Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

0
votes
0answers
16 views

can't decrypt AES-256-GCM log file! [HELP] [on hold]

i'm trying to decrypt a log file that containt some chat messages ( in french ) it is encrypted with AES-256-GCM then encapsulated into a TLS session: Take a look at the file here https://ufile.io/...
2
votes
1answer
253 views

SSL - encrypt with private key and then with public key?

Say there are 2 sides that wish to communicate: side A and side B. Let's say we are looking at side ...
2
votes
1answer
51 views

The 9 lives of Bleichenbacher's CAT, it puts another scratch again

Bleichenbacher demonstrated a padding oracle attack against RSA implementations that follow the PKCS #1 v1.5. Through the years, there are various mitigation techniques developed as OAEP and limiting ...
0
votes
1answer
60 views

Does make sense utilize TLS and Noise Protocol in the same application?

Nowadays I work maintaining an web application written in Node.js and we use HTTPS with TLS 1.2. We have to implement a new feature related to security on this application, all HTTP messages must be ...
0
votes
1answer
47 views

What can eve see when I go to https//paypal.com

If I go to https://paypal.com/ and login, can Eve find the approximate size of the HTTPS request from my browser? Can she see the approximate size of the responses from the paypal server to me? and ...
10
votes
1answer
141 views

How does the process of creating a new secure Elliptic Curve look like?

I'm especially curious about the technique djb would have used to come up with his Curve 25519. Say I have already written down my goals, such as - Twist Secure, Speed, Side Channel resistance, etc. ...
2
votes
1answer
58 views

Why don't the TLS1.3 cipher suites mention the key exchange and digital signature algorithm in names?

Does it mean both RSA and ECDSA certificates can be used with the same cipher suite?
0
votes
1answer
33 views

When a program using openssl library is using a certificate, does the server check if the issuer(s) are still valid

If I have a program acting as TLS server with a certificate signed by a CA, if one of the issuers in the chain becomes invalidated or the date expires, then how does the program using the certificate ...
2
votes
0answers
49 views

Sharing RSA private key between SSH and SSL services. How bad is it?

An appliance uses a curious way of obtaining ssh-rsa host keys: There is a single configuration option "management certificate" that sets RSA private keys both for HTTPS and SSH management. ...
3
votes
1answer
80 views

In a TLS 1.3 connection, how do the client and server choose a mutual cipher suite?

According to KeyCDN, TLSv1.3 connections are established in a single round trip: While TLS 1.2 requires two round-trips to complete the TLS handshake, 1.3 gets the job done in just one trip If ...
25
votes
2answers
2k views

Why did TLS 1.3 prohibit PGP authentication?

There is a specification, in Informational(!) RFC 6091, for using PGP keys in TLS authentication, although I don’t think it has ever been implemented outside of GnuTLS (it’s certainly not in OpenSSL). ...
2
votes
1answer
25 views

Are Authenticated Encryption ciphersuites supported in legacy TLS versions older than TLS 1.2?

I have read in a paper that Authenticated Encryption (by this I mean those that support GCM mode or ChaCha20 ciphers) are not supported in versions older than TLS 1.2? I could not confirm this as ...
0
votes
2answers
91 views

Why does curl need both root and intermediate certificates in order to securely connect to an HTTP server?

I have created a root certificate, an intermediate certificate, and a server certificate: ...
3
votes
0answers
62 views

Why does TLS 1.3 support two CCM variants?

One of the important improvements introduced in TLS 1.3 is the pruning of the many previously available cipher suites to only five secure options (for symmetric ciphers), that are each supposed to ...
6
votes
1answer
239 views

Cipher suites: same name, different IDs, why?

Sorry if I missed with a community to ask. Recently I stumbled on a fact that the same cipher suite can be designated by two different IDs, and this is not a typo nor single occasion. For instance: ...
2
votes
2answers
165 views

The attacker model of the Lucky13 attack in TLS

Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page: The attacks involve detecting small differences in the time at which TLS error messages ...
2
votes
4answers
55 views

TLS ciphersuite without mode of operation

Will there be any security concern if there is no mode of operation specified in the ciphersuite name? For instance, there is no mode of operation in ...
0
votes
0answers
21 views

ecdsa_secp521r1_sha384 is it a valid curve/hash combination for ecdsa signature?

