SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

learn more… | top users | synonyms (2)

2
votes
1answer
37 views

Insecure third party connection

My organization processes some PII data and shares it with an outbound connection (outflow only) that is a third party. The data transfer transactions occur without human intervention. That outbound ...
2
votes
0answers
7 views

How to decrypt SSL data on a considered-to-be-compromised host? [migrated]

I have a package which I want to encrypt on my machine and send it to another remote machine. If I use asymmetric encryption, I must have the private key on the remote side. However, I don't trust the ...
1
vote
1answer
20 views

Size of Pre-Master Secret?

I am implementing TLS 1.2 and using cipher ECDHE_RSA_WITH_AES_128_GCM_SHA256 According to RFC 5346 Section 8.1 length of premaster secret will vary depending on key exchange method. So, what is the ...
3
votes
1answer
48 views

DTLS 1.2 Key Expansion

I am using DTLS 1.2 and my cipher is TLS_ECDHE_WITH_AES_128_GCM_SHA256 According to RFC 5246(RFC 5246 key calculation) i am calculating keys but i can not find the size of these keys in this RFC. ...
1
vote
0answers
40 views

DTLS 1.2 Finished message

I am implementing DTLS 1.2 and using ECDHE_RSA_AES_128_GCM_SHA256 cipher suit. Below is my client finished message Can anyone explain this message? How many bytes for verify data? Is there ...
0
votes
1answer
15 views

DROWN - decrypting ServerVerify message is not enough?

I have read this article, but I can't understand why after decrypting ServerVerify, the client needs to send the export grade PMS again... When exploiting these flaws the attacker will send its ...
1
vote
0answers
16 views

finished message layout in TLS version 1.2 [duplicate]

Is there anyone that can explain what wrong with my understanding about 'finished message layout' in TLS version 1.2 ? I'm trying to implement it for my own purpose, upgrading host-to-host ...
0
votes
1answer
40 views

DROWN Attack - Which is the SSLv2 vulnerability exploited?

In order to get the session key used in TLS communication, an attacker must capture X TLS handshakes based on RSA key encryption, and switch to a server supporting SSLv2 protocol, and sharing the same ...
1
vote
1answer
53 views

Handshake SSLv2, SSLv3, TLS

Can someone confirm that SSLv2, SSLv3, and TLS have the same Handshake process (ClientHello/ServerHello, ..., ClientKeyExchange ...)? If not, can you tell me the main differences between theses three ...
0
votes
0answers
25 views

TLS 1.2 PRF Cipher Suite Specification

I am upgrading our assembler SSL/TLS implementation to support TLS 1.2 and am reviewing RFC5246 specification for TLS 1.2. It states that the PRF is now part of the cipher suite specification but ...
1
vote
1answer
109 views

tls 1.2 finished message stucture

I am implementing TLS 1.2 and using ECDHE_RSA_AES_128_GCM_SHA256 cipher suit. According to RFC 5246 finished messages have {verify_data[verify_data_length]} and verify_data = PRF(master_secret, ...
6
votes
1answer
221 views

Authentication by hardcoding public key in client software

It would seem to me that mobile applications could reduce network traffic by hardcoding the server's public key into the app. The idea being that they could then encipher a secret to share with the ...
6
votes
1answer
108 views

What does the TLS 1.2 client finished message contain?

I am implementing TLS 1.2 and I'm stuck on the client finished message. My question is: what is the size and structure of a clients finished message in TLS 1.2 when using the ...
0
votes
1answer
10 views

Can TLS session resumption work after client dropped connection & reconnected to server?

I'm developing a sensor node and investigating TLS/OpenSSL. The network the node runs behind could drop and reconnect a lot. The node has limited data plan so data overhead is the key where TLS ...
3
votes
2answers
64 views

Is Schannel supposed to use SHA1 for (EC)DHE params?

I captured a TLS 1.2 handshake on my server (WIN2012.R2/IIS 8.5) and noticed that SHA1 is being used to hash ECDHE parameters despite both the server and client(s) supporting SHA2 signatures. ...
2
votes
2answers
60 views

What's the appeal of using ChaCha20 instead of AES?

I read about ChaCha20 being used in TLS by Google, SSH, and towards standardization in general. What's the appeal of using something other than AES, what with AES receiving dedicated CPU instructions ...
3
votes
0answers
33 views

Is an instruction similar to PCLMULQDQ valuable in post quantum key exchange?

