At the end of the SSL handshake both the client and server send a MAC over all previous messages and the master secret. However, why do we need to MAC the master secret? The master secret is computed at both the client and server independently, and all prior messages are included in the MAC.

  • 2
    It doesn't MAC the master secret. It uses the master secret as a key for the PRF. – cpast May 16 '15 at 21:45
  • @cpast I see. Our lecture slides show that the master secret is MACed with all previous messages. Could that be a mistake? – George Robinson May 17 '15 at 8:23
  • 4
    If you mean the Finished message, the actual RFC says it consists of PRF(master_secret, finished_label, Hash(handshake_messages)) (the TLS PRF syntax is PRF(secret, seed, data), and is essentially HMAC(secret, seed || data)) – cpast May 17 '15 at 8:31
  • 4
    I'm voting to close this question as it is based on a false premise (see @cpast's comment). – SilverlightFox May 17 '15 at 10:15

Browse other questions tagged or ask your own question.