2

I'm trying to implement, as an exercise, a protocol based on the cipher suite ECDHE-RSA-AES256-GCM-SHA384.

As I understand things, ECDHE is used for the key exchange, RSA for the authenticity of the ECDHE public key, AES (in GCM) for encipherment, and SHA to get a random-like key to use with AES from the ECDHE derived secret key.

Now the thing I don't understand is that AES256 requires a 256 bits key but SHA384 produces a 384 digest. So I have two questions:

  • Why not simply use SHA256 here to produce a digest whose size matches the expected size for the cipher algorithm key ? (Has it something to do with the fact that both AES256 and SHA384 operate faster on 64 bits architectures ?)
  • What operation should one perform to use the 384 bits digest as an AES256 key ? Just keep the first 256 bits ? Or am I missing something ?
Improve this question
3
  • 1
    I'm pretty sure the TLS specification describes how to use the KDF to derive the required keys. You need to produce at least two AES keys (one for each direction) and possibly some IVs. Read the specification, and if you still have problems, cite the part you're having trouble with.
    – CodesInChaos
    Mar 12, 2014 at 9:13
  • @CodesInChaos: Would you have a link to this specification ? If found this but I'm not sure it is the one you are talking about.
    – ereOn
    Mar 12, 2014 at 10:28
  • 1
    There are "5. HMAC and the Pseudorandom Function" and "6.3. Key Calculation" in the TLS 1.2 spec you linked. There are also rfc5288 and rfc5289 for GCM specific stuff.
    – CodesInChaos
    Mar 12, 2014 at 10:35

1 Answer 1

Reset to default
3

According to RFC5246, the TLS 1.2 spec, SHA384 is used for signatures and MACs, not for a KDF.

Additionally, section 1.2 of the document specifies that all TLS 1.2 cipher suites use P_SHA256 as the PRF for Key Calculation, so they use a SHA256-based pseudorandom function defined in section 5. The PRF specifies a way of generating exactly as much data as necessary (modulo the SHA-256 block size). Excess data within the final block is simply discarded off the end.

Improve this answer
1
  • 2
    rfc5246 1.2 and 5 say all ciphersuites "in this document" use the PRF in section 5 with SHA-256. The ciphersuite in the question is not in rfc5246; as @CodesInChaos commented it is in rfc5288 which says it uses "the TLS PRF ... with SHA-384 as the hash function." And as you say that PRF generates as many blocks as needed.
    – dave_thompson_085
    Aug 6, 2015 at 9:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .