0
$\begingroup$

I know that TLS ciphers such as TLS_RSA_WITH_AES_128_CBC_SHA transmit data as shown https://tools.ietf.org/html/rfc5246#section-6.2.3.2. From my understanding the ciphertext MUST be a multiple of the block size, which in this case is 16 bytes. However when I look at the below output from wireshark, I'm confused. After subtracting the 16 bytes corresponding to the IV from the beginning of the Encrypted Application Data, that leaves 100 bytes of ciphertext which is obviously not a multiple of 16. What am I not understanding?

enter image description here

EDIT: I've included information about the ciphersuite

enter image description here

$\endgroup$

closed as off-topic by e-sushi Jun 18 '18 at 10:25

  • This question does not appear to be about cryptography within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

1
$\begingroup$

The default mode of TLS use MAC-then-Encrypt, it compute the tag, append it to the message, and then padd it to have a length multiple of the block size (16 in our case). However, you can change the default mode to use Encrypt-then-MAC (which eliminates risks of padding attacks over AES-CBC). In this case, the message is padded and encrypted, and only then you compute the tag and add it at the end.

In your case, TLS_RSA_WITH_AES_128_CBC_SHA use SHA1, which produce a 20 bytes long tag : $$116-20=96=16\times 6$$

That's the only way I have to explain it, but both the server and the client have to implement the option Encrypt-then-MAC.

$\endgroup$
0
$\begingroup$

From my understanding the ciphertext MUST be a multiple of the block size, which in this case is 16 bytes.

That depends on what the ciphersuite is. For CBC-mode suites, such as TLS_RSA_WITH_AES_128_CBC_SHA, that is the case, as padding is applied to make the 'plaintext' (which includes the MAC) a multiple of 16. However, for AEAD-based suites, such as TLS_RSA_WITH_AES_128_GCM_SHA256, no padding is involved, and so if the original plaintext (which, in this case, is only the protected data) was 92 bytes long, then the ciphertext would indeed be 116 bytes long.

So, are you certain that the ciphersuite is, indeed TLS_RSA_WITH_AES_128_CBC_SHA?

$\endgroup$
  • $\begingroup$ Yes absolutely, hence my confusion. $\endgroup$ – user3452345224 Jun 18 '18 at 1:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.