3
$\begingroup$

I have two questions about the sessions keys generated during the last steps of the Handshake phase:

  1. Do the "client write key" and the "server write key" have the same value, even though both keys are generated independently on both sides?

  2. (Same question) Do the "client write MAC key" and the "server write MAC key" have also the same value?

General question: Do the client and server arrive at the same results while generating the session keys?

$\endgroup$
3
  • 2
    $\begingroup$ Does this answer your question? What is the purpose of four different secrets shared by client and server in SSL/TLS?. In short: they are different parts of the common key_block and thus they are different. $\endgroup$ Aug 15 '20 at 14:37
  • 1
    $\begingroup$ If client write key is different from the server write key, then why is it called a symmetric encryption? In symmetric encryption both sides should use the same key $\endgroup$
    – user83003
    Aug 15 '20 at 14:48
  • 1
    $\begingroup$ Yeah, see final section of the answer, I was expecting this confusion :) $\endgroup$
    – Maarten Bodewes
    Aug 15 '20 at 14:50
5
$\begingroup$

Do the "client write key" and the "server write key" have the same value, even though both keys are generated independently on both sides?

No, see the next answer.

For encryption keys this is less important as the message is MAC'ed anyway. However, within TLS 1.2 and before MAC-then-encrypt is used, which may expose some unwanted vulnerabilities. E.g. if the sender is vulnerable to oracle attacks, then you might use that to decrypt messages when the same key would be used. This shows that key separation is always a good idea, as padding oracle attacks were initially not envisioned.

(Same question) Do the "client write MAC key" and the "server write MAC key" have also the same value?

No, they are deliberately different so that you cannot have the senders have their own message being replayed back to them. Basically a KDF (the PRF in TLS 1.2 parlance) uses a different label for each key, which means that each derived key will only be dependent on the master key (using a one way function).

General question: Do the client and server arrive at the same results while generating the session keys?

Yes, that they do. But they simply end up with the same values for each specific key. The client and server derive identical master secrets, and then proceed to use the same labels for the specific keys. So both sides will have the "client write key", but the server will use it to decrypt the messages.

$\endgroup$
2
  • $\begingroup$ Thanks, so from what I understood, client generates the 4 keys: client write key, server write key, client MAC key, server MAC key. Likewise, the server generates: server write key,client write key,client MAC key, server MAC key ? $\endgroup$
    – user83003
    Aug 15 '20 at 14:56
  • $\begingroup$ Yep, that's it. $\endgroup$
    – Maarten Bodewes
    Aug 15 '20 at 15:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.