# TLS: How is the shared secret (via Diffie-Hellman) used in the symmetric crypto function?

So let's say we use a cipher suite with DH key exchange and AES symmetric encryption. Alice and Bob both end up with the same shared secret key $k$.

How is this value k used in e.g. AES? Will it be hashed before use, or is there a PBKDF involved? And what do we do about small $k$ (e.g. $10, …$)

## 1 Answer

The shared secret that Diffie-Hellman produces is known as the premaster secret. This is then passed through the cipher suite's PRF to get the master secret, which is then passed through the PRF again to get the various keys and IVs. The master secret is always exactly 48 bytes long; the keys can be as long as needed.

Now, the PRF. TLS tends to use a PRF based on HMAC, using a hash specified by the cipher suite. The PRF takes three inputs: a secret, a label (which is generally "the thing this is calculating", and a seed (which, for key derivation, is derived from random values in client and server handshake messages). It outputs as much data as is needed. While this is a key derivation function, it is not a password-based key derivation; it is a key-based key derivation function. A PBKDF must be slow, as that's the only hope to stop someone from brute-forcing a password. But TLS's cipher suites produce high-quality premaster secrets: it is infeasible to guess them. So, all you need to do is to make it infeasible to figure out one key given a different key, and a PRF is sufficient for this.

For small values of $k$: First, keep in mind that these are constant-width data types. The output of 1024-bit Diffie-Hellman is always 1024 bits, regardless of the numeric value. If you mean "what about brute-forcing," this is what "high-quality premaster secrets" is about. While it's possible DH might result in an output of 10, it's monumentally unlikely. Any attacker who's starting his brute-forcing at zero and going up is an idiot, who will almost certainly never break any connection. If the attacker guesses what your key is, he can break the connection, but the point is that he can't feasibly guess it.

• TLS 1.2 PRF uses (double) HMAC with SHA256 for all suites defined before 1.2, or with a hash defined by each new ciphersuite; all new 1.2 suites to date use SHA256 or SHA384. TLS 1.0 and 1.1 use a combination of HMAC-SHA1 and HMAC-MD5, and for completeness SSLv3 uses a combination of keyed SHA1 and MD5 hashes (not HMAC) (and doesn't call it PRF, though functionally it is). – dave_thompson_085 Sep 20 '15 at 9:02