Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
0
votes
2answers
78 views

How can I dentify the ECDHE group value used in a TLS session

In ECDHE, the group is a public value. I want to get this value for a session. I inspected the session using Wireshark. Under the ServerHello -> Key share extension -> Key share entry, I found ...
0
votes
1answer
26 views

SSLv3 ServerKeyExchange SIgnature struct mismatch

Im playing with implementing SSLv3 in Go according to rfc6101. I can deserialize ServerKeyExchange until ServerKeyExchange.signed_params. The cipher suite is ...
0
votes
0answers
21 views

Benefits of HMAC-based server authentication [migrated]

Context and assumptions: TLS 1.2 or 1.3, server authentication only Client uses HMAC to authenticate itself to the server, using a PSK key Client is a library, not a web browser, which doesn't allow ...
0
votes
0answers
19 views

Unable to add subject alternate names to certificate [closed]

I have created an certificate authority for local use. I work in web development and need to issue certificates for internal servers that are not exposed to the internet. I am using openssl, and ...
5
votes
1answer
251 views

TLS 1.3 - Why have no encrypt-then-MAC modes been specified?

I have been scratching my head for a while why TLS 1.3 does not include any encrypt-then-MAC (EtM) modes. All the previous problems in TLS have been caused by MAC then and encrypt. Whereas encrypt ...
1
vote
1answer
41 views

Revealing original message length having random padding

If I have a message that has a fixed unknown length $L$, and we add to it's TLS encryption a random sized padding $0\leq n \leq N$ so the sent message if $L+n$. I'm also able to make the target re-...
0
votes
0answers
4 views

should I treated the let's encrypt fullchain.pem as a public key [migrated]

I am using let's encrypt to generate a certificate. It contains 'fullchain.pem' and 'privkey.pem'. should I treated the let's encrypt fullchain.pem as a public key? I find the public key certificate ...
1
vote
4answers
109 views

Does SSL connection provide integrity?

I'm new to cryptography and I'm trying to implement a secure chat application using OpenSSL. I want to ensure that public messages (which will be shown to all users) cannot be altered during ...
2
votes
2answers
123 views

Why do people use protocols like PGP, when TLS already exists?

TLS is the standard cryptography protocol on the internet, and many websites use it to secure their communications. However, for personal use, most people use other protocols like PGP, instead of ...
0
votes
1answer
36 views

Simple Key Exchange, One Server

I am trying to better understand how TLS works. I understand in the normal use case you need various random values generated and used in the key exchange, to prevent some MITM reusing a previous ...
0
votes
1answer
86 views

Using AES-CBC in TLS1.2

Is AES-CBC still vulnerable in TLS1.2 Or does the vulnerability only work for lower TLS versions? If not, why was it deleted in TLS 1.3?
2
votes
2answers
822 views

Which block cipher mode of operation does TLS 1.3 use?

Which block cipher mode of operation does TLS 1.3 use? I assume it is a block cipher mode that provides authentication (like GCM).
3
votes
1answer
82 views

Concatenation of password and TOTP - possible issues

I have come across a two factor login mechanism using Time based OTP (TOTP). TOTP (6 digits) is shown to the user in an app. There are two ways of logging in. Method 1: User inputs the username and ...
0
votes
0answers
40 views

Is it possible to extract a signature from a HTTPS webpage?

Let's say I want to prove to someone that a webpage claims X. I could take a screenshot, but it could easily be doctored. However, the webpage's contents are encrypted by the domain using its private ...
0
votes
0answers
17 views

HPKP on OS or library level

Among the major operating systems (Windows, MacOS, Linux) or common TLS libraries (Schannel, openssl, boringssl) is their any way to pin certificates on a global level? So not just per application but ...
1
vote
1answer
79 views

Read ECDHE traffic with Wireshark or the like

There is some https traffic from a specific server (which I have the certificate and private key) that I need legitimately be able to read. This traffic doesn’t come via browser so besides the ...
2
votes
0answers
23 views

SSL/TLS Forward secrecy with 2 KEM public keys

As we know, NIST PQC project is at its 3rd round, with draft standard expected to arrive in the next (few) year(s). An unfortunate fact is that, we're not seeing many signature schemes general-purpose ...
2
votes
1answer
101 views

In TLS, does the client know the server's public key before starting the data exchange?

