We’re rewarding the question askers & reputations are being recalculated! Read more.

New answers tagged


Everything is defined in the RFC that specifies the protocol. For example, if you're using TLS 1.2, then see section 5 of RFC: PRF is defined using P_<hash>, where hash depends on the suite negotiated in the handshake; P_<hash> in turn is defined using HMAC.


$\text{modBits}$ is the length of RSA modulus $n$ for example if you have 17 as RSA modulus than it has $\texttt{10001}$ as base two representation and has $\text{modBits} = 5$ If you generate a modulus $n$ which is 2048-bit than the $\text{modBits} = 2048$. Keep in mind that, we say a number $n$ is 2048-bit when it is between $2^{2047} \leq n \leq 2^{2048}-...


This is fine. There is one corner case I would note which is that the message from 4 can be replayed in 6. So the authenticated messages should include an indication of whether they are for step 4 or 6. As for how short K can be: as long as necessary to get the guarantee you want from HMAC.

Top 50 recent answers are included