SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

learn more… | top users | synonyms (2)

2
votes
1answer
110 views

generate hash of all handshake messages for verify data (DTLS)

I am trying to create a DTLS client finished packet, where I need to generate verify data for handshake hash is need. And here I want to know how to generate handshake hash. As of now I am doing like ...
2
votes
1answer
209 views

Are SSL modes with forward secrecy vulnerable to the BEAST attack?

From the original BEAST paper, it seems to me that you need the same session key when encrypting data, so you can check if the original plaintext block is the same as your chosen plaintext (which is ...
2
votes
1answer
376 views

Poor man's SSL - is this method as safe as SSL/TLS?

I need to send data between two applications. I've got requirement that says that data should be transmitted using secure protocol such as SSL/TLS. Data is sent using TCP sockets and I don't have ...
2
votes
1answer
114 views

Pick faster private exponent

I recently tried to send 1536-bit modulus CSR to COMODO. They refused to sign the certificate. I later found out that it's because NIST mandated 2048-bit modulus on the SSL certificate. I think it's ...
2
votes
1answer
123 views

Is AES-256 over AES-128 weakening the original encryption?

When transfering data using TLS the browser and server agree the cipher suite to be used - so for example this could be chosen as AES-128 and is (probably) outside of my control. If I separately ...
2
votes
1answer
90 views

TLS Key Block calculation - What is a PRF?

In Section 6.3 of the RFC for TLS 1.2, it is written that the key_block is derived from the following formula: ...
2
votes
2answers
210 views

At what stage is DHE and RSA used during the SSL/TLS handshake?

At what stage of the SSL/TLS handshake is the DHE and RSA used and what is the purpose of using a pre-master secret when you could just use RSA to exchange the symmetric key (i.e. AES) for further ...
2
votes
1answer
110 views

How does SSL secure the initial handshake?

I'm reading the SSL specs, and it seems that the initial handshake has no authenticity protection at all. What is to prevent, say, an attacker from overwriting the "available ciphers" list with one ...
2
votes
1answer
51 views

TLS - sharing 1792 bits of unidirectional keys

I've just watched a video on the TLS protocol and learnt that it uses unidirectional keys (meaning keys for both sides, from browser to server and from server to browser). Given that the server uses ...
2
votes
1answer
284 views

How do TLS 1.1 and 1.2 generate IVs (initialization vectors) for each record?

According to RFC 4346 Explicit IVs [CBCATT] describes a chosen plaintext attack on TLS that depends on knowing the IV for a record. Previous versions of TLS [TLS1.0] used the CBC ...
2
votes
2answers
279 views

Generating IV in TLS 1.2

I'm writing a TLS 1.2 implementation (in C#) using a custom protocol. My question is how to generate the IV attached to each message, I don't want to use RandonNumberGenerator because I've heard it ...
2
votes
1answer
127 views

Separate Read and Write Keys in TLS Key Material

Why does the TLS protocol use different symmetric keys for receiving and sending data? Isn't it enough to have a single key used for both reading and writing?
2
votes
1answer
110 views

Compare RFC 5246 SessionID re-use versus RFC 5077 Session Resumption?

Can you help me understand the differences, both algorithmic and practical, between RFC 5246 SessionID re-use and RFC 5077 Session Resumption? Both appear to be ways to nail up a second TLS session ...
2
votes
1answer
451 views

Is there a standard for OpenSSL-interoperable AES encryption?

Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64). I hear it's some sort of OpenSSL interoperability thing a b c. Is there some ...
2
votes
1answer
101 views

Is it possible to spoof an identity cert modulus?

I was looking at FOAF+SSL and wondering if its possible to spoof the modulus of the browser certificate so that the FOAF and browser certificate's modulus match?
2
votes
1answer
77 views

Do both client and server need to implement OpenSSL protections to protect from CBC attacks

In regards to the protections implemented in OpenSSL 0.9.6d (described in section 2. http://www.openssl.org/~bodo/tls-cbc.txt). My understanding is that the mechanism prepends an empty record when ...
2
votes
1answer
92 views

Educational videos for security topics [closed]

Is there anything like the famous "sorting out sorting" video in cryptography/security. I am looking for some nice videos that explaines SSL, SET, IPSec, PGP, S/MIME ....
2
votes
0answers
75 views

Could BREACH be used to determine an HTTPS URL?

