4

In rfc8446, it says

HKDF-Expand-Label(Secret, Label, Context, Length) =
    HKDF-Expand(Secret, HkdfLabel, Length)

Where HkdfLabel is specified as:

struct {
    uint16 length = Length;
    opaque label<7..255> = "tls13 " + Label;
    opaque context<0..255> = Context;
} HkdfLabel;

Derive-Secret(Secret, Label, Messages) =
    HKDF-Expand-Label(Secret, Label,
                      Transcript-Hash(Messages), Hash.length)

But in rfc8448(page 5),

{server}   derive secret for handshake "tls13 derived":
PRK (32 octets): 33 ad 0a 1c 60 7e c0 3b 09 e6 cd 98 93 68 0c e2
   10 ad f3 00 aa 1f 26 60 e1 b2 2e 10 f1 70 f9 2a
hash (32 octets): e3 b0 c4 42 98 fc 1c 14 9a fb f4 c8 99 6f b9 24
   27 ae 41 e4 64 9b 93 4c a4 95 99 1b 78 52 b8 55
info (49 octets): 00 20 0d 74 6c 73 31 33 20 64 65 72 69 76 65 64
   20 e3 b0 c4 42 98 fc 1c 14 9a fb f4 c8 99 6f b9 24 27 ae 41 e4
   64 9b 93 4c a4 95 99 1b 78 52 b8 55

expanded (32 octets): 6f 26 15 a1 08 c7 02 c5 67 8f 54 fc 9d ba
   b6 97 16 c0 76 18 9c 48 25 0c eb ea c3 57 6c 36 11 ba

Look into info octets. 00 20 0d this third '0d' is label size.. and there is '20' in front of hash bytes. This is size of the context.

rfc8446 should be like this.

struct {
    uint16 length = Length;
    uint8 label_size;
    opaque label<7..255> = "tls13 " + Label;
    uint8 context_size;
    opaque context<0..255> = Context;
} HkdfLabel;

Am I right?

I have one more question. where did the hash(32 octets) e3 b0 c4 .... come from? I could not get the value by hashing client hello with hmac, sha256, or anything...

5

You are not right. The 'variable-length vector' construct notated as type item <min..max> in TLS includes a prefix length field; see section 3.4 in rfc8446 or 4.3 in earlier versions.

The phase-to-phase steps in the TLS1.3 key schedule use "" i.e. an empty byte sequence/string, aka nothing, null, nil, or (in some environments) epsilon, for the 'Messages' parameter to Derive-Secret; see section 7.1. The value you quoted from rfc8448, which you will observe is the same for all "tls13 derived" operations, is SHA-256 of nothing.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.