I've tried to understand the content of the
Finished message of TLS. I'm using WireShark to capture the traffic between my browser and the internet. I noticed a "strangeness" when the chosen ciphersuite is
AES_GCM. Being it a stream-cipher, it has no padding, so, if I got it right, the data being sent in the
Finished message should be:
- 8 bytes Explicit Nonce
- 12 bytes verify_data
- 16 bytes authentication tag
That is, 36 bytes in total. The "problem" is that the
Finished message packet size is 40 bytes.
And here it is:
Why is the message packet 40 bytes? And what are the red bytes?
And why does WireShark see two
And another this... the Client answers with a 176 bytes packet:
What am I missing?