I'm currently using wireshark to analyse TLSv1 traffic. I generate the traffic to an Apache (OpenSSL) using the following java (jdk 6) code :
URL url = new URL(strUrl); HttpURLConnection httpc = (HttpURLConnection) url.openConnection(); httpc.setRequestMethod("POST"); httpc.setDoOutput(true); httpc.setFixedLengthStreamingMode(32); OutputStream out = httpc.getOutputStream(); String request = "A"; byte bytesRequest = new byte; bytesRequest = Character.toString((char)Integer.parseInt(partsRequest)).getBytes("UTF-8"); out.write(bytesRequest); out.flush(); out.close();
The chosen algorithm in the handshake is AES128_CBC_SHA.
So if I understand things correctly, the POST request is encrypted and sent, then we use the last cipherblock of this request as an IV for the message "A" to be encrypted.
However, when sniffing the traffic with Wireshark I noticed that the size of the encrypted data is of 32 bytes even if Wireshark decrypt it only as 1 byte :
So my question is : what is the nature of the appended data, padding, or info about the length of the message, or both ?
Also, I encrypted both 16 and 32 bytes and I respectively end up with 48 and 64 encrypted bytes, even though padding is not necessary (I'm using messages of the block size).