I am trying to build an EAP-TLS client. The handshake I have to deal with involves receipt of fragmented messages from the RADIUS server. As a part of the client reply, I have to construct a certificate verify message, which involves hashing all messages involved in the handshake using a private key, to ensure mutual authentication. So, do I treat the fragmented messages as separate messages (because each fragment has an Ethernet header appended to it) or as a single message? Thanks !

1 Answer 1


In TLS, the handshake messages are encoded into records. Each record has its own header. A given handshake message may be spread over several records, and a record may contain several handshake messages.

The hash computations for CertificateVerify and Finished messages is over the handshake messages only: you input the successive handshake messages into the hash function, in due order; each handshake message begins with a four-byte header (one byte for the message type, three bytes for the handshake message length), and these headers go to the hash function as well. The record headers do not enter the hash function.

In other words, fragmentation into records is ignored in the hash computations. The resulting hash value does not depend on how the handshake messages where conveyed, in particular any kind of fragmentation. EAP/TLS defines that the EAP messages contain TLS records. Neither the Ethernet headers, the EAP packet headers, or even the TLS record headers, enter the hash function. Only the handshake message themselves are hashed.

(This allows for a cleanly layered implementation: the SSL/TLS library produces handshake messages which are sent one after the other on a conceptual endless stream of bytes; the stream is hashed; the library does not have to care about how the stream is split into records encapsulated into EAP messages fragmented into individual Ethernet frames.)

  • Thank you !!! Just to clear things up, if my packet is fragmented, I should first combine all the fragments into one reassembled packet like Wireshark does, and then input all the handshake data namely client_hello, server_hello, server_cert, server_key_exch, cert_request and server_hello_done, without their header bits. Am I correct? And I should ignore the EAP Request/Identity messages at the beginning as well, right? Jul 28, 2014 at 15:56
  • For the CertificateVerify, you must hash all previous messages, so ClientHello, ServerHello, Certificate (from server), ServerKeyExchange, CertificateRequest, ServerHelloDone, Certificate (the one from the client) and ClientKeyExchange.
    – Tom Leek
    Jul 28, 2014 at 17:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .