New answers tagged

1

You can check this answer which mentions how does the IV generated for GCM ciphers in TLS 1.2 ... is an AEAD Cipher, so it is in the form of GenericAEADCipher: struct { opaque nonce_explicit[SecurityParameters.record_iv_length]; aead-ciphered struct { opaque content[TLSCompressed.length]; }; } GenericAEADCipher; Here, the ...


1

RFC 4279, section 5.2, says this about identity hints: In the absence of an application profile specification specifying otherwise, servers SHOULD NOT provide an identity hint and clients MUST ignore the identity hint field. Applications that do use this field MUST specify its contents, how the value is chosen by the TLS server, and what the TLS client is ...


2

I understand that AES would be a better choice for applications where all the data is available at once, permitting the use of large blocks. RC4 on the other hand is more suited for applications where continuous data (that may not be available all at once) is to be encrypted (e.g., real-time data). No, this is not accurate. The block size of AES is just ...


3

However, in some protocols descriptions, like TLS 1.3, I find them say the client sends "hello message includes Diffie-Hellman public values for the client's preferred groups". What is "group" refers to?? The term group is a mathematical concept that guarantees that a specific operation doesn't leave a set, that it is associative, that there is a ...


3

are the DH public values exchanged unencrypted? Yes, that are. After all, they are "public values"; there's no weakness in exposing them in the clear. Now, we do have to be careful that they aren't modified in transit (if they can be, then someone can perform a Man-in-the-Middle attack). We do that by having the server sign its key share (using the ...


0

to try again, I guess the attacker need try to modify the last byte No. Some other (symmetric) padding oracle attacks do that, but here the attacker can't tweak the prior block and try another decryption because the MAC error already caused the session to be terminated. Instead the attacker causes the client (browser) to make a new request with the same ...


1

As an addition to the other answers: there are indeed multiple solutions available to you that do not rely on designing your own encryption-scheme and code. This is of importance as it is very easy to make mistakes on both the scheme and the implementation level. You might for example be able to take a certain (trusted) algorithm which should be safe and ...


2

As no particular attack scenario has been given I'd add another, more high level option. When point-to-point transport security isn't supposed to be secure enough then you might consider end-to-end message security or application level security as well. The idea of TLS is that it protects messages from client to server. However, the client and the server ...


3

Your idea lacks forward secrecy, which protocols like TLS often (in newer versions anyway) offer. Otherwise it is close to how such things are usually done. To get forward secrecy you would instead use an ephemeral Diffie-Hellman key exchange, which you would authenticate with the pre-shared public key (which would be a signing key, not an encryption key, ...


0

Basically the padding oracle attack works by changing specific bytes so that the padding matches the expected padding and therefore padding length. Once a byte is found that correctly generates a (not specifically the) padding then then plaintext can be found by XOR'ing this byte with the known information about the byte at that position. The receiver just ...


3

Quoting the answer here: Padding Oracle attacks are mainly a problem in cases, where e.g. an encrypted message is modified and send to a target. These attacks try to measure the difference when decrypting and validating the message. The steps are: decrypting the message checking the padding > error if wrong checking or processing the ...



Top 50 recent answers are included