The TLS Handshake Protocol: A Modular Analysis

Paul Morrissey, Nigel Smart, Bogdan Warinschi

Research output: Contribution to journalArticle (Academic Journal)peer-review

18 Citations (Scopus)


We study the security of the widely deployed Secure Session Layer/Transport Layer security (TLS) key agreement protocol. Our analysis identifies, justifies, and exploits the modularity present in the design of the protocol: the application keys offered to higher-level applications are obtained from a master key, which in turn is derived through interaction from a pre-master key. We define models (following well-established paradigms) that clarify the security level enjoyed by each of these types of keys. We capture the realistic setting where only one of the two parties involved in the execution of the protocol (namely the server) has a certified public key, and where the same master key is used to generate multiple application keys. The main contribution of the paper is a modular and generic proof of security for a slightly modified version of TLS. Our proofs shows that the protocol is secure even if the pre-master and the master keys only satisfy only weak security requirements. Our proofs make crucial use of modelling the key derivation function of TLS as a random oracle.
Translated title of the contributionThe TLS Handshake Protocol: A Modular Analysis
Original languageEnglish
Pages (from-to)187-223
Number of pages37
JournalJournal of Cryptology
Issue number2
Publication statusPublished - Apr 2010

Bibliographical note

Other identifier: 2001127


Dive into the research topics of 'The TLS Handshake Protocol: A Modular Analysis'. Together they form a unique fingerprint.

Cite this