This paper describes a Quantum Key Exchange based on the Ring Learning With Errors problem. When used with ECC, there is only a slight performance impact. Assuming this is the popularized approach ...
5
votes
0answers
40 views

What's the reasoning behind the design of the TLS 1.2 PRF?

TLS 1.2 defines a PRF-like construction $P_{hash} : \{0,1\}^* \times \{0,1\}^* \rightarrow \{0,1\}^l$ for key derivation, etc. To quote the spec: We define a data expansion function, ...
0
votes
2answers
127 views

How does SSL work on the browser

I recently bought an SSL certificate from a website and was able to make it work on my Apache server. As far as I know, it uses asymmetric keys and the private key is stored on the server while the ...
3
votes
1answer
27 views

Reuse of TLS client key/certificate in challenge-response protocol

The situation: We have a custom PKI with clients communicating with the server over standard SSL/TLS encrypted channel. PKI uses ECC, server certificate supports ECDHE_ECDSA key exchange mechanism and ...
1
vote
0answers
28 views

TLS padding format

My question is about how the padding is formated in TLS1.0, 1.1, 1.2, 1.3 I came across the PKCS7 format for the padding: ...
0
votes
1answer
44 views

what is DHE_EXPORT cipher suite

I need to know what is exactly DHE_EXPORT cipher suite and why it is still supported by some servers. Is there any implementation or details about this weak crypto?
0
votes
1answer
30 views

SSL Traffic Inspection

Is the firewall decrypted my session? There is an error "Certificate Not Trusted" (Server Certificate changed to Firewall Cyberoam Certificate). Which public Key I got? Is Main server Public Key or ...
0
votes
2answers
59 views

Would a non-deterministic (read: randomized) compression algorithm be crypto-safe?

Would a compression algorithm that randomly shifts stuff around every iteration be TLS/crypto-safe? This randomization would prevent the same byte sequence from appearing twice in a row, thus making ...
4
votes
1answer
33 views

Is it okay to use a variable-time RSA implementation to verify TLS certificates?

RSA as implemented by OpenSSL et al. needs to protect against side channel attacks, at a big performance penalty. However, TLS certificate validation involves no secrets. Therefore, I should be able ...
4
votes
1answer
88 views

How does a company like Apple keep its keys safe? [closed]

Whatever key is used to sign new iOS updates (for example) must be incredibly well-protected. How does a huge corporation like Apple keep those 4096 bits safe?! Same goes for SSL keys for websites ...
1
vote
1answer
38 views

What is the last value in a cipher suite?

I understand that a cipher suite should contain the MAC algorithm at the end. So ECDHE-RSA-AES128-SHA256 should use SHA256 in HMAC for the MAC. But what about the ...
0
votes
0answers
27 views

How does TLS differ from SSH from a strictly cryptographic perspective?

How does TLS differ from SSH from a strictly cryptographic perspective? I know that there are many non-cryptographic differences between them, but I would like to know the cryptographic ones.
1
vote
1answer
27 views

Does TLS have to provide both confidentiality and authenticity?

I'm working on a project that uses OAuth. In the OAuth RFC it says many times that communication between the authentication server and the client should be with the use of TLS. However, in the project ...
0
votes
1answer
18 views

What will browser show when a user access website and website present certificate of some other domain with same top level domain [closed]

For example, User tries to access a.example.com and server presents abc.example.com with a.example.com not in SANs list. Will it be just a warning or an error?
2
votes
1answer
37 views

I am trying to implement TLS v1.1 {3,1} but get alert 70 on hellomessage to goolge

I am trying to implement TLS on top of the winsock api's from windows. I am using port 443 and have created a socket. I have sent this message in decimal. ...
1
vote
1answer
38 views

OpenSSL & TLS1.2 with aes-cbc and initialization vector

I'm trying to manually decrypt DTLS traffic using OpenSSL and TLS 1.2. The cipher suite im using is AES256-SHA256 as listed here. Im able to decrypt the packets with the key that the server and the ...
0
votes
4answers
183 views

How is a message digest decrypted?

Trying to get my head around digital signatures and hit a slight block. The book I am using gives the following information Device A hashes a message to create a message digest Device A encrypts ...
2
votes
1answer
38 views

Can one passively load-balance HTTPS traffic based on TLS SNI?

