1
$\begingroup$

I've captured my tor client network traffic and noticed that in every packet it sends 2 TLS records first of which is always 32 bytes long. The first TLS record seems not to be carrying any data. What is it for?

TLS records

$\endgroup$
3
$\begingroup$

It's a defense against the BEAST attack.

This attack is against TLS 1.0 (and SSLv3) and CBC mode; in CBC mode, TLS always uses the previous ciphertext block as the next IV, and hence the attacker can always predict the IV that will be used to encrypt the next block. So, what the attacker does is convince the sender to send a specific piece of data; that data, combined with the IV, causes AES (or DES/3DES) to encrypt an attacker chosen block, and that allows the attacker to tell whether previous blocks of encrypted data corresponded to a specific plaintext.

So, for this attack to work, the attacker needs to know the IV that will be used when he chooses the data to encrypt.

What this empty record does is mess this attack up. The attacker knows the IV that will be used to encrypt the empty record, but he can't control the data that is encrypted (as it is empty). TLS then sets the 'next IV' to the last ciphertext block of that record; then, TLS encrypts the real record (including the plaintext that the attacker has potentially chosen); however it uses an IV that the attacker could not predict when he selected the plaintext, and so the attack doesn't work.

An easier defense would be to use TLS 1.1 or latter (which selects the CBC mode IV for each record unpredictably), however if you're stuck with TLS 1.0, this is the sort of thing you need to do

| improve this answer | |
$\endgroup$
  • $\begingroup$ Thanks! I was wondering why I dont see such records outbound from my browser. So now I know is happens due to outdated TLS1.0 $\endgroup$ – academica Apr 2 '18 at 20:37
  • $\begingroup$ @poncho In general, the first record is not totally empty; it contains exactly one byte worth of plaintext. This is called the "1/n-1 split". This is done that way because there are (buggy) TLS implementations that choke on empty records; having one byte of plaintext still leaves 7 or 15 bytes (depending on 3DES / AES) of unpredictable data in the first block, which is enough to deter BEAST. $\endgroup$ – Thomas Pornin Apr 3 '18 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.