14.1 The big picture

In the last part of the book, we covered in detail the TLS Handshake protocol and the cryptography needed to implement the main security objectives of the TLS Handshake protocol, namely entity authentication and key agreement. For the latter of these goals, public-key cryptography was needed, for the former, we used both public-key cryptography, especially digital signatures, and symmetric cryptography, especially message authentication codes (MACs).

Figure 14.1: TLS subprotocols

But entity authentication and key agreement are only prerequisites of the main goal of TLS, which is to establish a secure tunnel between client and server, providing confidentiality, integrity protection, and message authenticity. As already briefly discussed in Chapter 6, Transport Layer Security at a Glance, it is the task of the TLS Record protocol, located immediately above the transport layer (see Figure 14.1), to actually realize this tunnel. In order to do so, it...