New answers tagged

2

Quoting from RFC 4492 All ECDH calculations (including parameter and key generation as well as the shared secret calculation) are performed according to [IEEE 1363, 2000] using the ECKAS-DH1 scheme with the identity map as key derivation function (KDF), so that the premaster secret is the x-coordinate of the ECDH shared secret elliptic ...


1

Since this is still open and the issue keeps coming up: TLDR: There are lots of things in OpenSSL that implement standards including AES, but the key derivation part of enc is partly nonstandard First, OpenSSL has several commandline operations it calls commands (although they usually aren't separate programs, as typical commands are on Unix), and a whole ...


5

In the case of a GCM-based ciphersuite, there is no MAC key. If the tool insists on a size, give it 0. See RFC5246 section 6.2.3.3 (which discusses AEAD ciphers, of which GCM is one example); it explicitly states that, in this case, no MAC key is used. In addition, the IV sizes are 4 bytes; these 4 bytes are combined with the 8 bytes from the TLS record to ...


1

Handshake differs greatly between SSLv2 and SSLv3. All versions of TLS (1.0, 1.1, 1.2) use the SSLv3 format and although they add some new options and features they don't alter the basic flow relevant to DROWN. Although formatted differently, the security content of SSLv2 ClientMasterKey is the same as SSLv3/TLS ClientKeyExchange when using RSA keyexchange, ...


1

No, it's not a mistake. After Bleichenbacher's attack was discovered, the fix throughout SSL/TLS was to prevent the "padding oracle" by decrypting and following this strategy: if the PKCS#1v1.5 padding is correct, then use the PMS obtained; if the PKCS#1v1.5 padding is incorrect, then use a random PMS. This prevents the oracle since an attacker who doesn't ...


3

SSLv2 has the property that after it receives an encryption of the pre-master secret, the server sends a message that uses the derived key. (This is unlike SSLv3 where the server first checks the MAC from the client.) Now, when using a ciphersuite with 40-bit keys, it is possible to brute force and find the derived key. Importantly, in SSLv2, the derived key ...


1

EDITED to cover DTLS for edited question, plus two small fixes In the Finished Message FOR TLS, verify data is a 12 byte long except if stated otherwise in the ciphersuite, so in your case it is 12 byte long. It is in the following handshake message form: struct { HandshakeType msg_type; /* handshake type */ uint24 length; /* ...



Top 50 recent answers are included