I was reading this article and had a question.... http://arstechnica.com/security/2013/08/gone-in-30-seconds-new-attack-plucks-secrets-from-https-protected-pages/ As I understand it TLS/SSL work in ...
2
votes
0answers
897 views

Cryptographic Protocol using NaCl

Why? I wanted to add some security and privacy to a chat-type server for playing various games (with a few things that are done on the server to limit cheating). Going by the "Don't implement ...
1
vote
4answers
633 views

Would this simple encrypted chat program be feasible using One Time Pads?

Lets say I want to build a simple chat program that has encryption that is impossible to crack for anyone, even a theoretical government with a massive super computer. Ok here's my idea. You'll need ...
1
vote
2answers
117 views

Perfect Forward Secrecy in TLS

I read that TLS does PFS using Diffie Hellman. However, DH can be used even without certificates - so how is DHE-RSA better than plain DHE? Is DHE a insecure algorithm, that DHE-RSA is needed?
1
vote
2answers
319 views

Where is my private key stored when I communicate to a website that uses SSL/TLS?

If I communicate with a website that uses SSL/TLS, my browser will generate a private key. Would the browser store that key on the hard disk or would store just it in the RAM?
1
vote
1answer
36 views

Alert protocol in TLS

Assuming the alert protocol is encrypted AFTER a session has been established and the structure below, how does the client know whether to expect encrypted data or not? ...
1
vote
4answers
331 views

How does TLS generate the shared secret?

From many readings, I got to know that TLS generates master shared secrets using pre-master keys and uses the DH algorithm to generate the shared secret/Master secret. What values during the hello ...
1
vote
1answer
411 views

Sending TLS messages with out encryption using openssl code

Is it possible to send messages over TLS with out encryption? If so which cipher suite is needed for this?
1
vote
1answer
91 views

How does this SSL-related flaw work?

I just saw a video at CNN in which it is claimed that, if the server isn't generating a random public key, the server can be hacked. First how HTTPS works… to be sure I’m on the same page: Server ...
1
vote
1answer
54 views

Using beginning of TLS ecnrypted data to reveal secret [duplicate]

I have the following question about TLS security: Assume TLS-PSK protected HTTP with AES256-CBC cipher. When a TLS connection is established, client sends some encrypted data, where the plaintext is ...
1
vote
1answer
142 views

With TLS and ECDHE, how does curve selection work?

Given that a TLS client and server have already agreed upon ECDHE for session key establishment, how does the selection of the actual elliptic curve ("domain parameters") being used for deriving the ...
1
vote
1answer
150 views

Which keys are necessary to decrypt Application data in a SSL connection?

I'm debugging an application which communicates between client and server using a SSL/TLS connection, and want to capture and analyze the sent data. Are the client write keys and server write keys ...
1
vote
1answer
40 views

How is an X.509 public key used for TLS?

Wikipedia's TLS article says: The client responds with a ClientKeyExchange message, which may contain a PreMasterSecret, public key, or nothing. (Again, this depends on the selected cipher.) This ...
1
vote
1answer
106 views

Does AES 256 really make sense in hybrid crypto systems when the PKI is the bottleneck?

AES 256 is used widely in hybrid crypto systems (e.g. SSL/TLS). According to keylength.com a 2048 bit public key corresponds to 112 bits of security. Does it make sense to use AES 256 in this ...
1
vote
1answer
179 views

SSL-like protocol with public-key hard-coded in the client

Imagine a SSL-like protocol that instead of using certificates signed by a trusted CA, has the server's public key hard-coded in the client. My question is: what happens if the server's private key is ...
1
vote
1answer
162 views

Verifying Self-signed SSL Client Certificates

I have a service and I want to authenticate my clients using SSL client certificates. Now I want the key exchange process to be as simple as possible, kind of like SSH: You generate a keypair and ...
1
vote
1answer
105 views

how does https key get shared?

I am only a beginner and doesn't know much about https. I have heard that they uses somekind of a key and is shared between them. If an attacker wishes to attack could he be able to capturebthe key ...
1
vote
1answer
803 views

How does a client verify a server certificate?

As far as I know, when I request a certificate from Verisign (for example), and after they approved that me is me, they create a certificate (for me) which contains the digital signature and public ...
1
vote
0answers
37 views

key-exchange with websockets in node.js

I do not see how someone would distribute a “key/key agreement” without exposing it to a MITM! I would consider it to be strange if the answer is “via a HTTPS or TLS connection” because – if this is ...
1
vote
0answers
22 views

Is TLS_RSA_WITH_RC4_128_SHA still a secure cipher to use? [duplicate]

I have read numerous times that the RC4 cipher itself is considered broken in TLS. Still many websites are using the TLS_RSA_WITH_RC4_128_SHA configuration even to date. Now, I know that sometimes ...
1
vote
0answers
65 views

Cryptographic library quality [closed]

I've been working on a project that will require secure communication over the internet, so I've been thinking of TLS 1.2. After looking around I chose Botan but then I thought about using a more ...
1
vote
0answers
36 views

Separate TLS Client Write and Server Write Keys in AES-CCM Mode

I am designing a system that uses TLS-like handshaking on a resource-constrained embedded system. I have settled on AES-CCM mode for symmetric session encryption and authentication, allowing ...
1
vote
0answers
249 views

Which eliptic curves in OpenSSL 1.0.1f meet all / most of the SafeCurves requirements? [closed]

I am using nginx compiled with OpenSSL 1.0.1f (most current release available). Nginx allows administrators to set a configuration parameter called ssl_ecdh_curve, ...
1
vote
0answers
40 views

Random numbers for Master Key and Key_block

Exploration through RFCs concludes that random numbers used in the creation of Master Key and Key Block(Key material for Encryption Key and Mac Secret) are from ServerHello.random and ...
1
vote
0answers
71 views

Should layered use of crypto always have a cryptographic binding between the layers?

Reading the latest TLS weakness, it seems that multiple weaknesses have been found over the years caused by not ensuring that messages are sent over the same channel, and in general a lack of ...
1
vote
0answers
83 views

Is it possible to modify SSL handshakes to enable PFS while still using RSA during the handshake?

I know we could possibly be using DH key exchange, that would enable PFS. However, what if we make modifications on our SSL 3.0 handshake such that the only cipher we use is RSA for the achieving PFS? ...
1
vote
0answers
93 views

openssl logs showing keyblock length of only 88 bytes instead of 136 bytes

I was decrypting TLS encrypted data from wireshark using the openssl(TLS1.0 version) TLS logs which provides the complete key block which of size 136 bytes.Now i moved to TLS(1.2 version) in that Key ...
1
vote
1answer
126 views

What should the size of the private exponents in Diffie-Hellman key exchange for TLS be? [duplicate]

I'm using TLS with a Diffie-Hellman key exchange to negotiate the symmetric keys. How long should the exponents be?
0
votes
1answer
98 views

HKDF vs TLS PRF. Which of the one is better? [closed]

Which of the one (HKDF or TLS1.1+ PRF) is more secure and why?
0
votes
1answer
727 views

Does ssl_rsa_with_rc4_128_md5 have known weaknesses?

My bank's website uses HTTPS with the cipher suite ssl_rsa_with_rc4_128_md5. What are the known weaknesses of this suite? Do they have a practical impact for ...
0
votes
1answer
194 views

TLS/SSL's usage of Non-Ephemeral DH vs DHE

These questions revolve around DH and ECDH vs DHE and ECDHE. Specifically within the context of TLS/SSL. There are three ...
0
votes
1answer
411 views

SSTP MSCHAP-V2 Authentication before SSL or after SSL Session

So with the recent news that there's a lovely new tool to crack MSChapV2 packets. So the question I have is on a SSTP Connection is the MSChapv2 handshake encrypted pre SSL setup or post. Obviously ...
0
votes
1answer
279 views

CVE-2014-1295 (Apple's Secure Transport and Triple Handshake Attack)

Apple is releasing some updates today. They have not published the bulletins yet, but they are available here: https://gist.github.com/FredericJacobs/11189734. In the writeup for CVE-2014-1295: ...