RFC8846 says:

..and the additional data input is the record header.


      additional_data = TLSCiphertext.opaque_type ||
                        TLSCiphertext.legacy_record_version ||

But the length of the encrypted text (which is the length field in the record header) is not known until the encryption is done. It looks to me like a chicken and egg situation. Question is, what I am missing here ?



the length of the encrypted text (which is the length field in the record header) is not known until the encryption is done

The length of the ciphertext is known as soon as the length of the plaintext is known. This is true for any non-broken encryption mechanism. An adversary can easily observe the length of the ciphertext, and if that allows the adversary to deduce anything about the plaintext other than its length, it's a weakness in the encryption.

All the standard AEAD mechanisms for TLS 1.3 (CCM, GCM, ChaCha20+Poly1305) are constructed in such a way that the ciphertext is the application of a stream cipher to the plaintext, followed by a one-time MAC (the authentication tag). Thus the length of the ciphertext is the length of the plaintext plus the tag length of the mechanism (16 for GCM, CCM and ChaCha20+Poly1305; 8 for CCM_8). RFC 8846 is worded in a more general way that would allow AEAD mechanisms with a more complex construction. But whatever the mechanism is, there is a way to calculate the ciphertext length from the plaintext length, although it could be harder than adding a constant.


If you search the file for "additional data" follow the links you will get your answer;

Section 5.2 mentions this;

AEAD algorithms take as input a single key, a nonce, a plaintext, and "additional data" to be included in the authentication check, as described in Section 2.1 of [RFC5116]

that sends you to Section 2.1 of RFC5116 where you will see this;

The associated data A, which contains the data to be authenticated, but not encrypted.

In short; the associated data is not encrypted, only authenticated. It is very useful where encryption is not needed but the only authentication is needed. That is why it is not part of the length of the cyphertext!


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.