Derive a per-message key and nonce
04A second extraction uses the public message salt and the IKM. Separate labels then derive the content-encryption key and nonce.
The single Web Push record has sequence number zero. Its XOR step leaves the derived 12-byte nonce unchanged. The receiver recomputes the same values from its secret material and the public salt and sender key.
Source for this drawing: RFC 8291 · Read RFC section 3.4 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The key, nonce and two kinds of salt are not interchangeable.
- The application server generates a random 16-byte message salt and places it in the body’s content-coding header. For a fixed IKM, the same salt MUST NOT be reused for different bodies (RFC 8188 §§ 2.1/4.3).
- Extract a second pseudorandom key, PRK = HMAC-SHA-256(message salt, IKM). The key label is Content-Encoding: aes128gcm followed by 0x00; HKDF-Expand selects 16 bytes for the content-encryption key (CEK).
- The separate label Content-Encoding: nonce followed by 0x00 derives 12 nonce bytes. HKDF’s 0x01 block counter is distinct from each label’s zero byte.
- Web Push MUST use one record. Its record sequence number is zero, so XOR with that number leaves the derived nonce unchanged. The nonce is not twelve zero bytes.
RFC 8188 §§ 2.2–2.3 specifies the second schedule. AEAD_AES_128_GCM is AES in Galois/Counter Mode with a 128-bit key and authentication; the nonce is a per-key encryption input. The displayed fixed values are public RFC test data, not keys to reuse for real messages. These illustrations do not send notifications or implement a production encryptor.
Read the RFC section ↗