Reputation
Top tag
Next privilege 250 Rep.
View close votes
Badges
1 6
Impact
~3k people reached

  • 0 posts edited
  • 0 helpful flags
  • 6 votes cast
Apr
29
comment What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?
Thanks for collecting historical traces! The list of non-technical reasons (for non-existance of more TLS CTR) you give is compelling. Too bad;(
Dec
22
comment With OpenSSL and ECDHE, how to show the actual curve being used?
Awesome, thanks! If I get this right, I can now see the actual curve negotiated in the end, but not the curves announced by the client in the first place?
Oct
28
comment What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?
For reasons other than mere performance, e.g. simpler to get right in software without side-channel attack vectors. Also the principle cipher seems to be around longer than GCM. I am just wondering: why hasn't that RFC been finished years ago?
Oct
27
comment What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?
Well, AES-CBC-(HMAC)-SHA256 has that too, doesn't it? And SHA1 is less secure. And then you could have a AES-CTR-(HMAC)-SHA1 also. And the alternative of AEAD like AES-GCM is very new and not yet widely available.
Oct
27
comment With OpenSSL and ECDHE, how to show the actual curve being used?
Would you mind pointing out the relevant bits in the ClientHello (I've updated the question) where the client announces the curves it is willing to use? I am having a hard time wading through the RFCs as I am not at all experienced with TLS wire-level. Thank you very much!
Oct
26
comment With OpenSSL and ECDHE, how to show the actual curve being used?
Fantastic! And yes, secp256r1 is also what I get: <<< TLS 1.2 Handshake [length 014d], ServerKeyExchange 0c 00 01 49 03 00 17 41 04 7e 74 d7 ed f4 7b 2f
Oct
26
comment With TLS and ECDHE, how does curve selection work?
Thanks for explaining! Regarding negotiation: what you describe refers to named curves (IANA registered) with domain parameters built into the implementation, right? Do you know any TLS implementation that supports arbitrary_explicit_prime_curves which the RFC also describes? Since, e.g., OpenSSL does not: github.com/openssl/openssl/blob/master/ssl/s3_clnt.c#L1754, github.com/openssl/openssl/blob/master/ssl/t1_lib.c#L419 - I am asking since of safecurves.cr.yp.to and those NIST defined might be .. well, you know where I am heading;)