Subject: [TLS] Question on length field used in HMAC calculation

From: "Nolan, Jerome" <[email-masked]>
Date: Tue, 10 May 2005 13:27:43 +0100

Hi,
 
    I'm new to SSL/TLS and am looking at its implementation in hardware.
I have a question about the length field that is used in the hash
calculation. Given the structures below, is the length used in the hash
calculation TLSCiphertext.length or TLSCompressed.length? It looks like
it is TLSCompressed.length from the specification but this means that is
necessary to decrypt the Ciphertext completely before starting the
authentication (in order to get the padding_length and thus know the
TLSCompressed.length). Is there a reason why TLSCompressed.length was
chosen over TLSCiphertext.length?

Jerome Nolan
Avocent

struct {

            ContentType type;

            ProtocolVersion version;

            uint16 length;

            select (CipherSpec.cipher_type) {

                                                                   case
stream: GenericStreamCipher;

                                                                   case
block: GenericBlockCipher;

                                                               }
fragment;

           } TLSCiphertext;

block-ciphered struct {

                                     opaque
content[TLSCompressed.length];

                                     opaque MAC[CipherSpec.hash_size];

                                     uint8
padding[GenericBlockCipher.padding_length];

                                      uint8 padding_length;

                                  } GenericBlockCipher;

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: David Hopwood <[email-masked]>
Date: Sat, 14 May 2005 14:07:03 +0100

Nolan, Jerome wrote:
> calculation TLSCiphertext.length or TLSCompressed.length?

TLSCompressed.length (the spec is clear on this, AFAICS).

> It looks like
> TLSCompressed.length).

Yes.

> Is there a reason why TLSCompressed.length was chosen over TLSCiphertext.length?

Inexperience. (It would have been better on both security and efficiency
grounds to encrypt-then-MAC.)

-- 
David Hopwood <[email-masked]>