The TLS Handshaking Protocols
TLS has three subprotocols that are used to allow peers to agree upon
security parameters for the record layer, to authenticate themselves,
to instantiate negotiated security parameters, and to report error
conditions to each other.
The Handshake Protocol is responsible for negotiating a session,
which consists of the following items:
session identifier
An arbitrary byte sequence chosen by the server to identify an
active or resumable session state.
peer certificate
X509v3 certificate of the peer. This element of the state may be null.
compression method
The algorithm used to compress data prior to encryption.
cipher spec
Specifies the pseudorandom function (PRF) used to generate keying
material, the bulk data encryption algorithm (such as null, AES,
etc.) and the MAC algorithm (such as HMAC-SHA1). It also defines
cryptographic attributes such as the mac_length.
master secret
48-byte secret shared between the client and server.
is resumable
A flag indicating whether the session can be used to initiate new
connections.
These items are then used to create security parameters for use by
the record layer when protecting application data. Many connections
can be instantiated using the same session through the resumption
feature of the TLS Handshake Protocol.
Alert Protocol
One of the content types supported by the TLS record layer is thealert type. Alert messages convey the severity of the message
(warning or fatal) and a description of the alert. Alert messages
with a level of fatal result in the immediate termination of the
connection. In this case, other connections corresponding to the
session may continue, but the session identifier MUST be invalidated,
preventing the failed session from being used to establish new
connections. Like other messages, alert messages are encrypted and
compressed, as specified by the current connection state.
enum { warning(1), fatal(2), (255) } AlertLevel;
enum {
close_notify(0),
unexpected_message(10),
bad_record_mac(20),
decryption_failed_RESERVED(21),
record_overflow(22),
decompression_failure(30),
handshake_failure(40),
no_certificate_RESERVED(41),
bad_certificate(42),
unsupported_certificate(43),
certificate_revoked(44),
certificate_expired(45),
certificate_unknown(46),
illegal_parameter(47),
unknown_ca(48),
access_denied(49),
decode_error(50),
decrypt_error(51),
export_restriction_RESERVED(60),
protocol_version(70),
insufficient_security(71),
internal_error(80),
user_canceled(90),
no_renegotiation(100),
unsupported_extension(110),
(255)
} AlertDescription;
struct {
AlertLevel level;
AlertDescription description;
} Alert;
Closure Alerts
The client and the server must share knowledge that the connection is ending in order to avoid a truncation attack. Either party may initiate the exchange of closing messages.
close_notify
This message notifies the recipient that the sender will not send any more messages on this connection. Note that as of TLS 1.1, failure to properly close a connection no longer requires that a session not be resumed. This is a change from TLS 1.0 to conform
with widespread implementation practice.
Either party may initiate a close by sending a close_notify alert.
Any data received after a closure alert is ignored.
Unless some other fatal alert has been transmitted, each party is required to send a close_notify alert before closing the write side of the connection. The other party MUST respond with a close_notify alert of its own and close down the connection immediately,
discarding any pending writes. It is not required for the initiator of the close to wait for the responding close_notify alert before closing the read side of the connection.
If the application protocol using TLS provides that any data may be carried over the underlying transport after the TLS connection is closed, the TLS implementation must receive the responding close_notify alert before indicating to the application layer that the TLS connection has ended. If the application protocol will not transfer any additional data, but will only close the underlying transport connection, then the implementation MAY choose to close the transport without waiting for the responding close_notify. No part of this standard should be taken to dictate the manner in which a usage profile for TLS manages its data transport, including when connections are opened or closed.
Note: It is assumed that closing a connection reliably delivers pending data before destroying the transport.
(THIS IS WHAT MAKES OR BREAKS A SUCCESSFUL TRANSFER)
