0
$\begingroup$

I am in doubt : of course one can create a tl connection between a client and a server.

But what if the client sends self encrypted with, say, blowfish, data to the server? The goal is that the server remains dumb about tls.

The question is not if it is possible, it is.

But in case of a "unattended listening by someone who might love hats", would that be secure enough if the hacker gets the packet?

Would it lessen the security ?

To me, maybe yes, because the hacker would have the packet on his/her computer with the speed involved vs hacking a tls connection. But am I correct ?

Edit : I am new to the security context.

$\endgroup$
  • $\begingroup$ I don't understand what you ask. Do you wan't to start sending encrypted text without the whole handshake and algorithm negotiation stuff? How should the server know which password was used for Blowfish? $\endgroup$ – Nova Nov 11 '14 at 11:58
  • $\begingroup$ Exact. The password is known in advance. It is much of a lab testing. My concern is the resistance of a packet once the hacker has it $\endgroup$ – Larry Nov 11 '14 at 12:16
  • $\begingroup$ Well, TLS is for systems which don't know each other. You can securely communicate with someone without sending a password in advance. If both participant already have a mutual password, they could just ignore the whole handshake and immediately start with the real communication. $\endgroup$ – Nova Nov 11 '14 at 13:52
1
$\begingroup$

It depends!

Any of the two alternatives TLS or directly symmetric encryption with a pre-shared key will of course require the sender (him/herself) to encrypt the data.

From a cryptographic perspective any statement about security/"being secure" even relative often requires specifity and not much about the actual ciphers are stated. that is why the answer is that it depends.

As much as it depends there are some points which might have some more general application.

TLS will be a stepwise procedure and use first asymmetric encryption (that with public and private keypair) to establish a secure channel. In another step it will then use this rather expensive/slow channel (because it takes more calculation power per transmitted data) to exchange a session key that is used for symmetric encryption. At this point you are at the point at which I assume your suggestion starts and that is that, you have a key only known to the legitimate sender and receiver.

Given that the symmetric encryption following a TLS initial handshake/sessionkey exchange is having the same attributes as the one you suggest with the "self"encrypted setup than there is no reason to see any difference in "security".

Indeed if you know were able to have a shared key for symmetric communication available on both ends of your communication, then this means no need to exchange a session key via asymmetric pub/pri-key encryption in the first place. At best with directly using symmetric encryption any vulnerabilities in the asymmetric part of the TLS can be avoided.

$\endgroup$
  • $\begingroup$ Ok! so say A and B have a super strong password they know in advance, client encryption with a strong cipher it is as "secure"/protected as a full blown tls connection, right ? (+1 by the way) $\endgroup$ – Larry Nov 11 '14 at 15:00
  • $\begingroup$ if they have an ideal password (hence one that provides for the amount of ramdoness to provide for the n bits key that is used for the symmetric encryption) then to what I understand yes. After als TLS also will end up using symmetric encryption in the second step, only of course not by using a key derived from a password, but a random source. Yet as I said with an ideal password and the same cipher used it is essentially the same thing :), thanks $\endgroup$ – humanityANDpeace Nov 11 '14 at 15:05
  • $\begingroup$ Actually, you don't have to choose between TLS and PSK. You can have both. en.wikipedia.org/wiki/TLS-PSK $\endgroup$ – StackzOfZtuff Dec 2 '14 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.