Web Security and Commerce

SSL 3.0 Record Layer

At the bottom layer of the SSL protocol is the SSL record layer. The record layer sends blocks of data, called records, between the client and the server. Each block can contain up to 16,383 bytes of data. According to the specification, “client message boundaries are not preserved in the record layer.” This means that if higher-level processes send multiple messages very quickly, those messages may be grouped together into a single SSL record. Alternatively, they might be broken into many SSL records.

Each SSL record contains the following information:

• Content type

• Protocol version number

• Length

• Data payload (optionally compressed and encrypted)

• Message authentication code (MAC)

Each SSL record is compressed and encrypted according to the current compression algorithm and encryption algorithm. At the start of the connection, the compression function is defined as CompressionMethod.null and the encryption method is SSL_NULL_WITH_NULL_NULL—that is, there is no compression or encryption. Both the compression and encryption algorithms can be set during the SSL “Hello” and changed during the course of the SSL conversation.

The MAC is calculated using the formula:

hash( MAC_write_secret + pad_2 +
     hash(MAC_write_secret + pad_1 + seq_num + length + content))

where:

• MAC_write_secret is a secret shared between the SSL client and server that is used to validate transmission.

• pad_1 is the character 0x36 repeated 48 times for MD5, 40 times for SHA-1^[121]. This is an arbitrary constant. ...