In SSL and TLS, why is there a separate Change Cipher Spec Protocol rather than including a change_cipher_spec message in the Handshake Protocol?


1 Answer 1


It could be in the handshake, but separating the two makes it easier to enforce the desired behavior in the protocol.

Long Answer
The same question has already been asked at Security.SE. For your convenience, this community wiki answer provides the related, accepted answer which was provided by Thomas Pornin :

SSL uses messages which are encoded over records. Encryption is done on a per record basis. However, several messages of the same type (e.g. handshake messages) can be crammed together in the same record. Since the Change Cipher Spec message modifies encryption settings, a new record should begin immediately afterwards, so that the new settings are immediately applied (in particular, it is crucial for security that the Finished message uses the new encryption and MAC).

Using a specific record type for Change Cipher Spec is a way to enforce this property. An SSL/TLS implementation cannot help but begin a new record for the Finished message, since it uses a record type distinct from that of the Change Cipher Spec message. Such a specific record type could be avoided if all SSL/TLS implementations were disciplined enough to begin a new record where they need, and also to verify that the peer also began a new record. It is safer and more robust to make it unavoidable through the record type.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.