Hi Ilari,
The problem is the follows:
Take the following input to the MAC (MtE case):
<seqnum> 19 FE FD 63 01 00 05 04 00 02 FF 17
There is no way to tell from that input if it is:
- Application record on CID 63 containing 04 00 02 FF, or
- Application record on CID 63 01 00 05 containing FF.
Maybe you check your example?
Does the 1. assume cid-length := 1?
And the 2. cid-length := 4?
The dtls-record will then contain:
(remove cid-length 01, cid-length is NOT encoded in the dtls-record!)
19 FE FD <seqnum> 63 00 05 04 00 02 FF 17
or
(remove cid-length 04)
19 FE FD <seqnum> 63 01 00 05 00 02 FF 17
For me this seems to be different input to the MAC, if the cid-length is
left out. My feeling is, your example proves my opinion, that it's
better to remove the cid-length from the MAC.
best regards
Achim Kraus
_______________________________________________
TLS mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/tls
