Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I met a strange issue that the TLS connection is always torn down by Chrome after received server ChangeCipherSpec. The sequence is as following:

  Client                     Server
  SYN-->              
                          <--SYN, ACK
  ACK-->
  ClientHello-->
                          <--ServerHello, Certificate
  ChangeCipherSpec-->
                          <--ChangeCipherSpec
  FIN-->
                          <--ACK
                          <--FIN
  ACK-->

Why FIN is sent instead of Application Data?

share|improve this question

1 Answer 1

Your sequence is weird. When the client sends the ClientHello, then the server will respond with a ServerHello, and then:

  • either the client and server reuse an existing session, and do the "abbreviated handshake", in which case the server sends its ChangeCipherSpec and then a Finished message;
  • or the client and server do not reuse an existing session, in which case the server must send its Certificate message and a ServerHelloDone, in which case the client will send a ClientKeyExchange, then a ChangeCipherSpec and a Finished message.

See this answer for a description of the SSL handshakes.

In any case, if you observe a Certificate message from the server, then this is not an abbreviated handshake, and there should be at least a ServerHelloDone from the server, and a ClientKeyExchange from the client. The logical conclusion would be that your network capture tool does not see all the traffic. Therefore, it may miss the "application data" records that you expect.

share|improve this answer
    
I searched the material in the network, and it seems the sequence follows the TLS False Start used by Chrome except the FIN after the ChangeCipherSpec from server –  jacky Aug 16 '13 at 14:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.