I am reading about the logjam attack. I was asked if the attack could be prevented by checking the integrity of the Server Hello message. My answer would be no because the man-in-the-middle can still ...
0
votes
0answers
24 views

Authentication between two servers using PKA

I've run into an small issue regarding authentication between 2 services (One way communication) using public and private key authentication (Elliptic Curve, secp256k1). The services will communicate ...
1
vote
0answers
34 views

Security proof for TLS 1.x

In JKSS12, a proof for the handshake in TLS-DHE 1.2 is given, assuming (among other things) the PRF-ODH hypothesis on the PRF used to derive keys. It is also stated that, if TLS 1.2 was to be modified ...
2
votes
1answer
72 views

In TLS 1.3, is the Binder Key in a non-PSK derived key schedule always a consistent value?

The Key Schedule in the TLS 1.3 RFC starts like this: ...
1
vote
1answer
79 views

In TLS 1.3, what is the rational for using different handshake transcripts for Resumption Master Secret vs Application Traffic Secrets?

The TLS 1.3 RFC, section 7.1 lists this as the last part of the key schedule: https://datatracker.ietf.org/doc/html/rfc8446#section-7.1 ...
1
vote
0answers
69 views

TLS 1.3 Handshake - Usage of MAC and Digital Signature for CertificateVerify and Finished Message

I was wondering, why the TLS 1.3 handshake employs two different 'messages' that compute an authentication code over the whole handshake. As far as I understand, the CertificateVerify "message&...
1
vote
0answers
59 views

How to decrypt raw TLS bytes?

Is there any tool / way to decrypt raw bytes of a TLS 1.2 session, when the master key is known, even if forward secrecy is used? The closest I found is this. I know its possible using Wireshark, but ...
2
votes
1answer
143 views

What does the running transcript hash in RFC-8446: TLS 1.3 do?

From RFC8446: In general, implementations can implement the transcript by keeping a running transcript hash value based on the negotiated hash. Note, however, that subsequent post-handshake ...
1
vote
1answer
43 views

What salt should be used when generating TLS 1.3 CertificateVerify message?

When signing handshake messages digest, the MGF1 function takes some salt value with same length as the digest has. But what content must be in salt's buffer? I explored the source code of libnettle, ...
0
votes
2answers
98 views

What does TLS 1.2 mean by SHA functions?

I'm looking at the technical docs for TLS 1.2 and it says it uses SHA (so hashing algorithms): 7.4.1.4.1. Signature Algorithms But hashing just digests an input, to do things like user authentication....
-1
votes
1answer
84 views

How much security does using TLS provide?

If someone tells me their service uses TLS 1.2 or higher, how much 'guaranteed' security does this provide? Is it possible to correctly claim to be using TLS 1.2 or 1.3 and still be insecure? For ...
3
votes
0answers
72 views

Openssl speed vs TLS speed with postquantum KEM

I'm studying the performance of postquantum KEM in TLS with the OQS (OQS is a project that integrate liboqs to openssl). I don't know why, but the KEM algorithms performance in TLS is 10 times slower ...
1
vote
1answer
56 views

Server authentication in TLS 1.2 with static DH

For (EC)DHE cipher suites, server authenticates itself by proving the possession of the private key matching its certificate by signing ServerKeyExchange message (...
-1
votes
1answer
55 views

Can X3DH algorithm implementation be avoided to thwart Man-in-the-Middle Attack during End-to-End Encryption with Diffie-Hellman Algo, When using SSL

For End-to-End Encryption in chats using Diffie-Hellman Algo the concept of Extended Triple Diffie-Hellman (X3DH) is used to prevent Man-in-the-middle attack (MITM) (courtesy: https://www.qed42.com/...
1
vote
0answers
45 views

How does TLS 1.3 sign key exchange?

From this site: https://tls13.ulfheim.net/ and from https://www.rfc-editor.org/rfc/rfc8446#section-2 I can't find the part in which the exchange of keys is signed, isn't one of the parties "...
0
votes
0answers
21 views

Why does AES_GCM sometimes has a SHA for integrity? [duplicate]

For example the following suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 From what I understand the SHA384 at the end is used to authenticate the message, which is exactly what MAC does, and the mode ...
1
vote
1answer
120 views

What hash is concatenating with the data to be signed in TLS 1.3 CertificateVerify message?

