1
$\begingroup$

The RFC5246 states the following:

The encrypted data length (TLSCiphertext.length) is one more than the sum of SecurityParameters.block_length, TLSCompressed.length, SecurityParameters.mac_length, and padding_length. Example: If the block length is 8 bytes, the content length (TLSCompressed.length) is 61 bytes, and the MAC length is 20 bytes, then the length before padding is 82 bytes

What is the extra byte and what should it be? Also, the maths doesn't quite seem to add up. The first section says the length is the sum of the block length, the contenct length, the MAC length and the padding length. So why in the example is the 8 byte block length ignored in the calculation?

$\endgroup$
1
$\begingroup$

What is the extra byte and what should it be?

That is due to the way padding is specified. The last byte is the padding length, from 0 to 255. That is the length of the padding without the length byte itself. So with "zero padding" there's still the padding length byte.

The first section says the length is the sum of the block length, the contenct length, the MAC length and the padding length. So why in the example is the 8 byte block length ignored in the calculation?

The quote continues "this does not include the IV". That is because unlike the rest of the data, the IV is not encrypted.

$\endgroup$
  • $\begingroup$ But then surely in the case of zero padding, by adding the length value of 0, you're increasing the length by one, and so the total length is no longer a multiple of the block length? $\endgroup$ – chadianscot Sep 4 '15 at 14:32
  • 1
    $\begingroup$ @chadianscot, that's why the +1 is calculated first. If the length (without padding, but including 1 for the length) is equal to the block size, then the length value is zero. If it's one over, you need to add 15 (for AES) bytes of padding, in addition to the length byte. $\endgroup$ – otus Sep 4 '15 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.