Frame and validate each record
04A record encrypts data, one delimiter and trailing zero padding, then includes a 16-octet AES-GCM authentication tag. The delimiter distinguishes an intermediate record from the final one.
The published final record has eight data octets followed by 02, with no extra zero padding. Its tag still takes 16 octets, so it also fills 25. A shorter final record is allowed; the 02 marker is still required.
Source for this drawing: RFC 8188 · Read RFC section 2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
At most rs−17 data octets fit: reserve one delimiter and 16 tag octets. Non-final records fill rs; the last may be smaller. A valid record needs at least 17 octets, even though rs itself must be at least 18.
- At most rs−17 data octets fit: reserve one delimiter and 16 tag octets. Non-final records fill rs; the last may be smaller. A valid record needs at least 17 octets, even though rs itself must be at least 18.
- Append delimiter 01 for non-final or 02 for final, then zero padding. After authenticated decryption, the delimiter is the last non-zero octet. A decrypter MUST fail for no non-zero octet or the wrong delimiter for that position.
- Additional authenticated data means unencrypted bytes included in the tag check; this coding supplies an empty sequence. Record-aligned random access requires the right header, key and original sequence numbers; partial encrypted records cannot be decrypted.
Published test keys are examples, not secrets to use. This guide does not implement key management or a production cryptographic library.
Read the RFC section ↗