What 32 bytes TLS data records for?

Question

I've captured my tor client network traffic and noticed that in every packet it sends 2 TLS records first of which is always 32 bytes long. The first TLS record seems not to be carrying any data. What is it for?

Answer 1

It's a defense against the BEAST attack.

This attack is against TLS 1.0 (and SSLv3) and CBC mode; in CBC mode, TLS always uses the previous ciphertext block as the next IV, and hence the attacker can always predict the IV that will be used to encrypt the next block. So, what the attacker does is convince the sender to send a specific piece of data; that data, combined with the IV, causes AES (or DES/3DES) to encrypt an attacker chosen block, and that allows the attacker to tell whether previous blocks of encrypted data corresponded to a specific plaintext.

So, for this attack to work, the attacker needs to know the IV that will be used when he chooses the data to encrypt.

What this empty record does is mess this attack up. The attacker knows the IV that will be used to encrypt the empty record, but he can't control the data that is encrypted (as it is empty). TLS then sets the 'next IV' to the last ciphertext block of that record; then, TLS encrypts the real record (including the plaintext that the attacker has potentially chosen); however it uses an IV that the attacker could not predict when he selected the plaintext, and so the attack doesn't work.

An easier defense would be to use TLS 1.1 or latter (which selects the CBC mode IV for each record unpredictably), however if you're stuck with TLS 1.0, this is the sort of thing you need to do