It is DTLS 1.2 version question of this question.

I know from of RFC 5246 (DTLS 1.2) AEAD Ciphers can be used in DTLS 1.2 exactly the same with TLS 1.2.

In TLS 1.2

AAD = seq_num + TLSCompressed.type + TLSCompressed.version + TLSCompressed.length

It makes sense since it is (implicit) sequence number + header of TLSCiphertext. However at DTLS 1.2 new header field epoch is added. Shouldn't I includes epoch as the AAD too?

In my understanding of DTLS, the below makes more sense. Am I correct?

AAD = DTLSCompressed.type + DTLSCompressed.version + DTLSCompressed.epoch + DTLSCompressed.sequence_number + DTLSCompressed.length


1 Answer 1


RFC 6347 § states

The DTLS MAC is the same as that of TLS 1.2. However, rather than using TLS's implicit sequence number, the sequence number used to compute the MAC is the 64-bit value formed by concatenating the epoch and the sequence number

Similar language is missing from § They also use the concatenation of the epoch and the DTLS sequence number as the TLS sequence number in the AEAD associated data.

Effectively, TLS and DTLS both use an 8-byte “sequence number” in exactly the same way, but in TLS it's formed as a single 64-bit number, whereas in DTLS it's formed from a 16-bit number (epoch) and a 48-bit number (which is the part called “sequence number” in the DTLS specification).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.