Zilog EZ80F91AZA User Manual download pdf (Page 14)

UM020107-1211 SSL Handshake Protocols

ZTP Network Security SSL Plug-In

User Manual

SSL Handshake Protocols

This chapter presents an overview of the SSL handshake protocols and some background

information about security concepts.

Before SSL begins transferring encrypted application data, an SSL session is established

between the SSL client and the SSL server. The establishment of a session is initiated by

the SSL client.

The following processes occur during this session establishment:

1. The client verifies the identity of the server. This verification is performed by analyz-

ing a certificate that the server sends to the client when a new session is established.

The SSL protocol optionally allows the server to request a certificate from the client

so that the server can verify the client’s identity. However, the SSL server in ZTP does

not implement client authentication.

2. The client and server decide on a set of cryptographic algorithms to be used to

exchange a secret key, encrypt/decrypt data (cipher), and ensure message integrity

(through a one-way hash function). The combination of a key exchange algorithm, a

cipher algorithm and a hash algorithm is called a cipher suite.

3. The client generates a secret value, called a Master Key, that is used to derive addi-

tional keys for encrypting/decrypting data exchanged between a client and a server.

This key is sent to the server using the selected key exchange algorithm; and is pro-

tected using the information in the server’s certificate (the server’s public key) and

other SSL handshake messages.

4. Because the key exchange algorithm is asymmetric, only the server that possesses the

corresponding private key recovers the Master Key generated by the client.

5. The client and server independently generate read and write keys from the Master

Key; these keys are used to encrypt/decrypt data with the cipher algorithm.

6. The client and server exchange test messages to ensure both sides are using the correct

Read and Write keys. The test message is composed of data exchanged using the

handshake protocol. In the case of TLSv1 and SSLv3, the test message is a hash of all

handshake messages used to establish the SSL session. This message is also encrypted

using the negotiated cipher suite. If each party is able to decrypt the message and ver-

ify its contents then both parties are using the same symmetric key. This also proves

that the server is in possession of the private key corresponding to the public key in

the server’s certificate and completes the authentication of the server.

When a session is successfully established, every byte of data exchanged between the cli-

ent and server is packaged into an SSL data record. Each data record contains a field

called the message authentication code (MAC), which is computed using the Hash func-

1 2 ... 9 10 11 12 13 14 15 16 17 18 19 ... 78 79

No comments

Zilog EZ80F91AZA User Manual Page 14