3 ms·
Yes, vs RC4-SHA. There's always five bytes of record header: the record type, u16 length and u16 version. (The version is basically a waste.) For AES-CBC ther
by agl 12y ago
Yes, vs RC4-SHA.
There's always five bytes of record header: the record type, u16 length and u16 version. (The version is basically a waste.)
For AES-CBC there's an average of 8 bytes of padding (half the block size).
For AES-GCM there's eight bytes of wasted nonce because of FIPS concerns that appear to have been groundless.
Then there's the MAC: 20 bytes for HMAC-SHA1 or 16 for GCM or Poly1305.
- tptacek 12y agoIf you were designing a new transport to replace TLS, would you build a flexible record layer protocol to run it on top of, in the sense that TLS provides?
- agl 12y agoI'd likely say that the records are AEAD ciphertext and let the AEAD decide on what that means. But as for allowing handshake messages, alert messages etc to mix with application data, no. (See the QUIC design as an example: https://docs.google.com/document/d/1g5nIXAIkN_Y-7XJW5K45IblHd_L2f5LTaDUDwvZ5L6g/edit https://docs.google.com/document/d/1g5nIXAIkN_Y-7XJW5K45IblH...)