0
$\begingroup$

I am studying the cipher suites provided by TLS 1.2 and found an interesting question.

TLS 1.2 adopts GCM for encryption and SHA256 or SHA384 for hash (e.g. TLS_RSA_WITH_AES_128_GCM_SHA256). But, GCM already provides data authenticity (integrity).

So, my question is that why TLS 1.2 includes another hash functions (SHA256 or SHA384) to provide integrity. Why not just use GCM for both encryption and hash, like IPsec?

$\endgroup$
4
$\begingroup$

Those ciphersuites do use GCM for both encryption and authentication. The hash function mentioned at the end is not used for integrity, but in the pseudorandom function. The TLS PRF is used to derive valid keys for the ciphersuite from the shared secret generated in the key exchange.

| improve this answer | |
$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.