Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
0
votes
2answers
61 views

Is HTTPS encryption using the RSA algorithm?

According to this article HTTPS and RSA is the same thing: https://tiptopsecurity.com/how-does-https-work-rsa-encryption-explained/ From other sources I learn that they are both asymmetric encryption ...
1
vote
2answers
60 views

Standards for finite-field discrete log cryptography

The NIST and TLS standards for Diffie-Hellman key exchange over a finite field all work in a subgroup of ${\mathbb Z}_p^*$ having prime order $q$, where $p = 2q+1$. On the other hand, DSA has a larger ...
1
vote
0answers
42 views

Comparison of end-to-end encryption and TLS

I am writing a comparison paper about security of electronic communication and I want to compare end-to-end encryption and TLS by giving two examples such as Whatsapp and Facebook Messenger. However, ...
2
votes
1answer
81 views

Is there an actually an alternative to using Diffie Hellman in TLS handshake?

After looking into how TLS handshaking works it seems to inherently include the Diffie Hellman algorithm during the point where they generate a shared secret key. However as I look into this some ...
1
vote
0answers
28 views

Does the order of the “Finished” messages matter in SSL/TLS?

In SSL 3.0 and TLS versions 1.0 through 1.2 the last two messages are the "Client Finished" followed by "Server Finished" messages. These messages include an encrypted (under the established session ...
0
votes
1answer
100 views

Avoid Logjam TLS Attack?

As the Logjam attack allows a Man-in-the-Middle attacker to downgrade vulnerable TLS connections to 512-bit export-grade cryptography by modifying the ClientHello and ServerHello, can the Logjam ...
3
votes
1answer
143 views

Diffie-Hellman in Https: How are prime numbers picked?

I am trying to understand https, as I understand https uses the Diffie–Hellman method for keys exchange and then AES for encryption. But Diffie–Hellman needs two prime numbers, where do these come ...
2
votes
1answer
78 views

Why is there no “ephemeral non-DH EC” key exchange in TLS?

In RSA key exchange, the client picks a premaster secret and encrypts it with the RSA public key in the server certificate, and sends it to the server. This offers no forward secrecy. In ECDHE key ...
3
votes
1answer
77 views

Can a 3rd party decrypt static Diffie Hellman?

Do cipher suites that use static Diffie Hellman (not Ephemeral) allow for the same 3rd party decryption ability as RSA cipher suites? With RSA key exchange, 3rd parties can gain possession of the ...
1
vote
1answer
134 views

Double 3DES/TDES Encryption

If 3DES/TDES (officially TDEA or Triple DEA - Triple Data Encryption Algorithm) encryption is used twice, using 6 different keys K1-...
1
vote
2answers
145 views

What encryption to choose from the SSL library in python 3?

I've been researching some of the types of encryption that the python SSL library uses. Among them the best I've seen are: ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx = ECDH Au = RSA Enc = AESGCM (256) ...
0
votes
1answer
31 views

Is it possible to multiplex TLS connections by SNI metadata without knowing any keys?

Imagine the following communication diagram: C1-----\ /--B1 C2------P---B2 ...----/ \--... We have multiple C(lients), call them C1, C2, etc. They connect to a ...
0
votes
1answer
34 views

TLS handshake with client later on acting as a server

Is it possible that a client which gets the Digital certificate of the Server during the TLS handshake then acts as a server? Because a server only needs to have a valid digital certificate which it ...
1
vote
0answers
27 views

TLS client authentication from static client image

I'm trying to implement mutual authentication for a TLS connection between a server (ONOS OpenFlow controller) and multiple clients (OpenFlow switches). I'm restricted in that I must create a single ...
0
votes
0answers
28 views

How is Pre Master Secret related to Client.random or Server.random if DH KEX is RSA

For TLS 1.2 cipher Suite AES256-GCM-SHA384, RSA is KEX(key exchagne algorithm). As per standards of RSA Diffie Hellman KEX, after 'ServerHello' message client gets server certificate and it generates ...
1
vote
0answers
36 views

Does SET in any way use SSL?