Is it theoretically possible to passively snoop into the HTTPS traffic, reliably detect whether or not TLS SNI is attempted to be used by the client, and, if it is, redirect the stream of the ...
7
votes
2answers
151 views

Is TLS secure against VM reset attacks?

Is the TLS protocol secure against VM reset attacks? Background: Imagine running cryptographic software inside a virtual machine (VM). A VM reset attack is one where the the state of the software is ...
5
votes
1answer
90 views

How is SSL secure?

if the client and the server need to exchange keys and I can sniff it, wouldn't I be able to decrypt the data transported?
4
votes
1answer
147 views

Determining if Server/Client's TLS configuration is Vulnerable to SLOTH

In the context of SSL/TLS protocol and SLOTH vulnerability. I want to find out if certain websites(webservers) or applications that use TLS are vulnerable. I need some guidance for this. My idea is ...
3
votes
1answer
34 views

What is PCT_SSL_CIPHER_TYPE_1ST_HALF?

I'm writing a tool to do security posture assessments of SSL/TLS services, and ran into an interesting result. I ran through all defined cipher suites to test which could be negotiated (like sslscan ...
1
vote
2answers
196 views

Certificate Signature Algorithm differs from Signature Algorithm Negotiated for Connection

With the upcoming sunsetting of SHA-1 by browsers I was checking signature algorithms for sites I visit. I'm using Firefox 43.0.2 on Windows. I noticed something interesting when I visited the site ...
2
votes
1answer
296 views

Authenticated Encryption of UDP packets

I am working on a UDP based file transfer protocol. Congestion Control, Resending of packages and other UDP challenges are dealt with - speedtests shows that the protocol is up to 10 times faster than ...
1
vote
1answer
69 views

Username and Password: How does it work?

Suppose a client (Alice) goes to an HTTPS website (Bob) over TLS 1.2. Alice sends Client Hello with some random number $r_a$. Bob sends Server Hello with another random number $r_b$. Suppose they ...
6
votes
1answer
113 views

Non-deniability of data sent over TLS

Andy is going to connect to a server Selma over TLS. Later, Andy would like to be able to publish everything (the ciphertexts, the plaintexts, all his keys) and prove to a mediator what data he sent ...
2
votes
1answer
110 views

Message security and also program copy detection

Imagine I have client and server running on different machines, each as a separate software. I want to ensure: message authenticity, integrity and confidentiality at least of messages coming from ...
3
votes
1answer
63 views

How does padding oracle attack work with bytes larger than possible length?

I am trying to understand how the POODLE attack would actually be implemented. In the original security advisory from Möller, Duong and Kotowicz [POODLE 14] the following example is presented: ...
2
votes
1answer
208 views

RSA vs ECDSA/ECDH

So we've been using RSA for a while now. I wonder, is it still secure? I'm wondering whether surveillance agencies can at this point read traffic encrypted with say, TLS_ECDH_RSA_WITH_AES_128_GCM? ...
3
votes
1answer
107 views

TLS RSA Certificate with Elliptic Curve Negotiation

When I look at Google's Public Key in Firefox I get PKCS #1 SHA-256 With RSA Encryption Yet according to SSL Labs Google has EC 256 bits / SHA256withRSA and supports ...
2
votes
0answers
78 views

Why is SSL/TLS so complicated?

I'm new to SSL/TLS and I'm staring as a new security researcher. It appears to me that SSL/TLS protocol is needlessly complex for arriving at a shared secret. The complexity results in so many bugs ...
0
votes
1answer
38 views

Understanding SSL vulnerability within Apple's GOTOFAIL

Currently learning and reading about the fascinating SSL Key Exchange and came upon the Apple GOTOFAIL incident back in 2014. I'm going through the code during that time and came across this section. ...
0
votes
1answer
77 views

Why does TLS 1.2 use GCM with additional SHA hash? [duplicate]

I am studying the cipher suites provided by TLS 1.2 and found an interesting question. TLS 1.2 adopts GCM for encryption and SHA256 or SHA384 for hash (e.g. TLS_RSA_WITH_AES_128_GCM_SHA256). But, GCM ...
3
votes
1answer
77 views

Are HTTPS web sessions non-repudiable?

(This is probably a basic question, and may be a duplicate; if so, just let me know.) Suppose there are two clients A and B, ...