Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've tried to understand the content of the Finished Message of TLS. I'm using wireshark to capture the traffic between my browser and the internet. I noticed a "stangeness" when the chosen ciphersuite is AES_GCM. Beign it a stream-cipher, it has no padding, so, if I got it right, the data being sent in the Finished Message is:

  • 8 bytes Explicit Nonce
  • 12 bytes verify_data
  • 16 bytes authentication tag

That is, 36 bytes in total. The "problem" is that the Finished Message packet size is 40 bytes.

And here it is:

enter image description here

Why the message packet is 40 bytes and what are the red bytes?

And why wireshark sees two hello requests?

And another this... the Client answers with a 176 bytes packet:

enter image description here

What am I missing?

share|improve this question

migrated from May 12 '14 at 22:00

This question came from our site for software developers, mathematicians and others interested in cryptography.

I believe the nonce is 12 bytes, not 8. – hunter May 12 '14 at 19:58
This question appears to be off-topic because it is about TLS and not crypto; would be better for Security.SE – rath May 12 '14 at 21:05
For what it's worth, I think this was a perfectly reasonable fit on Crypto.SE - TLS is a cryptographic protocol, and the very reason it's "interesting" is because it was built as a protocol (that people then tried to show was cryptographically secure) rather than being cryptographically secure by construction – figlesquidge May 12 '14 at 22:14

Each handshake message has a header, which contains its type (as a handshake message) and length. This header is in addition to the record header. See section 7.4 for a description of the header: one byte for the message type, and three bytes for the message length.

In the case of the Finished message, the header should be 14 00 00 0C (in hexadecimal), with 0x14 meaning "Finished" and 00 00 0C encoding the message contents length (12 bytes). Therefore, what is encrypted with GCM is actually 16 bytes, not 12. GCM adds the 8-byte explicit nonce (which is combined with the 4-byte implicit nonce, yielding the 12-byte nonce that raw GCM actually needs), and the 16-byte authentication tag, for a grand total of 40 bytes, as you observe.

Of course, this record is encrypted, so you don't see its contents; in particular, Wireshark will not show the handshake message header. All it knows from the record header is that the record contains "some handshake data".

As for your second question, it is possible that the client is not content with the handshake and wants to start a new one, immediately sending a ClientHello just after the Finished. Two handshake messages can be merged into a single "handshake" record.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.