I just started a course in web security, and I was just wondering quickly if SET in any way would use SSL? I noticed it was developed in part by Netscape. But all I can find is comparisons between the ...
-1
votes
1answer
132 views

TLS handshake cryptography AES key query

I am working on a IoT project where I am trying to perform manual handshake (SSL) for certificates and sending data to the server securely using HTTPS POST method. RSA is used for sending Pre-master ...
0
votes
1answer
31 views

RSASSA-PSS-SIGN modBits size

In RFC 8017 modBits is the length in bits of the RSA modulus n I am using 2048 RSA key ...
5
votes
4answers
3k views

Is encrypted e-mail sent over TLS 1.3 a form of “forward secrecy” (similar to something like Signal)?

One common complaint about GPG-encrypted e-mail is that it doesn't provide forward secrecy; however with opportunistic TLS becoming increasingly common in both IMAP and SMTP, it's not unreasonable to ...
3
votes
2answers
93 views

TLS 1.3 Security against PKCS#1v1.5

This paper explains an attack on TLS 1.3. This was published way back in 2015 when TLS RFC was in draft stage. My question is now TLS 1.3 RFC is finalized, is this attack got addressed?
0
votes
1answer
61 views

Observing cipher suites and certificate algorithms without man-in-the-middle

I manage a proxy server. Is it technically possible to observe and determine which cipher suite is selected between end points (client and server) without changing their SSL certificate, without ...
0
votes
1answer
34 views

Is it necessary to have a certificate when we use TLS

When we say a communication is secured by the latest version of TLS, can we say that Man-in-the-Middle attack is not possible? Do not consider the situations that we can down grade the communication ...
-2
votes
1answer
80 views

Why do we need HMAC?

AFAIK, HMAC solves the collision problem of hash algorithms by mixing in a pre shared secret. Can't we just use the pre shared secret to symmetrically encrypt data and leave out the hashing?
0
votes
1answer
76 views

How does tls 1.3 cope with man in the middle (in key exchange)

in case i cannot do PSK (give the same key to both sides via physical means). i saw tls1.3 still support DH (doesnt matter that it is DHE or ECDH). isnt that makes it a weak key exchange? do they ...
-1
votes
2answers
60 views

A simple misunderstanding of SSL/TLS

I just came to learn about Deffie Hellman Key Exchange. And a little bit about RSA. I came to DH from something about SSL. From what I understood before is that SSL uses DH and TLS uses RSA, but after ...
1
vote
1answer
56 views

Size of Key Material of TLS_DHE_RSA_WITH_AES_256_CBC_SHA

What is the size of key material required for generating MAC keys, encryption keys and IV when use TLS_DHE_RSA_WITH_AES_256_CBC_SHA ? How to calculate it?
1
vote
1answer
52 views

Is this pairing scheme for establishing trust between two devices with self-signed TLS certs secure from MITM?

Assume two devices (A and B) with self-signed TLS certificates (this part can't change). We want these devices to trust each other. One way to do this is to simply copy A's cert over to B's allowed ...
2
votes
0answers
76 views

Security of MAC-Then-Encrypt without MAC key authentication

We have the following settings in our system: TLS 1.2 using legacy cipher suite - OFB mode (using 64 bit block cipher) and trunkated CBC-MAC (32 bit). The goal is to achieve authenticated encryption ...
2
votes
1answer
106 views

TLS_DH_RSA_* cipher, how can static DH use an RSA certificate?

I am confused about TLS_DH_RSA_* ciphers because, for DH to work, the server certificate has to include a DH public key, but for server authentication the server certificate needs an RSA public key. ...
1
vote
0answers
80 views

SDES algorithm purpose

What is the purpose of SDES algorithm? (Session Description Protocol Security Descriptions) What are the problems in the way it exchanges keys? I have tried to search about these quastions but i ...
0
votes
0answers
32 views

Pitfalls of wildcard certificates with unique key pairs?

I am having difficulty finding information regarding using wildcard certificates with unique key pairs. I understand if you duplicate key pairs across multiple servers and one becomes compromised, an ...
2
votes
2answers
248 views

Talking TLS with EC cryptography and the secp256k1 curve [duplicate]

How reasonable would it be to speak TLS over the secp256k1 curve? My initial experiments show that OpenSSL supports it (albeit with special flags, see below): Running an OpenSSL client against an ...
2
votes
2answers
86 views

Why is it not possible to tap into the HTTPS traffic specifically going from the server to the client?

How I think HTTPS works when sending data from server to client: -Server has 1 public, 1 private key. -Client has access to the server's public key and not it's private key. -Client has no keys of ...
1
vote
1answer
65 views

How are public keys securely and reliably obtained across the internet?

