[TLS] About TLS 1.2 AEAD ciphers definition

[Juho Vähä-Herttua <[e-mail]>]

Hi,

I'm implementing TLS (including v1.2) and went through the 6.2.3.3. 
chapter of AEAD ciphers definition. The following puzzles me:

       additional_data = seq_num + TLSCompressed.type +
                         TLSCompressed.version + TLSCompressed.length;

       AEADEncrypted = AEAD-Encrypt(write_key, nonce, plaintext,
                                    additional_data)

       TLSCompressed.fragment = AEAD-Decrypt(write_key, nonce,
                                             AEADEncrypted,
                                             additional_data


This seems to be strange in case of AEAD-Decrypt, because 
additional_data contains TLSCompressed information, which is not 
available before decryption. I started to trace it down and found out it 
was changed in draft-ietf-tls-rfc4346-bis-05 back in 2007. To find some 
reason for this change, I noticed the following email:

http://www.ietf.org/mail-archive/web/tls/current/msg01870.html

It seems to me that the change was made after this email and probably as 
a response to it. Before the change AEAD-Encrypt was using 
TLSCompressed.length and AEAD-Decrypt was using TLSCiphertext.length, 
which may be different if the AEAD cipher adds some own padding to it.

So I'm curious to know how is AEAD actually handled and how to find out 
the TLSCompressed.length when constructing additional_data for 
AEAD-Decrypt? I'm sure there are more experienced people here who can 
tell me the answer. Thank you in advance.


Juho