2
$\begingroup$

I am using DTLS 1.2 and my cipher is TLS_ECDHE_WITH_AES_128_GCM_SHA256

According to RFC 5246(RFC 5246 key calculation) i am calculating keys but i can not find the size of these keys in this RFC.

What is the size of following keys.

1- Client_Write_Mac_Key

2- Server_Write_Mac_Key

3- Client_Write_key

4- Server_Write_key

5- Client_Write_IV

6- Server_Write_IV

$\endgroup$
  • $\begingroup$ tools.ietf.org/html/rfc5288. The keys are obviously 128 bit for AES-128. You're missing the authentication scheme in your TLS ciphersuite string. $\endgroup$ – Maarten Bodewes May 25 '16 at 7:59
  • $\begingroup$ but what is the size of MAC key? $\endgroup$ – Ahsan Younis May 25 '16 at 9:10
4
$\begingroup$

In the case of a GCM-based ciphersuite, there is no MAC key. If the tool insists on a size, give it 0.

See RFC5246 section 6.2.3.3 (which discusses AEAD ciphers, of which GCM is one example); it explicitly states that, in this case, no MAC key is used.

In addition, the IV sizes are 4 bytes; these 4 bytes are combined with the 8 bytes from the TLS record to form the 12 byte GCM nonce; see RFC5288 second 3.

And, of course, the encryption keys for GCM128 is 16 bytes, yielding a total of:

1- Client_Write_Mac_Key - 0 bytes

2- Server_Write_Mac_Key - 0 bytes

3- Client_Write_key - 16 bytes

4- Server_Write_key - 16 bytes

5- Client_Write_IV - 4 bytes

6- Server_Write_IV - 4 bytes

| improve this answer | |
$\endgroup$
  • $\begingroup$ I think this answer misses the 4/8/12 byte nonce/IV calculation. And of course the size of the encryption keys, although those should be pretty obvious. $\endgroup$ – Maarten Bodewes May 25 '16 at 13:18
  • $\begingroup$ @MaartenBodewes: thanks for the reminder -- I initially just answered his plea of 'but what is the size of the MAC key', and forgot that he asked for the rest of the sizes as well... $\endgroup$ – poncho May 25 '16 at 13:39
  • $\begingroup$ @Maarten Bodewes: when i compute master secret its size is 48 bytes and according to your answer i need 16 + 16 + 4 + 4 = 40 bytes key. Do i expand the key according to RFC 5246 Section 6.3 or use the 40 bytes of master secret? $\endgroup$ – Ahsan Younis May 26 '16 at 6:15
  • $\begingroup$ @poncho do i need do expand master secret or not? $\endgroup$ – Ahsan Younis May 26 '16 at 9:07
  • $\begingroup$ @AhsanYounis No you expand the key. The entropy of the master secret may not be completely well distributed. The PRF makes sure that it is. $\endgroup$ – Maarten Bodewes May 27 '16 at 8:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.