What's the deal with Deno? We talk with a major contributor to find out. Listen now.

Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
0
votes
1answer
58 views

What MAC did SSLv3.0 use? How did it compare to HMAC in TLS 1.0 and above?

According to Wikipedia: TLS has a variety of security measures: Using a message digest enhanced with a key (so only a key-holder can check the MAC). The HMAC construction used by most TLS cipher ...
0
votes
1answer
45 views

OpenSSL cipher suite support / key requirement for ecdhe_ecdsa_with_aes128_cbc_sha256

I hope this is the right place for that kind of question. So actually I am trying to test the TLS implementation of some industrial device. I have to write my own TLS implementation for this, for ...
0
votes
1answer
27 views

Key renewal when the sequence counter is only 32-bit

If we look at the use-case that our sequence counter within our TLS communication is only 32-bit, would an automatic key re-newal be necessary a lot more frequently? We're going to use state-of-the-...
2
votes
2answers
75 views

Is it possible to create a ciphersuite for TLS 1.3 using only the Keccak-sponge/duplex?

Now that Keccak has been chosen as SHA-3 we see that there have been defined quite a few related modes, including authenticated cipher modes, the KMAC message authentication mode, XOF's and whatnot. ...
1
vote
1answer
516 views

DH Elliptic Curves: Why choose a fixed base point?

I am having a first look at the TLS key exchange using Diffie Hellman and try to understand the Elliptic Curve variant of it. So if a client and a server agree on using ECDH for key exchange and they ...
-1
votes
0answers
31 views

Can a client with an ECC certificate and a server with RSA certificate establish a mTLS connection? [migrated]

Can a client with an ECC certificate and a server with RSA certificate establish a mTLS connection? Can they agree on a cipher suite? Why?
1
vote
1answer
67 views

ECDSA signature with Brainpool curves in TLS possible?

Even the up to date RFC 8446 lists at the page 41 as the options for the ECDSA in e.g. TLS_ECDHE_ECDSA_WITH_... only NIST curves: ...
3
votes
1answer
135 views

Do the session keys have the same value on both sides during TLS?

I have two questions about the sessions keys generated during the last steps of the Handshake phase: Do the "client write key" and the "server write key" have the same value, even ...
1
vote
0answers
40 views

Security of CCM using 8 byte MAC within TLS

In the Dutch "IT Security Guidelines for Transport Layer Security (TLS)" the ciphersuites using AES-128-CCM_8 (i.e. CCM with a 64 bit authentication tag) are considered "insufficient&...
4
votes
0answers
94 views

RSASSA-PSS in TLS 1.2

I know it is possible to use RSASSA-PKCS1-v1_5 with client certificates in TLS 1.3. But what about the other way around: using RSASSA-PSS with client certificates in TLS 1.2? Is it possible to use ...
1
vote
1answer
73 views

Why does TLS 1.3 AES cipher require both a server and client traffic key/iv?

During the TLS 1.3 handshake using the cipher suite TLS_AES_128_GCM_SHA256 a server and client traffic key/iv will be derived using HKDF based on the shared secret, see rfc8446 #7.1 Why is it ...
0
votes
0answers
32 views

Why is MAC encrypted in TLS data transmission? [duplicate]

Referring the slide 16 from this link: I want to ask why is MAC encrypted along with the data to be transmitted. Why isn't MAC just appended at the end of encrypted data ?
1
vote
1answer
89 views

Are TLS connections in china mostly encrypted with AES or with SM4?

What is the dominant symmetric cipher used for TLS connections in China? Is it AES, as it is in the US, or is it SM4?
2
votes
1answer
223 views

TLS 1.2 is still secure or should we move to TLS 1.3?

There are some vulnerability such POODLE, that allows the attacker to gain access to encrypted blocks of data and then gain exposure to plain text information using side channels. Another ...
7
votes
1answer
506 views

How do client and server agree on the values of p and g during DHE exchange?

How do the communicating parties using Finite Field DHE agree on the values of the $p$ and $g$ variables? Are their values fixed for each DHE group? Reading through the TLS 1.3 RFC (8446), the client ...
1
vote
2answers
200 views

Why is a MAC verification algorithm required when we can simply create a new MAC and compare the received one with the one calculated?

