TLS handshake cryptography AES key query

I am working on a IoT project where I am trying to perform manual handshake (SSL) for certificates and sending data to the server securely using HTTPS POST method.

RSA is used for sending Pre-master Secret from client to the server.

I want to know how client or server calculate AES key from:

1. Pre master secret (32 bytes)
2. Client random (32 bytes)
3. Server random (32 bytes)

there are few posts which claims that it is being created by using

PRF(pre-master,client.random,server.random);


I wish C language works in this, but I dont have the PRF function body.

Does anyone have a code for the PRF, or is there any onther way for creating AES key at client side?

Also I would like to know the real use of SHA1/256 in TLS handshake.

Justification with example would be a real help.

I know realise that we ourselves won't derive AES algorithm keys.
But to work with AES one must have MasterKey, which can be derived from ( pre Master, client random and server random ) in TLS 1.3.

So I am stuck on the process of getting masterKey from the above parameters. And even https://tls.ulfheim.net doesn't document the key derivation process using the pre-master secret and the two hellos for TLS 1.2 (or TLS 1.3).

• Writing an SSL/TLS implementation on your own can be troublesome and error-prone. One of our well-reputed member created BearSSL which can target lightweight environments you should check out. After that, just find a good HTTP library to go with it, or you can limit your self to the few actually needed headers and methods. – DannyNiu Nov 4 '19 at 11:15
• @DannyNiu yes I know it could be little troublesome,but as my project requirement is customized thus I am going for it. I have successfully extracted other data from server just need the actual function which is being used by clients like chrome or other devices for generating AES key. Thank you. – Vaibhav Tayade Nov 4 '19 at 11:19
• hi @DannyNiu can you help me with AES key generation function used at client side..? i will be so thankful. – Vaibhav Nov 4 '19 at 11:47
• @VaibhavTayade If you want an explanation of the different parts of a TLS handshake, you might find tls.ulfheim.net interesting. (Not mine; it's just a great reference.) – user7761803 Nov 4 '19 at 15:48
• For RSA keyexchange the premaster is 48 bytes, like the master for all keyexchanges. Note the main issue with security software is that testing it works functionally does nothing to establish its security. You may well get this to 'work' but it almost certainly won't be secure, which means if your 'project' is actually used by anybody there's a very good chance you will cause them serious harm. – dave_thompson_085 Nov 5 '19 at 0:41

1 Answer

Everything is defined in the RFC that specifies the protocol. For example, if you're using TLS 1.2, then see section 5 of RFC: PRF is defined using P_<hash>, where hash depends on the suite negotiated in the handshake; P_<hash> in turn is defined using HMAC.

• Note you don't derive one AES (or other cipher) key, for <=1.2 you derive one master secret and then multiple working keys (at least 2, often 4 or 6); see sections 8.1 and 6.3 in addition to 6. For 1.3 it is substantially different and a good bit more complicated, plus the document is reorganized. – dave_thompson_085 Nov 5 '19 at 0:41
• This is the relevant section for TLS 1.3 – SEJPM Nov 5 '19 at 9:36