1
$\begingroup$

During the TLS 1.3 handshake using the cipher suite TLS_AES_128_GCM_SHA256 a server and client traffic key/iv will be derived using HKDF based on the shared secret, see rfc8446 #7.1 Why is it necessary to derive the key/iv for both the server and client instead of a single key/iv for encryption and decryption?

$\endgroup$
2
$\begingroup$

Why is it necessary to derive the key/iv for both the server and client instead of a single key/iv for encryption and decryption?

Of course, it's not necessary for TLS 1.3 to be designed that way, however that's the way they decided to do it.

As for why, well, for all the encryption modes supported in TLS 1.3, it is necessary for security to never encrypt two different records with the same key/nonce combination. With the current record design, the encryptor selects the nonce; hence, if two different encryptors (the client and the server) had the same key and selected the same nonce, well, things would be broken.

Now, they could have partitioned the nonce space; for example, tell the servers "you always encrypt with a nonce that starts with a "0" bit" and clients "you always encrypt with a nonce that starts with a "1" bit"; that would work, however they declined to do so.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Is there a specific reason for them to decline that? $\endgroup$ – kelalaka Aug 8 at 16:56
  • 2
    $\begingroup$ @kelalaka: I wasn't a part of the discussion, so I have to guess. My guess is that the question never really came up - previous versions of TLS (and SSL) always had separate keys for the different directions, and they never had a reason to change that. Besides, if they did have the same key in both directions, then each new ciphersuite would have to address the issue, and each one would be a bit different (and I don't believe TLS 1.3 will never get additional ciphersuites - I don't see the IETF disallowing national ciphersuites long term) $\endgroup$ – poncho Aug 8 at 17:09
  • $\begingroup$ @poncho seems like a logical explanation to never use the same key for for more than one message. Unfortunately the reason isn't clearly documented anywhere.. $\endgroup$ – Pakoenator Aug 11 at 16:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.