<![CDATA[wolfSSL - Embedded SSL Library — In case of DTLS 1.3 when using NULL cipher the Nonce length invalid]]> https://www.wolfssl.com/forums/topic2470-in-case-of-dtls-13-when-using-null-cipher-the-nonce-length-invalid.html Tue, 10 Feb 2026 15:58:38 +0000 PunBB <![CDATA[Re: In case of DTLS 1.3 when using NULL cipher the Nonce length invalid]]> https://www.wolfssl.com/forums/post8720.html#p8720 Thank you for posting this. I've noticed you sent the same request to support@wolfssl.com.  I will help you there.

]]> Tue, 10 Feb 2026 15:58:38 +0000 https://www.wolfssl.com/forums/post8720.html#p8720 <![CDATA[In case of DTLS 1.3 when using NULL cipher the Nonce length invalid]]> https://www.wolfssl.com/forums/post8719.html#p8719 Version
master branch, commit from 2026.02.06 (hash: 25db90...)

Description
I am using DTLS 1.3 with TLS_SHA384_SHA384 (integrity only, NULL cipher)
In this case when the BuildTls13Nonce gets executed, the seq_offset calculated as follows:

int seq_offset = AEAD_NONCE_SZ - SEQ_SZ;

According to my understanding, the seq_offset is variable and should depend on the size of the HMAC Nonce.
In wolfssl this is called HMAC_NONCE_SZ

Explanation:

According to Section 5.3 ("Per-Record Nonce") of RFC 8446 (https://www.rfc-editor.org/rfc/rfc8446#section-5.3):

"The resulting quantity (of length iv_length) is used as the
per-record nonce."

This means that the nonce has to be the same length as the IV.

According to Section 6 ("Key Schedule when Using Integrity-Only Cipher Suites") of RFC 9150 (https://www.rfc-editor.org/rfc/rfc9150.html#section-6), the IV length of TLS_SHA384_SHA384 is 48.

Therefore, these two combined mean that the nonce length in case of TLS_SHA384_SHA384 shall be 48.

See also:  https://github.com/wolfSSL/wolfssl/issues/9757

]]> Tue, 10 Feb 2026 13:36:39 +0000 https://www.wolfssl.com/forums/post8719.html#p8719