In TLS, for certificate authentication, I encountered a ECDSA signature, where the signer was using secp521r1 curve and SHA384 algorithm. Generally the hash strength should match the curve strength ...
3
votes
4answers
95 views

JWT Login Security

I am new to security and I am wondering if JWT is secure enough. From what I have read online the flow goes like this: Clients log in by sending their credentials to the identity provider. The ...
1
vote
1answer
87 views

CBC related TLS cipher suites to be disabled in the server side

I understand the TLS cipher suites using CBC mode are susceptible to timing attacks. From that understanding it seems that the cipher suites using GCM (CTR-based) are safe to use considering they don'...
2
votes
2answers
52 views

Does the Server Key Exchange sign a hash or text

In TLS 1.2 when using ECDHE_RSA, the ServerKeyExchange message contains a signature over the server's ECDHE public parameters. My question is: Is the signature over ...
1
vote
1answer
77 views

How Elliptic-Curve affects the Server Key Exchange parameters

In Finite Field DHE, the server sends the following parameters in the server key exchange message: $p$: prime $g$: group $g^b$: the server's public DH key In DHE_RSA (non anonymous DHE), the server ...
0
votes
1answer
45 views

When using Client Certificates, is it usual to generate your own?

We're building a webservice for a third party customer who wants us to use "two-way SSL". By which I understand them to mean they want us to host the site using https, and to require that include a ...
3
votes
3answers
377 views

What is different below two Ciphersuites?

I have two questions; I need an explanation for the differences of below two cipher suites. How do they work with SSL/TLS protocol? (my main concern first one doesn't have '...
1
vote
2answers
105 views

signature with Bleichenbacher’s attack

I understood Bleichenbacher & ROBOTO attack, however I have some trouble understanding Section 3.5 of ROBOT attack which discusses retrieving private keys. https://www.usenix.org/system/files/...
0
votes
1answer
108 views

Cipher Block Chaining (CBC) encryption in SSL

Is cipher block chaining (CBC) mode used in SSL encryption? If block reordering is already protected by SSL and TCP sequence numbers, what added advantage does CBC provide?
0
votes
1answer
49 views

How is the TLS 1.2 sequence number generated?

In the other ciphers supported by TLS 1.2, namely stream cipher and CBC block cipher mode, the sequence number is implicitly in the MAC (RFC5246, 6.2.3.1): ...
0
votes
1answer
70 views

Tls protocols: is the simple diffie hellman key exchange still used these days?

Or did it mostly get replaced by ecdh for key exchange and rsa for authentication ?
2
votes
1answer
57 views

Does DROWN attack break 2048-bit key itself or just the plaintext encrypted with the RSA key

Does the DROWN attack enable breaking strong RSA keys (e.g. the 2048-bit key itself) or enable breaking the plaintext (i.e. pre-master key) that is encrypted with a 2048-bit (or any strong) RSA, if ...
2
votes
0answers
40 views

Is my way safe to remove SSL CA Cert by DHT and PoW NodeID for a decentralized system?

To implement a decentralized system, I wrote a TLS like P2P net stack. The main idea is removing CA Cert from the whole system by using a DHT for Naming and Key Exchange. I am not a crypto expert, so ...
0
votes
1answer
55 views

How does OpenVPN work?

I'm confused with the technologies that OpenVPN uses. The official site mentions it uses SSL/TLS in-place of IKEv1/IKEv2, and uses IPSec ESP to secure the data, and yet that it isn't compatible with ...
1
vote
1answer
29 views

How to prove to a third-party that a given response came from a specific domain?

Suppose I've got a response from a website using https. Is it possible to store the certificate and keys exchange to prove to a third-party that the response came from that domain?
8
votes
1answer
166 views

Can the lengths of HTTPS requests be used to deduce which public pages on a site are visited?

