2
$\begingroup$

Section 2 of RFC 8446 says about the phase "Key Exchange": … Everything after this phase is encrypted.

The "Certificate" message is sent after "Key exchange" as the scheme in that section shows. So it seems to be encrypted.

I am confused that I haven't found a mention of certificate encrypting in the "Certificate" section 4.4.2.

Could you explain to me - Should the certificate be encrypted and (if it should) which cipher must be used -

  1. the cipher in ciphersuite which server had sent to the client as agreed ciphersuite or
  2. any other?
$\endgroup$

1 Answer 1

2
$\begingroup$

The "Certificate" message is sent after "Key exchange" as the scheme in that section shows. So it seems to be encrypted.

It is.

I am confused that I haven't found a mention on certificate encrypting in the "Certificate" section 4.4.2.

Well, it's after the key exchange, and so of course it's encrypted; it was assumed that when they said 'everything after the key exchange is encrypted', that was implied.

Could you explain me ... which cipher must be used - (1) the cipher in ciphersuite which server had sent to the client as agreed ciphersuite

The ciphersuite that was negotiated (and using the keys that were derived from the key exchange).

Background: a major goal of TLS 1.3 was anonymity; that is, to leak as little about the communicating parties as possible. Now, the identity of the server is in the certificate, and so of course it is encrypted.

$\endgroup$
4
  • $\begingroup$ Quite often the identity of the server is of course not that important; an adversary can tell by looking at the IP that I am talking to amazon.com or not. However, if you connect to a embedded device in your home and an attacker can find out the firmware from the included certificate then that would be important information. $\endgroup$
    – Maarten Bodewes
    Commented May 9, 2023 at 20:58
  • $\begingroup$ @poncho, as I know, there are two keys (secrets) - for handshake and for application data. So, which key server should use to encrypt the certificate ? Is it the handshake key ? $\endgroup$
    – LUN
    Commented May 9, 2023 at 21:05
  • 2
    $\begingroup$ @LUN see rfc-editor.org/rfc/rfc8446#section-4.4 and rfc-editor.org/rfc/rfc8446#section-7.1 Unless I am reading it wrong, the server encrypts the Certificate using "server_handshake_traffic_secret" $\endgroup$
    – honzaik
    Commented May 10, 2023 at 7:36
  • 1
    $\begingroup$ @LUN: Figure 1 of RFC 8446 clearly shows that it is the handshake key $\endgroup$
    – poncho
    Commented May 10, 2023 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.