Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've just watched a video on the TLS protocol and learnt that it uses unidirectional keys (meaning keys for both sides, from browser to server and from server to browser).

Given that the server uses TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 , how are all those keys shared? We need:

  • AES 256-bit key for the browser
  • AES 256-bit key for the server (CBC)
  • AES 128-bit IV for the browser
  • AES 128-bit IV for the server (CBC)
  • HMAC 512-bit key for the browser
  • HMAC 512-bit key for the server

So in total we need 1792 bits, if we use 2048 bit Diffie-Hellman we can at most share 256 bits securely, if we take the SHA512 of it we get 512 bits, but how are we gonna securely derive so much keys from it?

Indeed we could use PBKDF2 to derive keys, but that would be kind of expensive. Does anyone know how TLS does all this?

share|improve this question
up vote 3 down vote accepted

In TLS, the key exchange step results in a key called the master secret which is then derived into as much key material as needed with a custom key derivation function, called in TLS terminology the PRF. It is not slow -- contrary to PBKDF2, the "PRF" of TLS is not for handling password and thus has no need to be slow.

share|improve this answer
Oh wow, an answer by Mr Thomas Pornin himself! I'm honoured :) Thank you very much! – hl3mukkel Jun 15 '14 at 21:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.