0

If a bit gets flipped by the network in a TLS stream, then the message integrity check in TLS will fail. Does TLS retransmit the affected message? Or does it do something else, like terminate the entire TLS stream?

Improve this question
2
  • Error correction, when it comes to bit errors, is typically handled at the TCP layer. See networkengineering.stackexchange.com/questions/52200/…
    – mti2935
    Commented Nov 18, 2021 at 20:17
  • if the network (and not a malicious actor) corrupts the data, it will probably render the TCP checksum invalid. So the packet will be resent on the TCP layer, before it reaches the TLS layer
    – nobody
    Commented Nov 18, 2021 at 20:17

1 Answer 1

Reset to default
3

For reliable transport TLS relies on the transport layer, i.e. typically TCP. TLS by its own does not retransmit data.

If data get accidentally corrupted (bit flip) this will in most cases detected by TCP and the data will be discarded and retransmitted due to the reliability properties of TCP.

If data get corrupted in a way that it can not not be detected at the TCP level this will be considered a fatal error and the TLS session will be closed. Maybe a bad_record_mac alert will be issued too.

Improve this answer
1
  • 3
    Accidental bit flips that reach all the way up to the TLS layer should be incredibly rare, too. The Ethernet PCS frame itself has a frame check code (CRC32), and 10G+ networks have forward error correction (FEC) on top of that. Then the IPv4 packet header contains a 16-bit checksum, and the TCP segment header contains another 16-bit checksum. By the time you get to TLS, the data has been checked by at least three nested checksums (i.e. each successive checksum was itself part of the data checksummed in the preceding layer). Over WiFi there are at least two more layers of integrity checking.
    – Polynomial
    Commented Nov 19, 2021 at 19:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .