SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

learn more… | top users | synonyms (2)

1
vote
3answers
90 views

Is it true the longer the key length is the more secure the encryption?

Then why don't we use xxxxxxx bits encryption? what stopping us from using a very lengthy key? I am referring to the encryption we use with SSL
0
votes
1answer
822 views

How does TLS_FALLBACK_SCSV help?

After reading through https://tools.ietf.org/html/draft-ietf-tls-downgrade-scsv-0, I could understand that this option is recommened for use when one has legacy SSL Servers which only support SSLv3. ...
3
votes
3answers
132 views

Why are we not using multiple ciphers per message?

I am aware of at least rsa, elgamal-encryption, and variations of elliptic-curves relying on different problems and that those problems are considered hard. However, if someone figures out a way to ...
-1
votes
0answers
47 views

SSL heartbeat design [migrated]

So, about Heartbleed again, why does SSL/TLS allow the client to specify the message and its length in the heartbeat requests, rather than sending a simple ping?
4
votes
1answer
200 views

SHA1 no longer considered secure for SSL Certificates — what about Cipher Suites?

Many browsers and Internet companies have recently claimed that SSL Certificates with a signature algorithm of SHA1 will imminently no longer be considered secure. Most notably, Google and Google ...
0
votes
0answers
36 views

Protocol for establishing physical ownership of a connected/IoT device?

If I'm connected to a device e.g. using BLE are there rules/protocols for establishing that I'm also in physical possession of that device (at least for the first time I connect to it)? Crypto is in ...
0
votes
1answer
69 views

Is it possible to hand-negotiate an SSL/TLS session?

I'm interested in trying to hand-negotiate an SSL/TLS session. Similar to how one would use telnet to port 80 and type GET / HTTP/1.1. I know there's a lot of steps ...
1
vote
0answers
49 views

What does “G2” mean when used with X509 certficates and certificate authorities?

For example "Google Internet Authority G2"?. I thought it was another way of specifying Class 2 (for organizations, for which proof of identity is required) but then see certificates such as "VeriSign ...
16
votes
7answers
3k views

How can SSL secure a two-way communication with only one key-pair?

As I understand it, SSL involved the use of a public-private key pair. How does this enable two-way communication? Suppose I have some server with which I wish to communicate securely. I connect to ...
1
vote
2answers
137 views

Are SSL/TLS used for maintaining data confidentiality?

In SSL/TLS, we use symmetric and asymmetric keys to encrypt the data. Does that mean that the keys are used to encrypt the data (preserve the integrity) or provide a secure channel for the data to be ...
1
vote
1answer
36 views

Is MAC algorithm same at both sender and receiver end

The MAC algortihm which is used along with a secret key to generate a MAC tag on the sender end ,is it same at the receiver end also who again uses a MAC algorithm to generate a tag? If yes, then how ...
1
vote
1answer
135 views

Is SHA related to AES or TLS in any way

I have been reading about SHA-2 family and I found a lot of in depth details, but I am confused about how it is related to TLS and AES. TLS encrypts data between server and client, but does it make ...
2
votes
1answer
41 views

Is multiple encryption using NaCL and TLS better?

In general, the idea of multiple encryption sounds interesting - for creating stronger cyphers (especially against implementation bugs), one could always get the configuration details wrong and mess ...
1
vote
0answers
97 views

Should layered use of crypto always have a cryptographic binding between the layers?

Reading the latest TLS weakness, it seems that multiple weaknesses have been found over the years caused by not ensuring that messages are sent over the same channel, and in general a lack of ...
14
votes
1answer
927 views

Why do new versions of TLS use an explicit IV for CBC suites?

SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: they used the last part of the previous record, a value that can be predicted by the attacker. ...
28
votes
7answers
15k views

Google is using RC4, but isn't RC4 considered unsafe?

Why is Google using RC4 for their HTTPS/SSL? $ openssl s_client -connect www.google.com:443 | grep "Cipher is" New, TLSv1/SSLv3, Cipher is RC4-SHA Isn't RC4 ...
1
vote
1answer
64 views

Private Key - Memory Lifecycle

I often heard about private key storage, but rarely about key life cycle in memory. For example, when SSL is used from one peer, the private key is used to sign messages or decrypt other peers' ...
4
votes
1answer
2k views

What is the 'Version Incompatibility" Problem in TLS 1.1/1.2 and 1.0?

It's unclear to me if there are multiple problems, or a single one, (and just what that problem is) with servers incorrectly negotiating down from a client offering 1.1 or 1.2 to something they ...
8
votes
2answers
2k views

Why is TLS susceptible to protocol downgrade attacks?

A recent blog post from Ivan Ristić (expert extraordinaire on all things SSL) says: all major browsers are susceptible to protocol downgrade attacks; an active MITM can simulate failure conditions ...
4
votes
1answer
132 views

Using Lattice-based cryptography for TLS\SSL

Given the general benefits of Lattice-based cryptography, such as: Post quantum Security Security from worst case scenario Efficiency What could the outlook of shifting from RSA \ ECC-based ...
5
votes
3answers
365 views

How vulnerable is the C rand() in public cryptography protocols?

I just learned about the basics of public cryptography a few weeks ago and I am curious as to why the C rand() function should not be used for crypto schemes. For example, say I want to generate a ...
3
votes
2answers
3k views

How to distribute session keys in public key cryptography?

In public key cryptography we can also use session keys which are symmetric. How do the sender (say a server) provides this session key information to its clients? If the sender (here server) ...
2
votes
1answer
144 views

generate hash of all handshake messages for verify data (DTLS)

I am trying to create a DTLS client finished packet, where I need to generate verify data for handshake hash is need. And here I want to know how to generate handshake hash. As of now I am doing like ...
2
votes
2answers
181 views

In RSA, why does $p$ have to be bigger than $q$ where $n=p \times q$?

In openSSL – during RSA key generation – if $q$ is bigger than $p$, they exchange them. Why is that?
-2
votes
1answer
55 views

moduli in SSL certificates [closed]

this is normally seen in a typical SSL certificate. For the modulus, I know that it is represented in hexadecimal form, but why is there a semicolon (:) after every group of 2 digits? ...
2
votes
1answer
187 views

SSL-like protocol with public-key hard-coded in the client

Imagine a SSL-like protocol that instead of using certificates signed by a trusted CA, has the server's public key hard-coded in the client. My question is: what happens if the server's private key is ...
1
vote
0answers
60 views

key-exchange with websockets in node.js

I do not see how someone would distribute a “key/key agreement” without exposing it to a MITM! I would consider it to be strange if the answer is “via a HTTPS or TLS connection” because – if this is ...
2
votes
1answer
55 views

TLS - sharing 1792 bits of unidirectional keys

I've just watched a video on the TLS protocol and learnt that it uses unidirectional keys (meaning keys for both sides, from browser to server and from server to browser). Given that the server uses ...
3
votes
1answer
207 views

Why does AES-GCM need MAC? (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)

"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" is just one example for a cipher suite, as far as I'm concerned it means this: it uses the TLS protocol, exchanges keys with Elliptic Curve Diffie Hellman ...
0
votes
0answers
56 views

What are the consequences of not checking the server mac in a TLS connection?

The context for this question (it's quite involved) can be found in this document: https://docs.google.com/file/d/0B15itpMWb2ztWTJrYTgzX204OVU However, I want to make it clear that you don't have to ...
2
votes
1answer
118 views

Pick faster private exponent

I recently tried to send 1536-bit modulus CSR to COMODO. They refused to sign the certificate. I later found out that it's because NIST mandated 2048-bit modulus on the SSL certificate. I think it's ...
4
votes
3answers
4k views

Which one of the Block Cipher modes is the best?

I have two questions regarding the Block Cipher Modes: Which one of the modes is considered the best? I know CBC has a problem of IV since the next block of the plain text is XORed with the result ...
12
votes
3answers
43k views

How secure is AES-256?

