Questions tagged [tls]
SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.
640
questions
0
votes
0
answers
8
views
How to add Crypto++ library to NS3 using waf build system? [migrated]
1.I already downloaded the crypto++ 8.8.0 source code & moved them to a folder called cryptopp.
2.Furthermore, I have also created a wscript file in the cryptopp folder.
3.Now how should I proceed ...
- 1
1
vote
1
answer
35
views
Regarding the Digital Signature Algorithm During Client Authentication in TLS 1.2
In TLS 1.2, when client authentication is carried out, digital signatures are utilized. However, at what point is the specific signature algorithm communicated to the server? It seems to me that the ...
- 11
1
vote
0
answers
45
views
Is the SNI extension signed in TLS 1.3?
In TLS 1.3, and since the server signs the entire handshake messages including the server hello message, in this case, is the SNI extension of the client hello message, is it included in the content ...
- 33
0
votes
0
answers
32
views
How by changing ciphertext can the attacker know the length of the padding in POODLE attack
I try to understand the POODLE attack. I read that the attacker try to change one byte of the last block of the ciphertext. Becasue the last block is only have padding and the last byte is the padding ...
- 31
0
votes
0
answers
44
views
Public key encryption with a large number of users
I'm building an app that will primarily be iOS or Android based. My plan is for every user to have their own key pair. The public key will be stored on the server along with a 128 bit UUID which is ...
- 101
0
votes
0
answers
56
views
Using curl with TLS1.3
I need to test my server with curl 8.2.1 utility.
My server works only with TLS1.3 and cipher 0x1302 - TLS_AES_256_GCM_SHA384.
...
- 85
0
votes
1
answer
51
views
Does TLS1.3 support DHE_EXPORT cipher suite? [duplicate]
I just wanted to know for sure that TLS 1.3 does not support DHE_EXPORT cipher suits.
- 33
3
votes
1
answer
52
views
how 0/n split prevent BEAST attack against TLS?
I read that to mitigrate BEAST attack openSSL tried to inject empty TLS record before each real TLS record. and by doing that there is no opportunity to execute an attack but i dont understand way?
...
- 31
0
votes
0
answers
26
views
Encrypted Alert21- Error code 214
I am working on TLS 1.2 Cipher TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, After send the application data server throws an error message ...
1
vote
0
answers
34
views
TLS 1.3 key_share capture without certificate exchange
I am working on an investigation on TLS 1.3.
I've came across an article of qacafe where they shared a TLS 1.3 handshake sequence. Wireshark capture. In this capture you see that in the Client Hello a ...
1
vote
1
answer
95
views
For TLS-PSK (pre-shared key), should non-ephemeral key exchange be preferred over ephemeral one?
TLS 1.3 specify two pre-shared key exchange modes, which are psk_ke and psk_dhe_ke. The former is a non-ephemeral key exchange ...
- 13
0
votes
0
answers
37
views
How to know details of generating keying material in openssl library?
I am testing my TLS 1.3 server (it does not use openssl library) using openssl s_client utility. I have found out that ...
- 85
0
votes
0
answers
14
views
A reason of "SSL_ERROR_RX_MALFORMED_HELLO_RETRY_REQUEST" error in FF when connecting wirh Firefox (TLS 1.3)
I am trying to test my server program which implements TLS 1.3 connection - it should establish TLS 1.3 connection.
My server uses a self-signed certificate, created in ...
- 85
0
votes
1
answer
91
views
How to define RSA padding for RSA encryption in openssl 3.0?
I am studying openssl 3.0 (Windows, C++) in order to encrypt data using RSA. More specifically, I need to sign a CertificateVerify server message in TLS 1.3. The ...
- 85
0
votes
0
answers
36
views
How I can force the openssl "s_client" utility to generate predefined random bytes in it's ClientHello?
I'm testing my server application (TLS 1.3) using s_client program from the openssl library and I need to force the ...
- 85
0
votes
1
answer
97
views
How to force openssl/s_client to send a keyshare for the specific elliptic curve (secp256r1)?
I want to test my server application (TLS 1.3) using s_client program from the openssl library and I need to get from the ...
- 85
3
votes
1
answer
447
views
How does TLS 1.3 restrict the Diffie-Hellman parameters to ones that are known to be secure?
In previous versions of TLS, the choice of the Diffie-Hellman parameters was up to the participants. This resulted in some implementations choosing incorrectly, resulting in vulnerable implementations ...
