On the (provable) security of TLS: Part 1(blog.cryptographyengineering.com)

http://blog.cryptographyengineering.com/2012/09/on-provable-security-of-tls-part-1.html