At the end of the SSL handshake both the client and server send a MAC over all previous messages and the master secret. However, why do we need to MAC the master secret? The master secret is computed at both the client and server independently, and all prior messages are included in the MAC.

  • 2
    It doesn't MAC the master secret. It uses the master secret as a key for the PRF.
    – cpast
    Commented May 16, 2015 at 21:45
  • @cpast I see. Our lecture slides show that the master secret is MACed with all previous messages. Could that be a mistake? Commented May 17, 2015 at 8:23
  • 4
    If you mean the Finished message, the actual RFC says it consists of PRF(master_secret, finished_label, Hash(handshake_messages)) (the TLS PRF syntax is PRF(secret, seed, data), and is essentially HMAC(secret, seed || data))
    – cpast
    Commented May 17, 2015 at 8:31
  • 4
    I'm voting to close this question as it is based on a false premise (see @cpast's comment). Commented May 17, 2015 at 10:15


Browse other questions tagged .