- 33
3
votes
1
answer
123
views
Is there open-source test tool that operate TLS server/client with unexpected behaviors
I'm working in an embedded system that uses TLS v1.2 protocol for network security and it acts as a client.
Now I want to test some TLS security functions that require connecting with a TLS server and ...
- 31
1
vote
1
answer
85
views
Using of the Transcript-Hash in TLS 1.3
The section 4.4.1 of the RFC 8446 tells about Transcript-Hash.
My questions about the transcript-hash are:
Must a server hash (a) all own sent messages, enumerate in the section 4.4.1, or (b) own ...
- 85
1
vote
1
answer
77
views
Forming ECC key (TLS) in X9.63 format
I am studying TLS handshaking by example a program tlse, which uses libtomcrypt library.I see that in line 5236 (link above) the program call libtomcrypt procedure ...
- 85
1
vote
1
answer
72
views
Where in the TLS 1.3 record is the sequence number located?
The sequence number should be a 64 bit number in every TLS record, but the record header layer is only 5 bytes long and I am looking at a Wireshark pcap, where the TLS record only includes the header ...
- 113
2
votes
1
answer
55
views
Should a certificate message of a server be encypted in TLS 1.3?
Section 2 of RFC 8446 says about the phase "Key Exchange": … Everything after this phase is encrypted.
The "Certificate" message is sent after &...
- 85
2
votes
2
answers
158
views
"Supported groups" in RFC 8446 (TLS 1.3)
What is meant by "supported groups" in the section 4.2.7. "Supported Groups" of RFC 8446:
/* Finite Field Groups (DHE) */
ffdhe2048(0x0100), ffdhe3072(0x0101), etc:
Is the digits - ...
- 85
0
votes
1
answer
46
views
Why is IV in RFC8448 examples only 12 octets instead of 16?
I am working on manual decryption of application data in TLS 1.3 by going through example in RFC8448. I successfully derived and expanded key and IV, but the IV in examples is only 12 bytes long ...
- 113
0
votes
1
answer
56
views
Its Tls 1.2 Padding required when message ist multiple of block length?
When I want to encrypt a 16 byte long message with AES-128-CBC using int TLS 1.2 do I need to add a 16 byte block of padding or can I just encrypt the message without padding ?
1
vote
1
answer
73
views
Difference between "key_share" extension and "server_key_exchange" message in TLS 1.3
Could anyone explain me the difference between "key_share" extension and "server_key_exchange" message in TLS (1.3) ?
If I understood right, these "packets" of data are ...
- 85
0
votes
1
answer
50
views
Prove a response was received from the particular Tor hidden service
Consider a Tor hidden service. I want to retrieve the main page of such website in such a way that I can later prove to a skeptical third party that the website with this certificate (identified by ...
2
votes
1
answer
84
views
How to create TLS 1.3 Key Derivation test cases
I'm trying to create some test cases for a TLS library for the Key Derivation outlined in RFC 8446 7.1.
I tried to get this information from openssl using the ...
- 191
1
vote
3
answers
94
views
How do certificates add data to public key and how is this implemented into TLS?
I want to create a self signed PKI for a couple servers I am running. I am finding tutorials with copy paste commands from openssl, and hand waving explanations that describe the general purpose of ...
- 11
1
vote
2
answers
149
views
Entropy for TLS 1.2: how much is needed for linux servers?
I am trying to fix issues with a server where the server keeps freezing up and needs to be restarted. I recently started hearing about entropy and it importance to secure tls keys in linux. The one ...
6
votes
2
answers
2k
views
Is RSA longer supported in TLS 1.3 and are RSA and DH fundamentally different?
I'm watching "SSL, TLS, HTTPS Explained" by ByteByteGo on YouTube and at the end, starting around 5:15, there are two points that are interesting:
in TLS 1.3 RSA is no longer supported as ...
- 171
2
votes
1
answer
68
views
Are there any significant ways in which TLS could still be improved?
With TLS 1.3 supporting only secure, forward-secret cipher suites, are there any significant technological improvements that could still be made to the protocol?
- 21
1
vote
0
answers
883
views
BAD Record MAC error from the server [closed]
I am working on ssl client because of some server update I was enabling the cipher TLS_DHE_RSA_WITH_AES_128_GCM_SHA256. While handshake with server I was facing Bad Record MAC Alert message from the ...
3
votes
2
answers
223
views
Are the following ciphersuites vulnerable? if so, what are the vulnerabilities?