According to specification, to create data that will be signed with server private key for CertificateVerify message, we need to concatenate 64 space characters, the string "TLS 1.3, server ...
1
vote
1answer
86 views

How does TLS 1.3 work with PQC signatures?

I know that the first step in TLS 1.3 with modern signatures is hash the message with SHA256/SHA384/SHA512. Do PQC signatures work the same as modern algorithms in TLS 1.3?
1
vote
2answers
86 views

What symmetric algo does TLS use?

So my understanding of TLS is that it uses asymmetric cryptography such as DH to perform a key exchange, once this has occurred it then used an symmetric algorithm for the data exchange. (Obviously I ...
2
votes
2answers
170 views

How does TLS with PQC use key encapsulation?

As there don't seem to be any PQC alternatives for Diffie-Hellman (DH / ECDH), DH must have been replaced by key encapsulation using an ephemeral key pair. However, since TLS 1.3 always performs ...
1
vote
2answers
132 views

Who provides prime numbers for cryptographic protocols?

I am currently writing a thesis about different cryptographic protocols like DH-Key exchange, TLS or IKE. Most of them rely on a prime number earlier or later, so for security reasons I wondered if ...
0
votes
1answer
59 views

Symmetric key as proof of ownership of a session?

I have a question, or rather multiple questions that all relate to the same topic. I am building an application with both a frontend (FE) and a backend (BE). All communication between FE and BE is ...
1
vote
1answer
64 views

Is it safe to send a hashed password over HTTPS or what is the most secure method of authentication?

My rudimentary understanding of HTTPS and the Diffie-Hellman key exchange is that the client and server can establish a secured connection by generating the same key based on their private secrets and ...
4
votes
2answers
167 views

Have any PAKE extensions been added to TLS 1.3?

In TLS 1.2, there was TLS-SRP (RFC 5054,) which provided a password-authenticated key exchange (PAKE) protocol for use with TLS. However, it apparently relied on handshake messages that have been ...
1
vote
1answer
70 views

Different encryption standards and how they relate to auth and algorithms

The main confusion I have is around the different PKCS and relation with SSL (TLS). I have done a lot of research and have found bits and pieces but not necessarily how these relate, so let me explain ...
3
votes
0answers
20 views

SSL handshake - what is the purpose of the finishedClient message?

I am having some difficulties in understanding why is the finishedClient needed. In case an attacker attempts an attack like a replay attack, it will show ...
0
votes
1answer
27 views

Do you need both client and server side support for TLS 1.3 record padding?

When you enable record padding for a client, does a server need a specific option to support this? Or does the other end only need to support TLS 1.3 as well and can handle the padding automatically?
2
votes
2answers
479 views

Why does the TLS spec for TLS-PSK say not to derive the shared secret from a password?

According to a note at the end of section 2.2 of the TLS 1.3 spec (RFC 8446), When using an out-of-band provisioned pre-shared secret, a critical consideration is using sufficient entropy during the ...
1
vote
0answers
23 views

TLS 1.3 clarification needed on hello_hash and subsequent hashes

I am exploring TLS, mainly from the server side at the moment. I am creating a server that will authenticate a client using TLS 1.3 and eventually I will be creating a client authenticating to a ...
2
votes
1answer
247 views

What is the overhead of GCM? And how are GCM tags signed by RSA/PKI?

I'm mainly trying to wrap my head around the pipeline of encryption, hashing and signing. I've read over this question, describing the overhead of GCM, which I understand to be configurable for space-...
7
votes
3answers
1k views

Which Diffie-Hellman Groups does TLS 1.3 support? And should we use TLS 1.3 as a guide?

This is a two part question - and I'm asking as someone moving into a security role, who'll need to standardize practices going forward. (1) I'm curious whether the following 10 different DH Groups ...
1
vote
1answer
134 views

How does the TLS Client Hello message choose the TLS version? [closed]

Im looking at a Client Hello message in wireshark, the client supports 1.2 and 1.3, but Wireshark says the client used TLSv1.3 record layer when the server hasn't replied yet the choosen version. How ...
1
vote
1answer
61 views

OpenSSL TLSv1.3 record padding

OpenSSL supports TLSv1.3 record padding: https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html but I'm not sure if it works like I think it does. If I would choose a factor of 2 it would make ...

1
2 3 4 5
12