Transport Layer Security Session Hash and Extended Master Secret Extension
RFC 7627, “Transport Layer Security Session Hash and Extended Master Secret Extension”, is a Proposed Standard document published in September 2015 by K. Bhargavan, A. Delignat-Lavaud, A. Pironti, A. Langley, M. Ray. It updates RFC 5246. The canonical text is published by the RFC Editor.
Abstract
The Transport Layer Security (TLS) master secret is not cryptographically bound to important session parameters such as the server certificate. Consequently, it is possible for an active attacker to set up two sessions, one with a client and another with a server, such that the master secrets on the two sessions are the same. Thereafter, any mechanism that relies on the master secret for authentication, including session resumption, becomes vulnerable to a man-in-the-middle attack, where the attacker can simply forward messages back and forth between the client and server. This specification defines a TLS extension that contextually binds the master secret to a log of the full handshake that computes it, thus preventing such attacks.
What “Proposed Standard” means
An entry-level standards-track specification: stable, peer-reviewed and a solid basis for implementation, though it may still evolve before becoming an Internet Standard.
The canonical text of RFC 7627 is hosted at rfc-editor.org. Available in TXT,HTML.
- RFC 7626 DNS Privacy Considerations
- RFC 7628 A Set of Simple Authentication and Security Layer Mechanisms for OAuth
- RFC 7625 Architecture of an IP/MPLS Network with Hardened Pipes
- RFC 7629 Flow-Binding Support for Mobile IP
- RFC 7624 Confidentiality in the Face of Pervasive Surveillance: A Threat Model and Problem Statement
- RFC 7630 HMAC-SHA-2 Authentication Protocols in the User-based Security Model for SNMPv3
- RFC 7623 Provider Backbone Bridging Combined with Ethernet VPN
- RFC 7631 TLV Naming in the Mobile Ad Hoc Network Generalized Packet/Message Format