Skip to content

The TLS Handshake Protocol: A Modular Analysis

Research output: Contribution to journalArticle

Original languageEnglish
Pages (from-to)187-223
Number of pages37
JournalJournal of Cryptology
Volume23
Issue number2
DOIs
DatePublished - Apr 2010

Abstract

We study the security of the widely deployed Secure Session Layer/Transport Layer security (TLS) key agreement protocol. Our analysis identifies, justifies, and exploits the modularity present in the design of the protocol: the application keys offered to higher-level applications are obtained from a master key, which in turn is derived through interaction from a pre-master key. We define models (following well-established paradigms) that clarify the security level enjoyed by each of these types of keys. We capture the realistic setting where only one of the two parties involved in the execution of the protocol (namely the server) has a certified public key, and where the same master key is used to generate multiple application keys. The main contribution of the paper is a modular and generic proof of security for a slightly modified version of TLS. Our proofs shows that the protocol is secure even if the pre-master and the master keys only satisfy only weak security requirements. Our proofs make crucial use of modelling the key derivation function of TLS as a random oracle.

Additional information

Other identifier: 2001127

View research connections

Related faculties, schools or groups