A.3.     Alert messages                                           50
   A.4.     Handshake protocol                                       51
   A.4.1.   Hello messages                                           51
   A.4.2.   Server authentication and key exchange messages          52
   A.4.3.   Client authentication and key exchange messages          53
   A.4.4.   Handshake finalization message                           54
   A.5.     The CipherSuite                                          54
   A.6.     The Security Parameters                                  56
   B.       Glossary                                                 57
   C.       CipherSuite definitions                                  61




 
RFC 2246              The TLS Protocol Version 1.0          January 1999


   D.       Implementation Notes                                     64
   D.1.     Temporary RSA keys                                       64
   D.2.     Random Number Generation and Seeding                     64
   D.3.     Certificates and authentication                          65
   D.4.     CipherSuites                                             65
   E.       Backward Compatibility With SSL                          66
   E.1.     Version 2 client hello                                   67
   E.2.     Avoiding man-in-the-middle version rollback              68
   F.       Security analysis                                        69
   F.1.     Handshake protocol                                       69
   F.1.1.   Authentication and key exchange                          69
   F.1.1.1. Anonymous key exchange                                   69
   F.1.1.2. RSA key exchange and authentication                      70
   F.1.1.3. Diffie-Hellman key exchange with authentication          71
   F.1.2.   Version rollback attacks                                 71
   F.1.3.   Detecting attacks against the handshake protocol         72
   F.1.4.   Resuming sessions                                        72
   F.1.5.   MD5 and SHA                                              72
   F.2.     Protecting application data                              72
   F.3.     Final notes                                              73
   G.       Patent Statement                                         74
            Security Considerations                                  75
            References                                               75
            Credits                                                  77
            Comments                                                 78
            Full Copyright Statement                                 80

1. Introduction

   The primary goal of the TLS Protocol is to provide privacy and data
   integrity between two communicating applications. The protocol is
   composed of two layers: the TLS Record Protocol and the TLS Handshake
   Protocol. At the lowest level, layered on top of some reliable
   transport protocol (e.g., TCP[TCP]), is the TLS Record Protocol. The
   TLS Record Protocol provides connection security that has two basic
   properties:

     - The connection is private. Symmetric cryptography is used for
       data encryption (e.g., DES [DES], RC4 [RC4], etc.) The keys for
       this symmetric encryption are generated uniquely for each
       connection and are based on a secret negotiated by another
       protocol (such as the TLS Handshake Protocol). The Record
       Protocol can also be used without encryption.

     - The connection is reliable. Message transport includes a message
       integrity check using a keyed MAC. Secure hash functions (e.g.,
       SHA, MD5, etc.) are used for MAC computations. The Record
       Protocol can operate without a MAC, but is generally only used in




 
RFC 2246              The TLS Protocol Version 1.0          January 1999


       this mode while another protocol is using the Record Protocol as
       a transport for negotiating security parameters.

   The TLS Record Protocol is used for encapsulation of various higher
   level protocols. One such encapsulated protocol, the TLS Handshake
   Protocol, allows the server and client to authenticate each other and
   to negotiate an encryption algorithm and cryptographic keys before
   the application protocol transmits or receives its first byte of
   data. The TLS Handshake Protocol provides connection security that
   has three basic properties:

     - The peer's identity can be authenticated using asymmetric, or
       public key, cryptography (e.g., RSA [RSA], DSS [DSS], etc.). This
       authentication can be made optional, but is generally required
       for at least one of the peers.

     - The negotiation of a shared secret is secure: the negotiated
       secret is unavailable to eavesdroppers, and for any authenticated
       connection the secret cannot be obtained, even by an attacker who
       can place himself in the middle of the connection.

     - The negotiation is reliable: no attacker can modify the
       negotiation communication without being detected by the parties
       to the communication.

   One advantage of TLS is that it is application protocol independent.