The cipher AES-256 is used among other places in TSL/SSL across the Internet. It's considered among the top ciphers. In theory it's not crackable since the combinations of keys are massive. Although ...
1
vote
1answer
98 views

How does this SSL-related flaw work?

I just saw a video at CNN in which it is claimed that, if the server isn't generating a random public key, the server can be hacked. First how HTTPS works… to be sure I’m on the same page: Server ...
2
votes
1answer
137 views

Is AES-256 over AES-128 weakening the original encryption?

When transfering data using TLS the browser and server agree the cipher suite to be used - so for example this could be chosen as AES-128 and is (probably) outside of my control. If I separately ...
1
vote
0answers
22 views

Is TLS_RSA_WITH_RC4_128_SHA still a secure cipher to use? [duplicate]

I have read numerous times that the RC4 cipher itself is considered broken in TLS. Still many websites are using the TLS_RSA_WITH_RC4_128_SHA configuration even to date. Now, I know that sometimes ...
1
vote
1answer
114 views

Does AES 256 really make sense in hybrid crypto systems when the PKI is the bottleneck?

AES 256 is used widely in hybrid crypto systems (e.g. SSL/TLS). According to keylength.com a 2048 bit public key corresponds to 112 bits of security. Does it make sense to use AES 256 in this ...
1
vote
1answer
43 views

How is an X.509 public key used for TLS?

Wikipedia's TLS article says: The client responds with a ClientKeyExchange message, which may contain a PreMasterSecret, public key, or nothing. (Again, this depends on the selected cipher.) This ...
7
votes
1answer
452 views

What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?

It seems the only specified CTR mode ciphers in TLS are all GCM based. GCM ciphers run AES-CTR and do authenticated encryption with a MAC based on Galois-field ...
6
votes
3answers
295 views

Is SSL broken? If so, what can I do about it? [closed]

But recently, with the scandals about the (in)filtrations, I read that the NSA (and of course others, but I'm not particularly worried about NSA) is able to break SSL and track your data. It is true? ...
1
vote
1answer
59 views

Using beginning of TLS ecnrypted data to reveal secret [duplicate]

I have the following question about TLS security: Assume TLS-PSK protected HTTP with AES256-CBC cipher. When a TLS connection is established, client sends some encrypted data, where the plaintext is ...
0
votes
1answer
313 views

CVE-2014-1295 (Apple's Secure Transport and Triple Handshake Attack)

Apple is releasing some updates today. They have not published the bulletins yet, but they are available here: https://gist.github.com/FredericJacobs/11189734. In the writeup for CVE-2014-1295: ...
1
vote
0answers
69 views

Cryptographic library quality [closed]

I've been working on a project that will require secure communication over the internet, so I've been thinking of TLS 1.2. After looking around I chose Botan but then I thought about using a more ...
-1
votes
1answer
65 views

How do they implement MAC in TLS?

I recently read questions about "MAC then Encrypt/Encrypt then MAC" which made me curious about how they actually use the algorithm. MAC only calculated once either case (according to what I read). ...
2
votes
2answers
132 views

Perfect Forward Secrecy in TLS

I read that TLS does PFS using Diffie Hellman. However, DH can be used even without certificates - so how is DHE-RSA better than plain DHE? Is DHE a insecure algorithm, that DHE-RSA is needed?
2
votes
0answers
42 views

Separate TLS Client Write and Server Write Keys in AES-CCM Mode

I am designing a system that uses TLS-like handshaking on a resource-constrained embedded system. I have settled on AES-CCM mode for symmetric session encryption and authentication, allowing ...
2
votes
1answer
151 views

TLS Key Block calculation - What is a PRF?

In Section 6.3 of the RFC for TLS 1.2, it is written that the key_block is derived from the following formula: ...
0
votes
1answer
332 views

TLS/SSL's usage of Non-Ephemeral DH vs DHE

These questions revolve around DH and ECDH vs DHE and ECDHE. Specifically within the context of TLS/SSL. There are three ...
0
votes
1answer
116 views

HKDF vs TLS PRF. Which of the one is better? [closed]

Which of the one (HKDF or TLS1.1+ PRF) is more secure and why?