Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In various docs on SSL there is a mention of connection.
But from the context I am not sure if this means the underlying TCP connection or the SSL connection.
I am thinking that there is no SSL connection (formally defined) in the SSL protocol and only an SSL session.
Therefore if I read for example:

For each SSL session, multiple connections can be setup. Each connection uses the same session parameters but different key

Or

An SSL session can outlive the connection which produced it

The connection is the TCP connection right?
Formally speaking is there ever a SSL Connection?

share|improve this question
    
I was under the impression that the whole point of SSL sessions was to avoid having to negotiate a new key. –  symcbean Apr 23 '12 at 12:20
add comment

1 Answer

When SSL is set up, it undergoes a handshake. This handshake allows the two clients to securely decide the details of the conversation and exchange key material. Once the handshake is complete, both sides can communicate securely. This entire conversation is simply an exchange of messages, so SSL is not technically limited to any transport protocol. You could run SSL over UDP if you really wanted, though standard libs probably don't support it and I wouldn't suggest trying it.

To answer your question fully - there's no such thing as a message in the SSL protocol to say "this SSL session is ending". The session is tied to whatever logic is provided by your transport layer and application layer, and it's up to the SSL implementation to deallocate resources when the conversation has "ended".

One thing your application might do is create an SSL wrapper around a TCP connection, send a few messages, send a "I'm done" message, tear down the SSL wrapper, then go back to the first step without closing the TCP connection. This way you could run multiple SSL "sessions" in serial using a single connection. I'm not sure what the use-case is, and I'd just make a new connection, but there's no technical limitation to stop you.

share|improve this answer
    
Just to clarify, the reason I don't suggest running SSL over UDP is that UDP doesn't provide strong ordering, protection against packet injection, or protection against IP spoofing. –  Polynomial Apr 22 '12 at 11:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.