I am using DTLS 1.2 and my cipher is TLS_ECDHE_WITH_AES_128_GCM_SHA256

According to RFC 5246(RFC 5246 key calculation) i am calculating keys but i can not find the size of these keys in this RFC.

What is the size of following keys.

1- Client_Write_Mac_Key

2- Server_Write_Mac_Key

3- Client_Write_key

4- Server_Write_key

5- Client_Write_IV

6- Server_Write_IV

  • $\begingroup$ tools.ietf.org/html/rfc5288. The keys are obviously 128 bit for AES-128. You're missing the authentication scheme in your TLS ciphersuite string. $\endgroup$
    – Maarten Bodewes
    May 25, 2016 at 7:59
  • $\begingroup$ but what is the size of MAC key? $\endgroup$ May 25, 2016 at 9:10

1 Answer 1


In the case of a GCM-based ciphersuite, there is no MAC key. If the tool insists on a size, give it 0.

See RFC5246 section (which discusses AEAD ciphers, of which GCM is one example); it explicitly states that, in this case, no MAC key is used.

In addition, the IV sizes are 4 bytes; these 4 bytes are combined with the 8 bytes from the TLS record to form the 12 byte GCM nonce; see RFC5288 second 3.

And, of course, the encryption keys for GCM128 is 16 bytes, yielding a total of:

1- Client_Write_Mac_Key - 0 bytes

2- Server_Write_Mac_Key - 0 bytes

3- Client_Write_key - 16 bytes

4- Server_Write_key - 16 bytes

5- Client_Write_IV - 4 bytes

6- Server_Write_IV - 4 bytes

  • $\begingroup$ I think this answer misses the 4/8/12 byte nonce/IV calculation. And of course the size of the encryption keys, although those should be pretty obvious. $\endgroup$
    – Maarten Bodewes
    May 25, 2016 at 13:18
  • $\begingroup$ @MaartenBodewes: thanks for the reminder -- I initially just answered his plea of 'but what is the size of the MAC key', and forgot that he asked for the rest of the sizes as well... $\endgroup$
    – poncho
    May 25, 2016 at 13:39
  • $\begingroup$ @Maarten Bodewes: when i compute master secret its size is 48 bytes and according to your answer i need 16 + 16 + 4 + 4 = 40 bytes key. Do i expand the key according to RFC 5246 Section 6.3 or use the 40 bytes of master secret? $\endgroup$ May 26, 2016 at 6:15
  • $\begingroup$ @poncho do i need do expand master secret or not? $\endgroup$ May 26, 2016 at 9:07
  • $\begingroup$ @AhsanYounis No you expand the key. The entropy of the master secret may not be completely well distributed. The PRF makes sure that it is. $\endgroup$
    – Maarten Bodewes
    May 27, 2016 at 8:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.