In TLS1.3 all allowed algorithms included in cipher suites are AEAD, which means they don't just encrypt but they authenticate too (thus if I don't misunderstand, they give not only confidentiality but also integrity/authentication. So, then...why it's necessary to include a Hash algorithm in the cipher suite? I mean...why isn't ChaCha20 (or AES-GCM, etc) enough so Poly1305 (or SHA256, etc) should be necessary?


From RFC 8446, the hash is used for:

  1. The transcript hash, covering every message in the handshake to authenticate it during key agreement and certificate verification (§4.4.1).
  2. Deriving various session keys from raw key agreement material and transcript hash with HKDF (§7.1).
  3. Deriving key material for protocols based on the key negotiated in a TLS session (RFC 5705).

There are other tools in TLS 1.3 that you didn't list. From section E.1.1. in RFC8446

E.1.1. Key Derivation and HKDF Key derivation in TLS 1.3 uses HKDF as defined in [RFC5869] and its two components, HKDF-Extract and HKDF-Expand.

HKDF is HMAC-based Extract-and-Expand Key Derivation Function and defined in rfc5869

The HMAC requires the Cryptographic Hash algorithm specified in the cipher suite, these are SHA256 or SHA384.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.