RFC 2246

RFC 2246
Title	The TLS Protocol Version 1.0
Number	2246
Author	Tim Dierks, Christopher Allen
Pubdate	January 1999
Updates	None
Obsoletes	None
Status	Proposed Standard
Series	Request for Comments

RFC 2246. Published in January 1999, this document defines the Transport Layer Security protocol version 1.0, establishing a critical standard for securing communications over networks like the Internet. It was authored by Tim Dierks and Christopher Allen, building directly upon the foundation laid by the Secure Sockets Layer protocol from Netscape Communications. This specification introduced a robust framework for providing privacy and data integrity between two communicating applications, such as a web browser and a server.

Overview

The protocol was designed to operate above reliable transport protocols like the Transmission Control Protocol, primarily to secure connections for applications such as HTTP, leading to the creation of HTTPS. Its architecture allows for client and server authentication through the use of asymmetric cryptography and public-key certificates, often issued by a certificate authority. A primary goal was to prevent eavesdropping, tampering, and message forgery across network links, addressing growing security concerns in the era of expanding e-commerce on the World Wide Web.

Protocol details

The specification structures the protocol into two main layers: the TLS Record Protocol and the TLS Handshake Protocol. The TLS Record Protocol provides connection security with basic properties like confidentiality using symmetric-key cryptography and reliability through a keyed-hash message authentication code. It operates by fragmenting data from upper layers, optionally compressing it, applying a Message Authentication Code, and encrypting it before transmission. The protocol supports multiple block cipher modes and stream cipher algorithms, negotiated during the initial handshake phase.

Security features

Key security features include protection against man-in-the-middle attacks through authenticated key exchange and resistance to replay attacks via the use of sequence numbers. The protocol provides forward secrecy for some cipher suites, ensuring that compromise of long-term keys does not jeopardize past session keys. Integrity is guaranteed by the HMAC construction, while the handshake protocol itself is designed to be extensible, allowing for new cryptographic algorithms and authentication methods to be added as needed, a feature later utilized by extensions defined in RFC 3546.

Cipher suites

A cipher suite is a named combination of authentication, encryption, and Message Authentication Code algorithms. The document defines several mandatory suites for interoperability, such as those using the RSA algorithm for key exchange and the Data Encryption Standard for bulk encryption. It also specifies suites utilizing the Diffie-Hellman key exchange for authentication. Support for the RC4 stream cipher and the Triple DES block cipher is included, with specific modes like Cipher Block Chaining detailed for operation.

Handshake protocol

The TLS Handshake Protocol is responsible for negotiating the security parameters of a session. It involves a sequence of messages, including the ClientHello and ServerHello, to agree on a protocol version and cipher suite. This is followed by the exchange of public key certificates and the computation of a pre-master secret, often using RSA encryption or Diffie-Hellman key exchange. The process culminates in the generation of master secret and session key material, verified by exchanged Finished messages, which protect against downgrade attacks.

Version history and deprecation

This version was succeeded by TLS 1.1, defined in RFC 4346, which addressed vulnerabilities like those in Cipher Block Chaining mode. It was later followed by TLS 1.2 in RFC 5246 and TLS 1.3 in RFC 8446. Due to the discovery of weaknesses in algorithms like RC4 and theoretical attacks on the protocol itself, such as the POODLE attack, the use of this version has been strongly discouraged. Major organizations like the Internet Engineering Task Force and the National Institute of Standards and Technology have since mandated migration to later, more secure versions.

Category:Internet standards Category:Cryptographic protocols Category:1999 documents