I thought of this recently: There are some websites which have many publicly accessible pages, some of which could be embarrassing despite being public (e.g. Wikipedia). The HTML for these pages also ...
0
votes
0answers
30 views

Is there a way to quickly verify a TLS Notary proof?

I am experimenting with a Proof-of-Delivery concept where participants need to prove that they served a web-page to a user. I am familiar with the concept of TLS Notary proofs which also contain a ...
2
votes
1answer
142 views

In TLS 1.3 handshake, what's “PSK binders” used for?

PSK handhanke works like session ticket resumption in TLS 1.2, but I found a set of PSK binder for each identity(ticket) in TLS 1.3, why ...
2
votes
1answer
42 views

What's the `ticket_age_add` and `obfuscated_ticket_age ` used for in TLS 1.3

In RFC, I only find such description: This addition prevents passive observers from correlating connections unless tickets are reused ...
0
votes
1answer
58 views

What is the most popular cipher suite used in TLS 1.2 for HTTPS?

I'm trying to do some performance (time) calculations over TLS. I have the data I need for a variety of cipher suites but in order for the calculations to generalize well, I need to know if there is a ...
0
votes
2answers
115 views

UDP and AES with C++

I'm implementing different applications that will use UDP to exchange real-time data, thus a low impact on performance is very important. This system will not be connected to the Internet so I just ...
3
votes
2answers
64 views

Private key ECDSA/TLS

Is the private key required once the certificate is hashed and signed? After a certificate is generated, public key is shared within the certificate itself. Is the private key used for any other ...
64
votes
2answers
10k views

Why doesn't SSH use TLS?

Most cryptographically protected protocols use TLS these days. This applies to mail protocols, HTTP and many others. The newly designed QUIC has also adopted TLS as its cryptography layer. However, ...
2
votes
1answer
26 views

Does the server signs message body after ssl handshake?

So after SSL handshake the master secret is used to securely transfer data encrypted using symmetric cryptography. My question is simple: after SSL handshake, when the server (for example my bank) ...
0
votes
2answers
67 views

How does authentication work differently between asymmetric and symmetric cryptography?

Must Bob and Alice establish a 'connection' before a symmetric or asymmetric encryption scheme is secure? If so, is there ever some expected plaintext whose decryption authenticates the users? In ...
0
votes
2answers
104 views

TLS1.2 AES 128 CBC Encrypted Data size is not a multiple of block size [closed]

I know that TLS ciphers such as TLS_RSA_WITH_AES_128_CBC_SHA transmit data as shown https://tools.ietf.org/html/rfc5246#section-6.2.3.2. From my understanding the ciphertext MUST be a multiple of the ...
2
votes
1answer
50 views

TLS Extension signature_algorithms values

I hate asking for a reference, but I'm having a hard time finding this. The iana page on tls extensions just links me back to rfc5246 where it only has the following values: ...
1
vote
1answer
461 views

HMAC Key Sizes for MD5, SHA1, SHA224|256|384|512

I'm trying to find an authoritative source for the HMAC Key sizes for each of the hashing algorithms below. Specifically for TLS implementations of HMAC. I found this table in RFC5246: ...
1
vote
1answer
120 views

does TLS 1.3 use ECDSA-Sig-Value encoded signatures for Ed25519 / Ed448?

Quoting The Transport Layer Security (TLS) Protocol Version 1.3: ECDSA algorithms Indicates a signature algorithm using ECDSA [ECDSA], the corresponding curve as defined in ANSI X9.62 [...
7
votes
1answer
625 views

TLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

TLS 1.2 defines a number of cipher suites that employ AES-GCM, e.g.: ...
4
votes
1answer
139 views

TLS: Risks of using a NULL cipher with encryption implemented in application?

We have a browser-launched JNLP/WebStart application that is no longer able to establish client-server CORBA/IIOP communications across TLS 1.0/1.1 due to relying on a cipher suite that uses an ...
1
vote
1answer
67 views

Advantages of a TLS handshake over pre-shared public keys

Lets assume the following setup: A vendor manufactures IoT devices where each is able to generate an individual private/public key-pair. Only the public key is exposed, the private key is assumed to ...