DUnderstanding the Pitfalls of SSLv2 - Implementing SSL/TLS Using Cryptography and PKI - page 585

handshake is rejected. Likewise, the server sends a connection-id that the client
must send back, encrypted, after the key exchange succeeds.
The complete handshake is illustrated in Figure C-2.

client server

send_client_hello (list of cipher specs)

send_server_hello (list of cipher specs, certificates)

send_key (cipher_spec, rsa_encrypt (client_key))

Figure C-1: SSLv2 opening handshake

client server

send_client_hello (list of cipher specs)

send_server_hello (list of cipher specs, certificates)

send_key (cipher_spec, rsa_encrypt (client_key))

(Encryption Begins)

client_finished (conn_id)

server_verify (challenge)

server_finished ()

Figure C-2: SSLv2 complete handshake

The specifi cation states that the client finished message should be sent before the
server_verify is received. However, every working implementation sends
the server_verify immediately after the key is received. This isn't a problem
and doesn't affect the security of the implementation, but it is something that
you need to be aware of when coding the SSLv2 handshake.