20
Attacks on the TLS Handshake Protocol
The Handshake protocol is the most complex part of TLS because it has several targets to hit at once: it not only needs a key to be established between client and server in a secure (i.e. authenticated) manner, but also the protocol to do this must be negotiated. Finally, the client and server must agree on a set of symmetric algorithms to encrypt and authenticate their subsequent communication. It should come as no surprise that such a complex protocol is prone to many attacks.
Attacks on the Handshake protocol tend to be more severe than attacks on the Record protocol (which we will cover in the next chapter) because they do not attack single messages, but try to find out the key for the entire TLS session or even impersonate one of the communicating parties. On the other hand, all of these attacks require a rather strong attacker model, a man-in-the-middle with full control of the communication channel between client and server.
In what follows...