How is the TLS 1.2 sequence number generated?

In the other ciphers supported by TLS 1.2, namely stream cipher and CBC block cipher mode, the sequence number is implicitly in the MAC (RFC5246, 6.2.3.1):

MAC = HMAC(MAC_write_key, seq_num +
TLSCompressed.type +
TLSCompressed.version +
TLSCompressed.length +
TLSCompressed.fragment);


How many bytes is seq_num? How is the sequence number generated? There seems to be no explicit information about this in the RFC document.

• Hi Zeta. I've changed the question quite a bit to make it more readable. Please verify that I didn't break it. If the seq_num is mentioned in the section then it is explicit, not implicit. – Maarten Bodewes Sep 18 '18 at 22:34
• FWIW a mnemonic is that RHUL's 'Lucky 13' attack works because the pseudoheader is 13 bytes = 8 +1+2+2 and 13 bytes plus 9 bytes MD-padding is only slightly more than 20 bytes HMAC-SHA1. Okay, not a very simple mnemonic and it's probably easier to just read the RFC :) – dave_thompson_085 Sep 19 '18 at 17:05

How many bytes is seq_num?

To quote the RFC (section 6.1; item 'sequence number')

 Sequence numbers are of type uint64


That is, they are 8 bytes long

How is the sequence number generated?

From the same section:

 A sequence number is incremented after each
record: specifically, the first record transmitted under a
particular connection state MUST use sequence number 0.


That is, the sequence number for the first record is 0, the sequence number for the second record is 1, the sequence number for the hundredth record is 99.

• Thanks.. Is it like server 0,1,2,3... client 0,1,2,3. Or server 0 client 1 server 2 client 3.. – Zeta Sep 19 '18 at 1:29
• And when resumption, does it restart from 0? – Zeta Sep 19 '18 at 1:30
• @Zeta: TLS is not a request-response protocol; instead, either side can send records independently (just like TCP). Hence, the sequence numbers for the client-to-server direction, and the sequence numbers for the server-to-client direction are independent. – poncho Sep 19 '18 at 10:50
• @Zeta: session resumption generates fresh cryptographical keys, and so yes, the sequence numbers restart at 0 – poncho Sep 19 '18 at 10:57