# How do they implement MAC in TLS?

MAC only calculated once either case (according to what I read). However, in my experience surfing website via HTTPS, I think we should check the authenticity in every chunk of data received.

For example if I assume the MAC was appended at the end of encrypted data, how a browser is so confident so they execute Javascript before the HTML complete downloading.

Further more when downloading large file via HTTPS the browser seem to write the decrypted data to the harddisk before receive all portions of the file.

I think we should use updatable MAC in this case and verify each chunk of data received. However, with this approach it still vulnerable if the objective of an attacker is to discard some portion of data for example "the attacker want the first Javascript to be executed but the second one".

So, I want to ask what scheme browser used to make it sure enough to perform some operation without receive all portions of the file? Or is my info wrong at some point?

-

($\hspace{.02 in}$packet $\approx$ chunk)

They put a packet number into the plaintexts, and mac-then-encrypt the packets separately.

-
thank you; after I read your answer I look around to find more info. It seem like TLS cant directly control network packet since it built on top of TCP. Beside that some middlebox has smaller MTU than endpoint if keyed MAC perform on packet itself the packet will not be able to fragment by middlebox. However, in some TLS document I found "fragmentation" terms which somewhat look like what I'm looking for, but for now I don't find something to conclude the MAC was calculated for each fragment yet. If you have more info or references please tell me. –  Curious Sam Apr 13 at 18:23
@CuriousSam TLS “packets” (called records in the specification) are unrelated to how the stream is broken down into TCP packets. –  Gilles Apr 13 at 23:32