3

The SSL handshake contains the change_cipher_spec. When this change_cipher_spec is received, the pending read state is copied to current read state, and when change_cipher_spec is sent, the pending read state is copied to current read state.

What is the significance of theses states and what impact (in terms of data transfer/ encryption) do they have?

in.sane.prasain
  • 31
  • 2

1 Answers1

2

It's the state of the encryption. The pending state includes new encryption keys, and initialization vectors. There is a write key for sending data, and a read key for receiving data. The state of the keys and resulting IVs are the read and write states.

So when the current read/write state is overwritten with the pending read/write state it means that the new encryption keys and IVs are to be used for future communication. Until a new Change Cipher Spec message is received.

The significance of these states is that they keep track of the cryptographic state as data is being encrypted and decrypted. When a new key is negotiated these states are updated to use the new key that was negotiated between the peers. Key renegotiation is common among most cryptographic protocols.

To follow up on the comment by @Makif, the cryptographic state is complex. It keeps track of:

  • Symmetric algorithm (mode of operation and size)
  • Asymmetric algorithm
  • Symmetric encryption keys
  • Initialization vectors
  • Integrity keys (Message Authentication)

Essentially everything in a cipher suite, and any (or all) can be renegotiated and changed when a Change Cipher Spec message is received.

Community
  • 1
RoraΖ
  • 12,347
  • 4
  • 51
  • 83
  • Although i agree with the answer, i want to add that these read/write states also include symmetric encryption algorithm and mac algorithm in addition to keys and IVs used in that functions. So, the encryption algorithm can also change when we assign pending state to current state. – Makif Jul 27 '16 at 15:02
  • @Makif thank you for mentioning that, it is important to realize what exactly can be changed by a CCS message. – RoraΖ Jul 27 '16 at 15:11