165 reputation
4
bio website tavendo.de
location Erlangen, Germany
age
visits member for 5 months
seen Mar 31 at 13:32

I am founder of Tavendo, an enterprise software startup. We make Autobahn, open-source client and server implementations of the WebSocket and the WebSocket Application Messaging Protocol (WAMP) as well as Tavendo WebMQ, the Web Message Broker, a virtual appliance providing a fully integrated WAMP-based message broker running on VMware, Amazon EC2 and VirtualBox.


Dec
22
comment With OpenSSL and ECDHE, how to show the actual curve being used?
Awesome, thanks! If I get this right, I can now see the actual curve negotiated in the end, but not the curves announced by the client in the first place?
Oct
28
comment What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?
For reasons other than mere performance, e.g. simpler to get right in software without side-channel attack vectors. Also the principle cipher seems to be around longer than GCM. I am just wondering: why hasn't that RFC been finished years ago?
Oct
27
comment What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?
Well, AES-CBC-(HMAC)-SHA256 has that too, doesn't it? And SHA1 is less secure. And then you could have a AES-CTR-(HMAC)-SHA1 also. And the alternative of AEAD like AES-GCM is very new and not yet widely available.
Oct
27
revised With OpenSSL and ECDHE, how to show the actual curve being used?
added 14 characters in body
Oct
27
comment With OpenSSL and ECDHE, how to show the actual curve being used?
Would you mind pointing out the relevant bits in the ClientHello (I've updated the question) where the client announces the curves it is willing to use? I am having a hard time wading through the RFCs as I am not at all experienced with TLS wire-level. Thank you very much!
Oct
27
revised With OpenSSL and ECDHE, how to show the actual curve being used?
add handshake msgs
Oct
26
comment With OpenSSL and ECDHE, how to show the actual curve being used?
Fantastic! And yes, secp256r1 is also what I get: <<< TLS 1.2 Handshake [length 014d], ServerKeyExchange 0c 00 01 49 03 00 17 41 04 7e 74 d7 ed f4 7b 2f
Oct
26
awarded  Supporter
Oct
26
accepted With OpenSSL and ECDHE, how to show the actual curve being used?
Oct
26
comment With TLS and ECDHE, how does curve selection work?
Thanks for explaining! Regarding negotiation: what you describe refers to named curves (IANA registered) with domain parameters built into the implementation, right? Do you know any TLS implementation that supports arbitrary_explicit_prime_curves which the RFC also describes? Since, e.g., OpenSSL does not: github.com/openssl/openssl/blob/master/ssl/s3_clnt.c#L1754, github.com/openssl/openssl/blob/master/ssl/t1_lib.c#L419 - I am asking since of safecurves.cr.yp.to and those NIST defined might be .. well, you know where I am heading;)
Oct
26
awarded  Scholar
Oct
26
accepted With TLS and ECDHE, how does curve selection work?
Oct
26
awarded  Student
Oct
26
asked With TLS and ECDHE, how does curve selection work?
Oct
26
revised What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?
correction regarding GCM doing authenticated-encryption, but strictly speaking no "encrypt-then-MAC"
Oct
26
asked With OpenSSL and ECDHE, how to show the actual curve being used?
Oct
26
awarded  Editor
Oct
26
revised What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?
added HW instr., formatting
Oct
26
asked What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?