocol

Answer 11

slides 03-tls 14/15

Question 12

authentication in DH

Answer 12

server certificate contains DH parameters –> authenticated

no forward secrecy because static

Question 13

draw tls key derivation

Answer 13

03-tls 24

splitting up of key_block into components depends on cipher suite

Question 14

goal of record protocol

Answer 14

1. data origin auth. and integrity (by MAC)
2. confidentiality (by symmetric encryption)
3. anti-replay using sequence numbers