Subject: Re: [TLS] rfc7366: status

From: Peter Gutmann <[email-masked]>
Date: Sun, 7 Dec 2014 03:09:13 +0000

Nikos Mavrogiannopoulos <[email-masked]> writes:

>Is there any update on RFC7366 errata process? Is there a plan to update the
>existing text?

I'd sent the following as a private message to some of the people involved in
the discussion, I haven't had any feedback yet so I guess it's OK?  In that
case I'll submit it as an update...

-- Snip --

Note that the length value used for the MAC computation differs from the
length value as encoded on the wire since the MAC value is not included in the
MAC computation.  The value of the 'uint16 length' field in the TLSCiphertext
record therefore differs from the length value used in the MAC calculation,
since the TLSCiphertext record contains both the ciphtertext and the MAC,
while the MAC calculation is performed only over the ciphertext.  The length
value encoded in the TLSCiphertext record is therefore 'length' while the
length value used in the MAC calculation is 'length -
SecurityParameters.mac_length'.

More formally, if:

  TLSCiphertext.content = ENC(content + padding + padding_length)

then in TLS notation the MAC calculation for TLS 1.0 without the explicit
Initialization Vector (IV) is:

   MAC(MAC_write_key, seq_num +
       TLSCipherText.type +
       TLSCipherText.version +
       length of (TLSCiphertext.content) +
       TLSCiphertext.content);

and for TLS 1.1 and greater with an explicit IV is:

   MAC(MAC_write_key, seq_num +
       TLSCipherText.type +
       TLSCipherText.version +
       length of (IV + TLSCiphertext.content) +
       IV +
       TLSCiphertext.content);

-- Snip --

I didn't use TLSCiphertext.fragment since that includes the MAC so I've had to
invent a new name 'TLSCiphertext.content', not sure if that's the best option.

Peter.

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Fri, 12 Dec 2014 07:11:43 -0500 (EST)

----- Original Message -----
> case I'll submit it as an update...

I wouldn't use "length of" as it isn't used in other TLS-related
documents, but rather define it as you did for the content, but
other than that it looks ok to me. 

regards,
Nikos