1
$\begingroup$

Can someone confirm that SSLv2, SSLv3, and TLS have the same Handshake process (ClientHello/ServerHello, ..., ClientKeyExchange ...)?

If not, can you tell me the main differences between theses three protocols?

I am asking this because, as you can see in the image below, I can see ClientMasterKey (SSLv2) instead of ClientKeyExhange(TLS1.2). ClientKeyExhange must contains the Premaster secret, and I have never seen ClientMasterKey in handshake process.

enter image description here

Improve this question
$\endgroup$
3
  • 1
    $\begingroup$ In TLS 1.2 there is no handshake message as ClientMasterKey if thats what you are asking. $\endgroup$
    – Makif
    Commented May 10, 2016 at 6:02
  • $\begingroup$ This is, indeed, what i'm asking thanks. Have you got more informations about theses two packets (ClientMasterKey VS ClientKeyExchange) ? $\endgroup$
    – Duke Nukem
    Commented May 10, 2016 at 8:53
  • $\begingroup$ You can look to the ClientKeyExchange message from TLS1.2 documentation. There is another document about ssl2 which mentions ClientMasterKey Message. $\endgroup$
    – Makif
    Commented May 10, 2016 at 12:25

1 Answer 1

Reset to default
1
$\begingroup$

Handshake differs greatly between SSLv2 and SSLv3. All versions of TLS (1.0, 1.1, 1.2) use the SSLv3 format and although they add some new options and features they don't alter the basic flow relevant to DROWN. Although formatted differently, the security content of SSLv2 ClientMasterKey is the same as SSLv3/TLS ClientKeyExchange when using RSA keyexchange, in that both contain an RSA (specifically PKCS1v1.5) encryption of the only secret information needed to determine the keys, which is exactly why DROWN works.

The critical difference is SSLv2 ServerVerify. Quoting from the DROWN paper:

2.2 SSL and TLS ...

The SSLv2 handshake protocol. ...
  The server responds with a ServerVerify message consisting of the challenge $r_c$ encrypted with the server_write_key. ...
  Our attack exploits the fact the server always decrypts an RSA-PKCS#1 v1.5 ciphertext, computes the server_write_key, and immediately responds with a ServerVerify message. The SSLv2 standard implies this message ordering, but does not make it explicit. However, we observed this behavior in every implementation we examined.

The TLS handshake protocol. ... or SSLv3, ...
The two main details relevant to our attacks are: ...
* After receiving the ClientKeyExchange message, the server waits for the ClientFinished message, in order to authenticate the client.

This is why SSLv2 provides the Bleichenbacher-style oracle but SSLv3 or TLS does not, so DROWN can use the SSLv2 oracle to break SSLv3 or TLS sessions.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Hi, why is it that one has to transform a RSA PKCS#1 v1.5 TLS conformant ciphertext to RSA PKCS#1 v1.5 SSLv2 conformant ciphertext before being fed to the Blechenbacher oracle? $\endgroup$
    – meta_warrior
    Commented Mar 11, 2017 at 10:49
  • $\begingroup$ (@freak_warrior) answered at new Q crypto.stackexchange.com/questions/44634/… $\endgroup$
    – dave_thompson_085
    Commented Mar 15, 2017 at 3:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.