The process of verifying integrity through MAC involves two separate algorithms (as mentioned here). On the server side, a signing algorithm runs which calculates ...
0
votes
1answer
41 views

Trying to understand the struct HkdfLabel from tls1.3 RFC8446

I'm looking at RFC 8446 section 7.1 and trying to understand the following: ...
0
votes
1answer
59 views

Prior art: SSH key authn over TLS?

I’m developing an application that runs over TLS. In addition to password-based authentication we’d like to be able to use SSH keys. Is there any prior art in using SSH keys for authentication over ...
1
vote
2answers
69 views

How to derive a private/public keypair from a random seed?

For RSA, my understanding is that large primes are found randomly to build a private/public keypair. If a static seed can be used in that random search process, it should be possible to derive the ...
0
votes
1answer
111 views

TLS 1.2 AES-GCM decryption problem

I'm trying to decrypt a PCAP encrypted with TLS 1.2. I have the private key and Wireshark is able to decrypt the data so what I am doing should work but there is obviously something wrong. The ...
3
votes
1answer
176 views

DTLS vs direct use of AES. What are the threats unique for direct use of AES instead of DTLS?

For regular traffic in mesh network (between Internet of Thing devices) customer decided to use one of two options: DTLS PSK ciphersuite - DTLS based on pre-shared symmetric key or direct use of AES -...
0
votes
1answer
54 views

OpenSSL - What Data Is Used To Create A Certificate's Digital Signature?

I am coming up-to-speed on OpenSSL certificates. In all of my research I see where "data" is hashed to create a hash value that is used as the basis for a certificate's digital signature. This hash ...
0
votes
1answer
62 views

Diffie-Hellman parameter for use in TLS derived from given finite-field group

I'm interested in cryptography, but unfortunately haven't found the time to dive into the topic much. I have done some quantum encryption stuff back in the day, but that isn't helping me with my ...
1
vote
1answer
83 views

Debug client certificate authentication on path with openssl

Website on https://example.com/login will request client certificate authentication. If it was directly on https://example.com then using ...
0
votes
0answers
69 views

Diffie-Hellman + Asymetric encryption kept simple, or alternatives to TLS

I am working on a system that includes our dear friends Alice, Bob, and a server that is only partially trusted. I have spent the majority of the day reading up on various cryptography methods, but I ...
2
votes
1answer
63 views

Chrome TLS 1.3 no TLS resumption with not secure connections

I am testing TLS 1.3 on a slower IoT device (120Mhz ARM). In my tests Chrome with TLS 1.3 will not allow TLS resumption (Session Tickets) when you have an not secure connection e.g. because of an user ...
3
votes
1answer
145 views

How are initialization vectors used in TLS 1.1?

From my understanding, TLS 1.0 can use CBC to encrypt data. To do so, it creates one initialization vector (IV), and then uses the previous ciphertext block as the IV for the next record. I made this ...
1
vote
3answers
74 views

Why doesn't TLS provide E2EE?

Why doesn't TLS provide end-to-end encryption? This question is somewhat related to this, this and this. If you want to talk to someone, say, through facebook, the TLS connection ends in the ...
1
vote
1answer
49 views

What is the difference between DROWN and ROBOT vulnerability?

It seems like the main idea is the same for both the vulnerabilities then what is the difference?
1
vote
1answer
83 views

Safe way to derive IV from the DH shared keys for AES-GCM?

I am preparing to use AES-GCM to make a secure communication program. Here is the procedure DH key exchange to get shared keys SHA256(shared keys) Use AES-GCM to encrypt a message while the key only ...
0
votes
1answer
48 views

Why is the server's public key always used in SSL encryption and never the client's public key?

I spent a lot of time looking for an answer to this question, but the majority of answers never explicitly explain why the client's public key is never used; it's always the server's public key that's ...
3
votes
1answer
172 views

On what basis is padding chosen in OpenSSL?

I am using CAPI Engine in OpenSSL and I did some test. When I use TLS 1.0 or 1.1, during handshake and RSA signing, PKCS padding is chosen. When I use TLS 1.2, RSA signing uses PSS padding. What ...
0
votes
2answers
316 views

Is HTTPS encryption using the RSA algorithm?

