I recently read questions about "MAC then Encrypt/Encrypt then MAC" which made me curious about how they actually use the algorithm.

MAC only calculated once either case (according to what I read). However, in my experience surfing website via HTTPS, I think we should check the authenticity in every chunk of data received.

For example if I assume the MAC was appended at the end of encrypted data, how a browser is so confident so they execute Javascript before the HTML complete downloading.

Further more when downloading large file via HTTPS the browser seem to write the decrypted data to the harddisk before receive all portions of the file.

I think we should use updatable MAC in this case and verify each chunk of data received. However, with this approach it still vulnerable if the objective of an attacker is to discard some portion of data for example "the attacker want the first Javascript to be executed but the second one".

So, I want to ask what scheme browser used to make it sure enough to perform some operation without receive all portions of the file? Or is my info wrong at some point?


($\hspace{.02 in}$packet $\approx$ chunk)

They put a packet number into the plaintexts, and mac-then-encrypt the packets separately.

  • $\begingroup$ thank you; after I read your answer I look around to find more info. It seem like TLS cant directly control network packet since it built on top of TCP. Beside that some middlebox has smaller MTU than endpoint if keyed MAC perform on packet itself the packet will not be able to fragment by middlebox. However, in some TLS document I found "fragmentation" terms which somewhat look like what I'm looking for, but for now I don't find something to conclude the MAC was calculated for each fragment yet. If you have more info or references please tell me. $\endgroup$ – Curious Sam Apr 13 '14 at 18:23
  • 2
    $\begingroup$ @CuriousSam TLS “packets” (called records in the specification) are unrelated to how the stream is broken down into TCP packets. $\endgroup$ – Gilles 'SO- stop being evil' Apr 13 '14 at 23:32

Encryption occurs at the record layer by the record's state's current security parameters. MAC occurs before encryption, after compression or after decryption before decompression. The various appication layer's boundaries are not respected by the record layers fragmentation. For example multiple record payloads or messages in the TLS presentation language; may be packed into one record packet both encrypted together as one record packet.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.