Tagged Questions
0
votes
0answers
27 views
Decrypting TLS in Wireshark when using DHE_RSA ciphersuites [migrated]
How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
4
votes
1answer
98 views
Client and server using same SSL certificate - any issues?
I'm working on software where multiple components will communicate with each other using SSL.
There would be one central component acting as a server, which would also require the clients to present ...
5
votes
1answer
97 views
Using encryption schemes for identification
I've been researching how to implement a post-quantum SSL-like connection authentication, especially correct identification&authentization of the server/client. Because good post-quantum digital ...
5
votes
1answer
488 views
Why is CAMELLIA suddenly so widely used?
When nowadays I point my browser to https sites, the cipher that is on most occasions used is Camellia. My browsers (Chrome and Firefox) seem to prefer it, even when AES is available.
Is that not ...
3
votes
1answer
147 views
Is there a field guide to ECC for the IT Security layman?
I'm trying to understand ECC from an IT layman's perspective and am trying to separate the theory from the standards, and understand why certain features are implemented or not implemented in the ...
0
votes
1answer
156 views
How does a client verify a server certificate?
As far as I know,
when I request a certificate from Verisign (for example), and after they approved that me is me, they create a certificate (for me) which contains the digital signature and public ...
3
votes
2answers
7k views
How secure is AES-256?
The cipher AES-256 is used among other places in TSL/SSL across the Internet. It's considered among the top ciphers.
In theory it's not crackable since the combinations of keys are massive.
Although ...
2
votes
1answer
78 views
Educational videos for security topics [closed]
Is there anything like the famous "sorting out sorting" video in cryptography/security.
I am looking for some nice videos that explaines SSL, SET, IPSec, PGP, S/MIME ....
2
votes
2answers
783 views
How to distribute session keys in public key cryptography?
In public key cryptography we can also use session keys which are symmetric. How do the sender (say a server) provides this session key information to its clients?
If the sender (here server) ...
4
votes
2answers
537 views
What is the purpose of four different secrets shared by client and server in SSL/TLS?
I was looking through the working of SSL V3, and found that a connection state is defined by a set of things, including
client write mac secret,
server write mac secret,
server write key,
client ...
3
votes
3answers
265 views
Does the XML Encryption flaw affect SSL/TLS?
A "practical attack against XML's cipher block chaining (CBC) mode" has been demonstrated:
XML Encryption Flaw Leaves Web Services Vulnerable.
Does this weakness of CBC-mode which is used here also ...
4
votes
1answer
126 views
How common are SEED certificates outside of Korea? When is support required?
I'm looking at the SEED algorithm and would like to know if this is still in common usage.
Can anyone tell me when I would need to implement this standard, either as a client or a server?
6
votes
1answer
375 views
What causes first block of AES decryption to be garbled, even with correct IV?
I am attempting to duplicate wireshark's packet capture decryption for a TLS HTTP session, where I control the private key of the server.
The cipher suite number is 0x00002f, TLS_RSA_AES_128_CBC_SHA
...
15
votes
7answers
1k views
How can SSL secure a two-way communication with only one key-pair?
As I understand it, SSL involved the use of a public-private key pair. How does this enable two-way communication?
Suppose I have some server with which I wish to communicate securely. I connect to ...
