Internet Security - Dang Thanh Binh's Page

282 INTERNET SECURITY
SSLCompressed.fragment: The compressed fragment (the plaintext
fragment if not compressed)
||: concatenation symbol
The compressed message plus the MAC are encrypted using symmetric encryption.
The block ciphers being used as encryption algorithms are:
DES(56), Triple DES(168), IDEA(128),
RC5(variable) and Fortezza(80)
where the number inside the brackets indicates the key size. Fortezza is a PCMCIA
card that provides both encryption and digital signing.
For block encryption, padding is added after the MAC prior to encryption. The
total size of the data (plaintext plus MAC plus padding) to be encrypted must be
a multiple of the cipher’s block length. Padding is added to force the length of the
plaintext to be a multiple of the block cipher’s block length. Padding is formed by
appending a single ‘1’ bit to the end of the message and then ‘0’ bits are added, as
many as needed. The last 64 bits of the total size of padded data are reserved for the
original message length.
For stream encryption, the compressed message plus the MAC are encrypted. Since
the MAC is computed before encryption takes place, it is encrypted along with the
compressed plaintext.
• Append SSL record header: The final processing of the SSL Record Protocol is to
append an SSL record header. The composed fields consist of:
– Content type (8 bits): This field is the higher-layer protocol used to process the
enclosed fragment.
– Major version (8 bits): This field indicates the major version of SSL in use. For
SSLv3, the value is 3.
– Minor version (8 bits): This field indicates the minor version of SSL in use. For
SSLv3, the value is 0.
– Compressed length (16 bits): This field indicates the length in bytes of the plaintext
fragment or compressed fragment if compression is required. The maximum
value is 2 14 + 2048.
Figure 8.4 illustrates the SSL Record Protocol format.
The SSL-specific protocols consist of the Change Cipher Spec Protocol, the Alert
Protocol and the Handshake Protocol, as shown in Figure 8.1. The contents of these three
protocols are presented in what follows.
8.1.3 SSL Change Cipher Spec Protocol
The Change Cipher Spec Protocol is the simplest of the three SSL-specific protocols.
This protocol consists of a single message, which is compressed and encrypted under
the current CipherSpec. The message consists of a single byte of value 1. The change
cipher spec message is sent by both the client and server to notify the receiving party