# Why does AES-GCM need MAC? (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)

"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" is just one example for a cipher suite, as far as I'm concerned it means this:

it uses the TLS protocol, exchanges keys with Elliptic Curve Diffie Hellman Ephemeral, whose public keys are signed with RSA and afterwards AES 128 bit is used with the Galois Counter Mode, which provides authenticated encryption. The last function is a hash algorithm which is used for calculating the message authentification code for each packet.

Given that AES-GCM already provides integrity, why is an additional hash algorithm for authentication needed? Or am I mistaken with the interpretation of this?

-

AEAD ciphers take as input a single key, a nonce, a plaintext, and "additional data" to be included in the authentication check, as described in Section 2.1 of [AEAD]. The key is either the client_write_key or the server_write_key. No MAC key is used.

In addition, a construction is required to do expansion of secrets into blocks of data for the purposes of key generation or validation. This pseudorandom function (PRF) takes as input a secret, a seed, and an identifying label and produces an output of arbitrary length.

In this section, we define one PRF, based on HMAC. This PRF with the SHA-256 hash function is used for all cipher suites defined in this document and in TLS documents published prior to this document when TLS 1.2 is negotiated. New cipher suites MUST explicitly specify a PRF and, in general, SHOULD use the TLS PRF with SHA-256 or a stronger standard hash function.

Finally, in the hash function of the HMAC is also used to authenticate the handshake in the Finished message using the master key; see RFC 5246, section 7.4.9: Finished:

Hash denotes a Hash of the handshake messages. For the PRF defined in Section 5, the Hash MUST be the Hash used as the basis for the PRF. Any cipher suite which defines a different PRF MUST also define the Hash to use in the Finished computation.

So it is used for key derivation and authentication and for a final confirmation that the handshake succeeded, not for generating the MAC over the data messages.

-
ah okay, thanks for the clarification! –  hl3mukkel Jun 12 at 23:03
The hash function is also used to authenticate the handshake in the Finished message; see section 7.4.9. –  Matt Nordhoff Jun 13 at 1:40
@MattNordhoff Thanks, answer edited. –  Maarten Bodewes - owlstead Jun 13 at 7:07
Sorry for bothering again, but the MAC that AES-GCM produces, can that safely be prepended or appended to the ciphertext produced by AES-GCM, right? –  hl3mukkel Jun 15 at 13:11
Usually it's appended, as you require all ciphertext and AAD to be present to verify the authentication tag. The location does not matter, as long as the ciphertext and tag are strongly linked together. Otherwise you may be performing authentication on one and decrypting another. –  Maarten Bodewes - owlstead Jun 15 at 16:58