2

I've tried to understand the content of the Finished Message of TLS. I'm using wireshark to capture the traffic between my browser and the internet. I noticed a "stangeness" when the chosen ciphersuite is AES_GCM. Beign it a stream-cipher, it has no padding, so, if I got it right, the data being sent in the Finished Message is:

  • 8 bytes Explicit Nonce
  • 12 bytes verify_data
  • 16 bytes authentication tag

That is, 36 bytes in total. The "problem" is that the Finished Message packet size is 40 bytes.

And here it is:

enter image description here

Why the message packet is 40 bytes and what are the red bytes?

And why wireshark sees two hello requests?

And another this... the Client answers with a 176 bytes packet:

enter image description here

What am I missing?

Improve this question
3
  • I believe the nonce is 12 bytes, not 8.
    – hunter
    May 12, 2014 at 19:58
  • 1
    This question appears to be off-topic because it is about TLS and not crypto; would be better for Security.SE
    – rath
    May 12, 2014 at 21:05
  • For what it's worth, I think this was a perfectly reasonable fit on Crypto.SE - TLS is a cryptographic protocol, and the very reason it's "interesting" is because it was built as a protocol (that people then tried to show was cryptographically secure) rather than being cryptographically secure by construction
    – Cryptographeur
    May 12, 2014 at 22:14

1 Answer 1

Reset to default
4

Each handshake message has a header, which contains its type (as a handshake message) and length. This header is in addition to the record header. See section 7.4 for a description of the header: one byte for the message type, and three bytes for the message length.

In the case of the Finished message, the header should be 14 00 00 0C (in hexadecimal), with 0x14 meaning "Finished" and 00 00 0C encoding the message contents length (12 bytes). Therefore, what is encrypted with GCM is actually 16 bytes, not 12. GCM adds the 8-byte explicit nonce (which is combined with the 4-byte implicit nonce, yielding the 12-byte nonce that raw GCM actually needs), and the 16-byte authentication tag, for a grand total of 40 bytes, as you observe.

Of course, this record is encrypted, so you don't see its contents; in particular, Wireshark will not show the handshake message header. All it knows from the record header is that the record contains "some handshake data".

As for your second question, it is possible that the client is not content with the handshake and wants to start a new one, immediately sending a ClientHello just after the Finished. Two handshake messages can be merged into a single "handshake" record.

Improve this answer

You must log in to answer this question.