DTLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

Question

It is DTLS 1.2 version question of this question.

I know from 4.1.2.4. of RFC 5246 (DTLS 1.2) AEAD Ciphers can be used in DTLS 1.2 exactly the same with TLS 1.2.

In TLS 1.2

AAD = seq_num + TLSCompressed.type + TLSCompressed.version + TLSCompressed.length

It makes sense since it is (implicit) sequence number + header of TLSCiphertext. However at DTLS 1.2 new header field epoch is added. Shouldn't I includes epoch as the AAD too?

In my understanding of DTLS, the below makes more sense. Am I correct?

AAD = DTLSCompressed.type + DTLSCompressed.version + DTLSCompressed.epoch + DTLSCompressed.sequence_number + DTLSCompressed.length

score 1 · Accepted Answer · answered Jun 30 '23 at 06:16

RFC 6347 §4.1.2.1 states

The DTLS MAC is the same as that of TLS 1.2. However, rather than using TLS's implicit sequence number, the sequence number used to compute the MAC is the 64-bit value formed by concatenating the epoch and the sequence number

Similar language is missing from §4.1.2.4. They also use the concatenation of the epoch and the DTLS sequence number as the TLS sequence number in the AEAD associated data.

Effectively, TLS and DTLS both use an 8-byte “sequence number” in exactly the same way, but in TLS it's formed as a single 64-bit number, whereas in DTLS it's formed from a 16-bit number (epoch) and a 48-bit number (which is the part called “sequence number” in the DTLS specification).

DTLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

1 Answers1