Following ciphersuites found to be weak in Qualys(https://www.ssllabs.com/ssltest/analyze.html) tool:
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) ECDH x25519 (eq. 3072
bits RSA) ...
- 31
2
votes
0
answers
63
views
How are the `binder hash` and `finished` values calculated in the Resumed 0-RTT Handshake example in TLS 1.3?
I'm trying to understand the implication of the Binder Keys in in a TLS 1.3 resumed handshake. The TLS 1.3 RFC provides an additional RFC with example traces to validate all the math in a TLS 1.3 ...
- 983
18
votes
1
answer
5k
views
Will IBM's Condor quantum processor run Shor's Algorithm to crack a 256-bit Elliptic Curve key?
Yesterday IBM announced that they have a 433 bit quantum computer, called Osprey. There is nothing in the press releases I can find that says whether it can or cannot run Shor's Algorithm.
They also ...
- 333
0
votes
1
answer
32
views
Mapping DH / DHE p & g params to a group
I'm doing a small code that performs a simple SSL/TLS analysis and I'm stuck on determining the size of the key exchange in the case of DH / DHE.
If I take the following example (wireshark capture) :
<...
- 3
0
votes
2
answers
745
views
How does TLS 1.3 provide authentication without using the public key to verify that the server has a private key?
In the TLS 1.2 handshake, after checking the certificate, the public key from the certificate was used to encrypt the data to create a symmetric encryption key, hence the authentication took place on ...
0
votes
0
answers
50
views
Benchmark SSL/TLS certs: selfsigned vs signed (trusted)
I have two servers. A production server with a signed (trusted ca) cert and a test server with a self-signed cert.
How big is the difference between the two handshakes?
Because when benchmarking the ...
- 101
1
vote
0
answers
140
views
3
votes
1
answer
163
views
In TLS 1.3, is the first Derived Secret always a constant value (in non-PSK handshakes)?
RFC 5869 Defines HKDF-Extract in section 2.2 as:
HKDF-Extract(salt, IKM) -> PRK
TLS 1.3 RFC 8446 defines the first part of the Key Schedule like this:
...
- 983
2
votes
1
answer
109
views
If a server and I had the possibility to sign the encrypted messages we exchange, would it still be useful to use TLS?
Assume to neglect:
The man in the middle attack.
The efficiency of symmetric encryption over asymmetric
I can't understand the usefulness of TLS, with respect to the security, if both parties ...
0
votes
1
answer
52
views
Does TLS convert individual messages to ciphertext? If the network is breached, is the data exposed?
As far as I understand it, TLS creates a tunnel or channel or secure connection between the parties right? Where everything is protected? But hypothetically if the network gets breached, would the raw ...
- 25
3
votes
2
answers
570
views
1
vote
2
answers
517
views
How does a CertificateVerify message prevent MITM attacks in TLS 1.3
I' following along the book "Realworld Cryptography", in chapter 9 where the TLS protocol is introduced, they mention:
Following [authentication], the server can use its certified long-term ...
- 113
1
vote
1
answer
137
views
Almost similar, but still different algorithm names. What is the difference?
I was sent from Stack Overflow to here (original question). I'm quite new to cryptographic programming. I want to generate TLS certificates on application boot up time. It is a Spring Boot application,...
- 13
3
votes
1
answer
276
views
Key Committing AES-GCM
There is a handful of attacks against AEAD, and GCM in particular, which demonstrates that it is feasible for an attacker $\mathcal{A}$ to obtain a ciphertext $C$ which encrypts to multiple key/...
0
votes
1
answer
73
views
How SSL (similar version) works?
My book suggested the following protocol to replace SSL:
A lot of the terms are familiar to me from the Original SSL, like ChangeCipherSpec message which means ...
- 5
1
vote
2
answers
641
views
Why does AES-GCM means No MAC key, instead of MAC key what they are going to use?
From RFC 5246, section 6.2.3.3: AEAD Ciphers:
AEAD ciphers take as input a single key, a nonce, a plaintext, and "additional data" to be included in the authentication check, as described in ...
- 49
3
votes
1
answer
256
views
I didn't understand why both an implicit and an explicit nonce is used in AES-GCM in TLS 1.2
As per my understanding that the nonce of AES-GCM in SSL has 3 parts:
. salt, 4 bytes, generated in handshake, not changed in whole session
. nonce_explicit, 8 bytes, chosen by the sender and ...
- 49