How are initialization vectors used in TLS 1.1?

Question

From my understanding, TLS 1.0 can use CBC to encrypt data. To do so, it creates one initialization vector (IV), and then uses the previous ciphertext block as the IV for the next record. I made this diagram to depict my understanding about TLS 1.0:

In the diagram above, the red arrow opens up TLS 1.0 to the BEAST attack. As of TLS 1.1, this seems to be fixed by creating explicit IVs:

[CBCATT] describes a chosen plaintext attack on TLS that depends on knowing the IV for a record. Previous versions of TLS [TLS1.0] used the CBC residue of the previous record as the IV and therefore enabled this attack. This version uses an explicit IV in order to protect against this attack.

- RFC 4346

My question is: When and where exactly are these explicit IVs created? Are they created for each message like so (both messages are still being sent within the same stream like above)?:

Or do we now have explicit IVs for each record?:

... or is it neither of these?

I'm relatively unexperienced with all this so please forgive me if this is a silly question.

Answer 1

You might be somewhat confused by the term 'record'.

In TLS, a data to be encrypted is divided into a series of fragments; each fragment is encrypted as a record, with each record being encrypted and integrity protected independently [1]. Such a record can hold up to 16kbytes of data. This 'record' is standard TLS terminology and is what you are referring to as a 'message'. If you use a block cipher, then the amount of data that is processed by that block cipher at a time is referred to as a 'block' (not a 'record'), and in TLS, we generally don't talk about it that much, as there is generally little need to deal with the lower levels of how the crypto is done.

In TLS, each record is encrypted separately. If you use TLS 1.1 and CBC mode, when you encrypt a record, you pick an unpredictable IV, and then use that IV to CBC-mode encrypt all the data (and the HMAC of the data). You use CBC-mode in the standard way, and so CBC mode uses the IV the encrypt the first block (16 bytes for AES), and then uses resulting initial 16 bytes of ciphertext to encrypt the second block, and so on. It's just like TLS 1.0 CBC mode, except instead of using the previous ciphertext as the next IV, you use the value that appears immediately before the ciphertext. Hence, your first diagram is more accurate.

[1]: In addition, TLS sometimes sends messages between the encryptor and decryptor, to do the original negotiation, or to do rekeys. This data is also sent within records.