In draft 11 of TLS 1.3, additional_data is empty. Why?


First, thanks to StackzOfZtuff for digging through the various commits and finding out which are relevant.

From my understanding version and sequence where removed in draft 11 from additional_data since they were already protected by other means or no protection was needed in the first place. This is indicated by issue 278 which removes the version since it is not variable anymore. And in issue 318 the sequence number is removed given that the nonce is already included in AEAD input and the nonce is directly derived from the sequence number, which means that no addition protection for the sequence number is needed. Since these were the only data contained in additional_data it was now empty.

In draft 25 additional_data where set to include the record layer header (i.e. type, legacy version and length) after a discussion in issue 1145 successfully argued that not only the encrypted data but also the record layer header need to be protected against modifications.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.