"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" is just one example for a cipher suite, as far as I'm concerned it means this:

It uses the TLS protocol, exchanges keys with Elliptic Curve Diffie Hellman Ephemeral, whose public keys are signed with RSA and afterwards AES 128 bit is used with the Galois Counter Mode, which provides authenticated encryption. The last function is a hash algorithm which is used for calculating the message authentification code for each packet.

Given that AES-GCM already provides integrity, why is an additional hash algorithm for authentication needed? Or am I mistaken with the interpretation of this?


1 Answer 1


From RFC 5246, section AEAD Ciphers:

AEAD ciphers take as input a single key, a nonce, a plaintext, and "additional data" to be included in the authentication check, as described in Section 2.1 of [AEAD]. The key is either the client_write_key or the server_write_key. No MAC key is used.

However in RFC 5246, section 5: HMAC and the Pseudorandom Function:

In addition, a construction is required to do expansion of secrets into blocks of data for the purposes of key generation or validation. This pseudorandom function (PRF) takes as input a secret, a seed, and an identifying label and produces an output of arbitrary length.

In this section, we define one PRF, based on HMAC. This PRF with the SHA-256 hash function is used for all cipher suites defined in this document and in TLS documents published prior to this document when TLS 1.2 is negotiated. New cipher suites MUST explicitly specify a PRF and, in general, SHOULD use the TLS PRF with SHA-256 or a stronger standard hash function.

Finally, in the hash function of the HMAC is also used to authenticate the handshake in the Finished message using the master key; see RFC 5246, section 7.4.9: Finished:

Hash denotes a Hash of the handshake messages. For the PRF defined in Section 5, the Hash MUST be the Hash used as the basis for the PRF. Any cipher suite which defines a different PRF MUST also define the Hash to use in the Finished computation.

So it is used for key derivation and authentication and for a final confirmation that the handshake succeeded, not for generating the MAC over the data messages.

  • $\begingroup$ The hash function is also used to authenticate the handshake in the Finished message; see section 7.4.9. $\endgroup$ Commented Jun 13, 2014 at 1:40
  • $\begingroup$ Sorry for bothering again, but the MAC that AES-GCM produces, can that safely be prepended or appended to the ciphertext produced by AES-GCM, right? $\endgroup$
    – hl3mukkel
    Commented Jun 15, 2014 at 13:11
  • $\begingroup$ Usually it's appended, as you require all ciphertext and AAD to be present to verify the authentication tag. The location does not matter, as long as the ciphertext and tag are strongly linked together. Otherwise you may be performing authentication on one and decrypting another. $\endgroup$
    – Maarten Bodewes
    Commented Jun 15, 2014 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.