\section{The TLS alert protocol}
\label{alert}
-The Alert\index{Alert protocol} protocol
+The Alert\index{TLS protocols!Alert} protocol
is there to allow signals to be sent between peers.
These signals are mostly used to inform the peer about the cause of
a protocol failure. Some of these signals are used internally by the
for an example.
\par
-Client certificate authentication\index{Client certificate authentication} is
+Client certificate authentication\index{Certificate authentication!Client} is
optional in \tls{}. A server may request a certificate from the client -- using the
\printfunc{gnutls_certificate_server_set_request}{gnutls\_certificate\_server\_set\_request}
function. If a certificate is to be requested by the client, at the handshake
in order to use the TLS cipher suites which depend on X.509 certificates.
-\section{The OpenPGP\index{OpenPGP keys} trust model}
+\section{The OpenPGP\index{OpenPGP!Keys} trust model}
\label{pgp:trust}
The OpenPGP key authentication relies on a distributed trust model, called
-\section{Error handling\index{Error handling}}
+\section{Error handling\index{Error!handling}}
\par
In \gnutls{} most functions return an integer type as a result.
In almost all cases a zero or a positive number means success, and
This server also supports export-grade cipher suites and session resuming.
\input{ex-serv-export}
-\subsection{Echo Server with OpenPGP\index{OpenPGP server} authentication}
+\subsection{Echo Server with OpenPGP\index{OpenPGP!Server} authentication}
The following example is a server which supports {\bf OpenPGP} key authentication.
\input{ex-serv-pgp}
-\subsection{A callback which\index{OpenPGP key retrieval} retrieves OpenPGP keys}
+\subsection{A callback which\index{OpenPGP!Key retrieval} retrieves OpenPGP keys}
The following example is a callback function which retrieves {\bf OpenPGP} keys from
a public key server.
\input{ex-pgp-keyserver}
-\chapter{Function\index{Function reference} reference}
+\chapter{Function\index{Function reference!for \gnutls{}} reference}
\section{\gnutls{} library}
The prototypes for the following functions lie
\newpage
-\section{\gnutlse{} library\index{Function reference for \gnutlse{}}}
+\section{\gnutlse{} library\index{Function reference!for \gnutlse{}}}
These functions are only available in the GPL version of the
library called ``gnutls-extra''. The prototypes for this library lie
in ``gnutls/extra.h''.
author = "Moeller, B.",
title = "Security of CBC Ciphersuites in SSL/TLS: Problems and Countermeasures",
year = {2002},
- note = "Available from http://www.openssl.org/~bodo/tls-cbc.txt",
+ note = "Available from http://www.openssl.org/\~\ bodo/tls-cbc.txt",
url = "http://www.openssl.org/~bodo/tls-cbc.txt"
}
-\section{The TLS handshake protocol\index{Handshake protocol}}
+\section{The TLS handshake protocol\index{TLS protocols!Handshake}}
\label{handshake}
The Handshake protocol is fully controlled by application layer (your
-\section{TLS layers\index{TLS layers}}
+\section{TLS layers\index{TLS Layers}}
\tlsI{} is a layered protocol, and consists of the Record Protocol,
the Handshake Protocol and the Alert Protocol. The Record Protocol
-\section{Authentication using OpenPGP\index{OpenPGP keys} keys}
+\section{Authentication using OpenPGP\index{OpenPGP!Keys} keys}
\label{sec:pgp}
This authentication method is part of the certificate authentication
-\section{The TLS record protocol\index{Record protocol}}
+\section{The TLS record protocol\index{TLS protocols!Record}}
The Record protocol is the secure communications provider. It's purpose
is to encrypt, authenticate and --optionally-- compress packets.
\subsection{Weaknesses and countermeasures}
-\index{Record protocol}
+\index{TLS protocols!Record}
Some weaknesses that may affect the security of the Record layer have been
found in \tlsI{} protocol. These weaknesses can be exploited by active attackers,
\section{TLS Extensions}
-\index{TLS extensions}
+\index{TLS Extensions}
A number of extensions to the \tls{} protocol have been proposed
mainly in \cite{TLSEXT}. The extensions supported in \gnutls{} are
discussed in the subsections that follow.
\subsection{Maximum fragment length negotiation}
+\index{TLS Extensions!Maximum fragment length}
This extension allows a \tlsI{} implementation to negotiate
a smaller value for record packet maximum length. This extension
functions.
\subsection{Server name indication}
+\index{TLS Extensions!Server name indication}
A common problem in HTTPS servers is the fact that the \tls{}
protocol is not aware of the hostname that a client connects to, when