Cryptography Reference
In-Depth Information
Next is the handshake header 0x01000029. 0x01 is the handshake mes-
sage type (client hello), and 0x000029 is the strange three-byte length that
indicates that the actual payload is 41 bytes.
Following this, fi nally, is the client hello message itself. The fi rst two bytes
are the protocol version 0x0301 again, followed by 32 bytes of random
data (although as you can see the data isn't particularly random in this
case). Remember that the random structure is required to begin with
a four-byte “seconds since January 1, 1970” time, followed by 28 actu-
ally random bytes. As you can see, this is passed in the clear. Anything
you can see with tcpdump, a malicious intruder can see with a packet
sniffer as well.
After the random bytes, a 0 byte is supplied indicating that no session ID fol-
lows. The session ID structure is followed by the cipher suites list, which must
be supplied. First the two-byte length of the cipher suites indicates that there
are two bytes of cipher suite (that is, one cipher suite). This length declaration is
followed by the cipher suite list itself — here 0x002F, which is the single cipher
suite TLS_RSA_WITH_AES_128_CBC_SHA. Notice that the length of 2 indicates
that there follows two
bytes
of cipher suites, which is one cipher suite because
each suite is two bytes long. The client hello message ends with the list of sup-
ported compression methods, which is simply “no compression.”
12:37:03.938207 IP localhost.localdomain.56047 > localhost.localdomain.https: P
Handshake
Header
1:51(50) ack 1 win 257 <nop,nop,timestamp 12673267 12673267>
0x0000: 4500 0066 0342 4000 4006 394e 7f00 0001 E..f.B@.@.9N....
TLS
Header
TLS Version
(3.1)
0x0010: 7f00 0001 daef 01bb 1e32 63b3 1e28 e211 .........2c..(..
0x0020: 8018 0101 fe5a 0000 0101 080a 00c1 60f3 .....Z........`.
0x0030: 00c1 60f3
1603 0100 2d01 0000 2903 014c
..`.....-...)..L
0x0040:
4f19 3f00 0000 0000 0000 0000 0000 0000
O.?.............
Client
Ramdom
Session Id
Length (0)
Cipher
Sultes
0x0050:
0000 0000 0000 0000 0000 0000 0000 0000
................
Compression
Methods
0x0060:
0002 002f 0100
.../..
After the client hello, the server acknowledges the packet according to the
standard rules of TCP.
12:37:03.938244 IP localhost.localdomain.https > localhost.localdomain.56047: .
ack 51 win 256 <nop,nop,timestamp 12673267 12673267>
0x0000: 4500 0034 82e2 4000 4006 b9df 7f00 0001 E..4..@.@.......
0x0010: 7f00 0001 01bb daef 1e28 e211 1e32 63e5 .........(...2c.
0x0020: 8010 0100 5556 0000 0101 080a 00c1 60f3 ....UV........`.
0x0030: 00c1 60f3 ..`.
Because this is a topic about SSL/TLS and not about TCP, packet acknowledg-
ments are omitted from the remainder of this section.
Search WWH ::
Custom Search