During the TLS 1.3 handshake using the cipher suite TLS_AES_128_GCM_SHA256 a server and client traffic key/iv will be derived using HKDF based on the shared secret, see rfc8446 #7.1 Why is it necessary to derive the key/iv for both the server and client instead of a single key/iv for encryption and decryption?
$\begingroup$
$\endgroup$
0
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
3
Why is it necessary to derive the key/iv for both the server and client instead of a single key/iv for encryption and decryption?
Of course, it's not necessary for TLS 1.3 to be designed that way, however that's the way they decided to do it.
As for why, well, for all the encryption modes supported in TLS 1.3, it is necessary for security to never encrypt two different records with the same key/nonce combination. With the current record design, the encryptor selects the nonce; hence, if two different encryptors (the client and the server) had the same key and selected the same nonce, well, things would be broken.
Now, they could have partitioned the nonce space; for example, tell the servers "you always encrypt with a nonce that starts with a "0" bit" and clients "you always encrypt with a nonce that starts with a "1" bit"; that would work, however they declined to do so.
-
$\begingroup$ Is there a specific reason for them to decline that? $\endgroup$– kelalakaAug 8, 2020 at 16:56
-
2$\begingroup$ @kelalaka: I wasn't a part of the discussion, so I have to guess. My guess is that the question never really came up - previous versions of TLS (and SSL) always had separate keys for the different directions, and they never had a reason to change that. Besides, if they did have the same key in both directions, then each new ciphersuite would have to address the issue, and each one would be a bit different (and I don't believe TLS 1.3 will never get additional ciphersuites - I don't see the IETF disallowing national ciphersuites long term) $\endgroup$– ponchoAug 8, 2020 at 17:09
-
$\begingroup$ @poncho seems like a logical explanation to never use the same key for for more than one message. Unfortunately the reason isn't clearly documented anywhere.. $\endgroup$ Aug 11, 2020 at 16:29