I've tried to understand the content of the
Finished Message of TLS. I'm using wireshark to capture the traffic between my browser and the internet. I noticed a "stangeness" when the chosen ciphersuite is AES_GCM. Beign it a stream-cipher, it has no padding, so, if I got it right, the data being sent in the Finished Message is:
- 8 bytes Explicit Nonce
- 12 bytes verify_data
- 16 bytes authentication tag
That is, 36 bytes in total. The "problem" is that the Finished Message packet size is 40 bytes.
And here it is:
Why the message packet is 40 bytes and what are the red bytes?
And why wireshark sees two hello requests?
And another this... the Client answers with a 176 bytes packet:
What am I missing?