, Volume 23, Issue 2, pp 187-223
Date: 29 Oct 2009

The TLS Handshake Protocol: A Modular Analysis

Rent the article at a discount

Rent now

* Final gross prices may vary according to local VAT.

Get Access


We study the security of the widely deployed Secure Session Layer/Transport Layer Security (TLS) key agreement protocol. Our analysis identifies, justifies, and exploits the modularity present in the design of the protocol: the application keys offered to higher-level applications are obtained from a master key, which in turn is derived through interaction from a pre-master key.

We define models (following well-established paradigms) that clarify the security level enjoyed by each of these types of keys. We capture the realistic setting where only one of the two parties involved in the execution of the protocol (namely the server) has a certified public key, and where the same master key is used to generate multiple application keys.

The main contribution of the paper is a modular and generic proof of security for a slightly modified version of TLS. Our proofs shows that the protocol is secure even if the pre-master and the master keys only satisfy only weak security requirements. Our proofs make crucial use of modelling the key derivation function of TLS as a random oracle.

Communicated by Okamoto
This paper was solicited by the Editors-in-Chief as one of the best papers from ASIACRYPT 2008, based on the recommendation of the program committee.