I've just watched a video on the TLS protocol and learnt that it uses unidirectional keys (meaning keys for both sides, from browser to server and from server to browser).
Given that the server uses TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 , how are all those keys shared? We need:
- AES 256-bit key for the browser
- AES 256-bit key for the server (CBC)
- AES 128-bit IV for the browser
- AES 128-bit IV for the server (CBC)
- HMAC 512-bit key for the browser
- HMAC 512-bit key for the server
So in total we need 1792 bits, if we use 2048 bit Diffie-Hellman we can at most share 256 bits securely, if we take the SHA512 of it we get 512 bits, but how are we gonna securely derive so much keys from it?
Indeed we could use PBKDF2 to derive keys, but that would be kind of expensive. Does anyone know how TLS does all this?