According to this article HTTPS and RSA is the same thing: https://tiptopsecurity.com/how-does-https-work-rsa-encryption-explained/ From other sources I learn that they are both asymmetric encryption ...
1
vote
2answers
68 views

Standards for finite-field discrete log cryptography

The NIST and TLS standards for Diffie-Hellman key exchange over a finite field all work in a subgroup of ${\mathbb Z}_p^*$ having prime order $q$, where $p = 2q+1$. On the other hand, DSA has a larger ...
1
vote
0answers
51 views

Comparison of end-to-end encryption and TLS

I am writing a comparison paper about security of electronic communication and I want to compare end-to-end encryption and TLS by giving two examples such as Whatsapp and Facebook Messenger. However, ...
2
votes
1answer
150 views

Is there an actually an alternative to using Diffie Hellman in TLS handshake?

After looking into how TLS handshaking works it seems to inherently include the Diffie Hellman algorithm during the point where they generate a shared secret key. However as I look into this some ...
1
vote
0answers
32 views

Does the order of the “Finished” messages matter in SSL/TLS?

In SSL 3.0 and TLS versions 1.0 through 1.2 the last two messages are the "Client Finished" followed by "Server Finished" messages. These messages include an encrypted (under the established session ...
0
votes
1answer
137 views

Avoid Logjam TLS Attack?

As the Logjam attack allows a Man-in-the-Middle attacker to downgrade vulnerable TLS connections to 512-bit export-grade cryptography by modifying the ClientHello and ServerHello, can the Logjam ...
3
votes
1answer
231 views

Diffie-Hellman in Https: How are prime numbers picked?

I am trying to understand https, as I understand https uses the Diffie–Hellman method for keys exchange and then AES for encryption. But Diffie–Hellman needs two prime numbers, where do these come ...
2
votes
1answer
132 views

Why is there no “ephemeral non-DH EC” key exchange in TLS?

In RSA key exchange, the client picks a premaster secret and encrypts it with the RSA public key in the server certificate, and sends it to the server. This offers no forward secrecy. In ECDHE key ...
3
votes
1answer
167 views

Can a 3rd party decrypt static Diffie Hellman?

Do cipher suites that use static Diffie Hellman (not Ephemeral) allow for the same 3rd party decryption ability as RSA cipher suites? With RSA key exchange, 3rd parties can gain possession of the ...
1
vote
1answer
174 views

Double 3DES/TDES Encryption

If 3DES/TDES (officially TDEA or Triple DEA - Triple Data Encryption Algorithm) encryption is used twice, using 6 different keys K1-...
1
vote
2answers
192 views

What encryption to choose from the SSL library in python 3?

I've been researching some of the types of encryption that the python SSL library uses. Among them the best I've seen are: ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx = ECDH Au = RSA Enc = AESGCM (256) ...
0
votes
1answer
45 views

Is it possible to multiplex TLS connections by SNI metadata without knowing any keys?

Imagine the following communication diagram: C1-----\ /--B1 C2------P---B2 ...----/ \--... We have multiple C(lients), call them C1, C2, etc. They connect to a ...
0
votes
1answer
38 views

TLS handshake with client later on acting as a server

Is it possible that a client which gets the Digital certificate of the Server during the TLS handshake then acts as a server? Because a server only needs to have a valid digital certificate which it ...
1
vote
0answers
28 views

TLS client authentication from static client image

I'm trying to implement mutual authentication for a TLS connection between a server (ONOS OpenFlow controller) and multiple clients (OpenFlow switches). I'm restricted in that I must create a single ...
0
votes
0answers
46 views

How is Pre Master Secret related to Client.random or Server.random if DH KEX is RSA

For TLS 1.2 cipher Suite AES256-GCM-SHA384, RSA is KEX(key exchagne algorithm). As per standards of RSA Diffie Hellman KEX, after 'ServerHello' message client gets server certificate and it generates ...
1
vote
0answers
36 views

Does SET in any way use SSL?

I just started a course in web security, and I was just wondering quickly if SET in any way would use SSL? I noticed it was developed in part by Netscape. But all I can find is comparisons between the ...
-1
votes
1answer
197 views

TLS handshake cryptography AES key query

I am working on a IoT project where I am trying to perform manual handshake (SSL) for certificates and sending data to the server securely using HTTPS POST method. RSA is used for sending Pre-master ...
0
votes
1answer
35 views

RSASSA-PSS-SIGN modBits size

In RFC 8017 modBits is the length in bits of the RSA modulus n I am using 2048 RSA key ...

1
2 3 4 5
11