I am working on manual decryption of application data in TLS 1.3 by going through example in RFC8448. I successfully derived and expanded key and IV, but the IV in examples is only 12 bytes long instead of 16, which is required for AES-128-GCM.
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
the IV in examples is only 12 bytes long instead of 16, which is required for AES-128-GCM.
That is incorrect; while GCM supports any nonce length, it is both simpler and more secure with 12 byte nonce length, hence that is what is used in almost all cases, including TLS 1.3.
-
2
-
2$\begingroup$ Moreover, rfc5116 section 5 specifies 12-byte nonce for AES-GCM and AES-CCM used on the Internet, and rfc8446 section 5.3 specifies nonce is minimum 8-byte but otherwise determined by the cipher, referencing rfc5116 for GCM and CCM(16), rfc6655 for CCM8, and rfc8439 for chacha20/poly1305, the latter two also specifying 12-byte (aka 96-bit) nonce. So in short both TLS1.2 and TLS1.3 always use 12-byte nonce for AEAD including GCM. $\endgroup$ Commented May 9, 2023 at 0:08