I've just decided to start learning all about PKIs, and I have come across what seems like a paradox. When fetching a public key from either a server or a CA, how can we be sure that the public key ...
3
votes
0answers
48 views

Does Openssl 1.1.1 library supports sending multiple identities as part of PSK?

Does Openssl 1.1.1 supports sending multiple ticket identities as part of PSK? i have gone through the openssl code and i don't see that openssl supports it. could someone please confirm it if i ...
2
votes
1answer
128 views

Questions regarding static Diffie-Hellman (ephemeral-static) usage in TLS

It looks to me that there 3 main variants of Diffie-Hellman in SSL/TLS. Anonymous mode; Static mode; Ephemeral mode. In case of static DH the server owns an X.509 certificate with a DH public key ...
4
votes
1answer
368 views

Static Diffie-Hellman in TLS

Static Diffie-Hellman (cipher suites with DH in their name but neither DHE or DH_anon - ...
2
votes
1answer
47 views

Generate a per data shared secret vs per session

I have read about SSL that they persist the shared-secret for the entire session. However, someone in stackoverflow suggested a way of generating a shared secret for each data to send and then send ...
7
votes
1answer
348 views

Which TLS features are vulnerable to chosen-prefixes collision on SHA-1?

Gaëtan Leurent and Thomas Peyrin's preprint From Collisions to Chosen-Prefix Collisions - Application to Full SHA-1 (in volume 1 of proceedings of the forthcoming Eurocrypt 2019) shows a feasible ...
6
votes
2answers
2k views

Why is PerfectForwardSecrecy considered OK, when it has same defects as salt-less password hashing?

PFS suites suffer from the same defects as any other salt-less password hashing scheme. Why is everyone promoting Perfect Forward Secrecy (PFS) ciphersuites so fiercely? Namely, when the group/hash ...
1
vote
0answers
32 views

Which parts of a TLS connection can I safely reuse for DTLS to the same peer?

Suppose I need both encrypted TCP and UDP, say TCP for reliable control signals from server to client and UDP for low latency data from client to server. If I first establish TLS, for the DTLS ...
3
votes
1answer
285 views

How will be cipher selected when client is running on version TLS 1.3 and server is running on TLS 1.2?

How will be cipher selected when a client is running on version TLS 1.3 and server is running on TLS 1.2? The cipher list provided by TLS 1.3 client will be different than the version supported on ...
2
votes
1answer
87 views

What key is used to encrypt the certificate and certificate verify message in TLS1.3?

Which key is used to encrypt certificate and certificate verify message in TLS1.3? I could not figure out which one it is reading section 4.4.2 of RFC 8846 and I only saw a vague mention on page 11.
0
votes
1answer
67 views

What SALT value will be used in HKDF_EXTRACT in TLS1.3?

What SALT value will be used in HKDF_EXTRACT while generating the Handshake Secret (when there will not be any PSK)?
1
vote
1answer
317 views

When do clients use TLS in PSK mode?

The TLS protocol can perform the handshake in different modes. Either fresh handshake where new keys are generated, or using Pre Shared Keys (PSK) or what was know as Session Resumption in previous ...
4
votes
2answers
540 views

Which hash is used when providing signature algorithm ED25519 or ED448?

From TLS 1.3 there are two signature algorithms using edDSA: /* EdDSA algorithms */ ed25519(0x0807), ed448(0x0808), All the other signature-...
8
votes
1answer
718 views

Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3?

Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3? How keys can be exchanged then? https://tools.ietf.org/html/draft-ietf-tls-tls13-28
1
vote
0answers
310 views

Which 'info' and 'salt' parameters to use in HKDF for TLS 1.3?

all the following discussion is for HKDF in TLS1.3: Regarding the 'salt' parameter in - HKDF-Extract(salt, IKM) as written in RFC 5869: HKDF without having to protect the secrecy of the salt. In ...
0
votes
1answer
255 views

Is LibreSSL affected? - Downgrade Attack on TLS 1.3

https://news.ycombinator.com/item?id=19111707 https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/february/downgrade-attack-on-tls-1.3-and-vulnerabilities-in-major-tls-libraries/ No ...
2
votes
1answer
901 views

TLS 1.3 Secure Renegotiation not supported [closed]

I get the message "Secure Renegotiation IS NOT supported" if a TLS 1.3 cipher will be chosen at a TLS handshake with openssl s_client. Since TLS 1.3 does not support renegotiation at all I assume that ...

1
2 3 4 5
10