1
$\begingroup$

TLS consists of sub-protocols including the handshake where the key-exchange is and the record protocol. If I want to use a statement like:

both parties negotiate a ciphersuite that defines the algorithms that will be used in the session

Is this a correct statement? Can I use the term session in a context that includes the key-exchange? The term session gives me the impression that it is after the key-exchange has been done. However, I use it in my statement because I am not sure if the ciphersuite defines anything beyond the key-exchange?

Need more clarifications please.

$\endgroup$
  • $\begingroup$ Cipher suites define the algorithms for the key exchange and for the record layer / the bulk transfer. Usually the term "session" (imo) refers to the whole connection from the client hello to the connection tear-down. $\endgroup$ – SEJPM Aug 6 '17 at 13:19
  • $\begingroup$ So in you opinion, the statement I posted seems correct to you? $\endgroup$ – user6875880 Aug 6 '17 at 13:20
  • $\begingroup$ Looks fine to me, with the caveat that a TLS session may go beyond a single TCP session, if you allow session resumption. This can have serious consequences for ‘forward secrecy’, by delaying when the session keys are actually erased. $\endgroup$ – Squeamish Ossifrage Aug 6 '17 at 22:17
  • $\begingroup$ And conversely a single TCP connection can contain/use multiple TLS sessions if renegotiation occurs. (Although nowadays if you try renego without 5746 it will very likely fail, and some paranoic systems won't accept it even with 5746.) @SqueamishOssifrage $\endgroup$ – dave_thompson_085 Aug 7 '17 at 5:48
1
$\begingroup$

Yes, that looks like a correct usage of the word session.

Of course the session keys are only valid for the record layer. But the session keys are tied to the session, not the other way around. And usually the TLS session is of course tied to a TCP/IP session, but that doesn't need to be the case.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.