Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
3
votes
0answers
50 views

Openssl speed vs TLS speed with postquantum KEM

I'm studying the performance of postquantum KEM in TLS with the OQS (OQS is a project that integrate liboqs to openssl). I don't know why, but the KEM algorithms performance in TLS is 10 times slower ...
1
vote
1answer
39 views

Server authentication in TLS 1.2 with static DH

For (EC)DHE cipher suites, server authenticates itself by proving the possession of the private key matching its certificate by signing ServerKeyExchange message (...
-1
votes
1answer
37 views

Can X3DH algorithm implementation be avoided to thwart Man-in-the-Middle Attack during End-to-End Encryption with Diffie-Hellman Algo, When using SSL

For End-to-End Encryption in chats using Diffie-Hellman Algo the concept of Extended Triple Diffie-Hellman (X3DH) is used to prevent Man-in-the-middle attack (MITM) (courtesy: https://www.qed42.com/...
1
vote
0answers
37 views

How does TLS 1.3 sign key exchange?

From this site: https://tls13.ulfheim.net/ and from https://tools.ietf.org/html/rfc8446#section-2 I can't find the part in which the exchange of keys is signed, isn't one of the parties "...
0
votes
0answers
19 views

Why does AES_GCM sometimes has a SHA for integrity? [duplicate]

For example the following suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 From what I understand the SHA384 at the end is used to authenticate the message, which is exactly what MAC does, and the mode ...
1
vote
1answer
54 views

What hash is concatenating with the data to be signed in TLS 1.3 CertificateVerify message?

According to specification, to create data that will be signed with server private key for CertificateVerify message, we need to concatenate 64 space characters, the string "TLS 1.3, server ...
1
vote
1answer
67 views

How does TLS 1.3 work with PQC signatures?

I know that the first step in TLS 1.3 with modern signatures is hash the message with SHA256/SHA384/SHA512. Do PQC signatures work the same as modern algorithms in TLS 1.3?
1
vote
2answers
70 views

What symmetric algo does TLS use?

So my understanding of TLS is that it uses asymmetric cryptography such as DH to perform a key exchange, once this has occurred it then used an symmetric algorithm for the data exchange. (Obviously I ...
1
vote
2answers
81 views

How does TLS with PQC use key encapsulation?

As there don't seem to be any PQC alternatives for Diffie-Hellman (DH / ECDH), DH must have been replaced by key encapsulation using an ephemeral key pair. However, since TLS 1.3 always performs ...
1
vote
2answers
112 views

Who provides prime numbers for cryptographic protocols?

I am currently writing a thesis about different cryptographic protocols like DH-Key exchange, TLS or IKE. Most of them rely on a prime number earlier or later, so for security reasons I wondered if ...
0
votes
1answer
40 views

Symmetric key as proof of ownership of a session?

I have a question, or rather multiple questions that all relate to the same topic. I am building an application with both a frontend (FE) and a backend (BE). All communication between FE and BE is ...
1
vote
1answer
47 views

Is it safe to send a hashed password over HTTPS or what is the most secure method of authentication?

My rudimentary understanding of HTTPS and the Diffie-Hellman key exchange is that the client and server can establish a secured connection by generating the same key based on their private secrets and ...
4
votes
2answers
78 views

Have any PAKE extensions been added to TLS 1.3?

In TLS 1.2, there was TLS-SRP (RFC 5054,) which provided a password-authenticated key exchange (PAKE) protocol for use with TLS. However, it apparently relied on handshake messages that have been ...
1
vote
1answer
43 views

Different encryption standards and how they relate to auth and algorithms

The main confusion I have is around the different PKCS and relation with SSL (TLS). I have done a lot of research and have found bits and pieces but not necessarily how these relate, so let me explain ...
3
votes
0answers
15 views

SSL handshake - what is the purpose of the finishedClient message?

I am having some difficulties in understanding why is the finishedClient needed. In case an attacker attempts an attack like a replay attack, it will show ...
0
votes
1answer
23 views

Do you need both client and server side support for TLS 1.3 record padding?

When you enable record padding for a client, does a server need a specific option to support this? Or does the other end only need to support TLS 1.3 as well and can handle the padding automatically?
3
votes
2answers
326 views

Why does the TLS spec for TLS-PSK say not to derive the shared secret from a password?

According to a note at the end of section 2.2 of the TLS 1.3 spec (RFC 8446), When using an out-of-band provisioned pre-shared secret, a critical consideration is using sufficient entropy during the ...
1
vote
0answers
19 views

TLS 1.3 clarification needed on hello_hash and subsequent hashes

I am exploring TLS, mainly from the server side at the moment. I am creating a server that will authenticate a client using TLS 1.3 and eventually I will be creating a client authenticating to a ...
2
votes
1answer
101 views

What is the overhead of GCM? And how are GCM tags signed by RSA/PKI?

I'm mainly trying to wrap my head around the pipeline of encryption, hashing and signing. I've read over this question, describing the overhead of GCM, which I understand to be configurable for space-...
6
votes
3answers
245 views

Which Diffie-Hellman Groups does TLS 1.3 support? And should we use TLS 1.3 as a guide?

This is a two part question - and I'm asking as someone moving into a security role, who'll need to standardize practices going forward. (1) I'm curious whether the following 10 different DH Groups ...
1
vote
1answer
76 views

How does the TLS Client Hello message choose the TLS version? [closed]

Im looking at a Client Hello message in wireshark, the client supports 1.2 and 1.3, but Wireshark says the client used TLSv1.3 record layer when the server hasn't replied yet the choosen version. How ...
1
vote
1answer
41 views

OpenSSL TLSv1.3 record padding

OpenSSL supports TLSv1.3 record padding: https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html but I'm not sure if it works like I think it does. If I would choose a factor of 2 it would make ...
5
votes
2answers
427 views

Clarification on the TLS verification process

I am reading this article in my attempt to understand how the TLS verification and chain of trust works. In the piece I come across a section that I am not sure I understand. In the simplified ...
1
vote
2answers
205 views

Stream cipher and block cipher usage in network data encryption

Stream ciphers are usually used for streaming data encryption, such as voice, and also for low layers data encryption. For example, MACSec uses AES-GCM encryption. In L3 ad L4 security protocols (...
2
votes
1answer
56 views

Is client certificate mandatory for two-way TLS?

In One-way Transport Layer Security (TLS), client who initiates the connection verifies the identity of the server or entity it is connecting to, but server not necessarily validates client identity. ...
0
votes
0answers
29 views

Key and Message generated on Client, and validated by Server

(Sorry in advance for my blurry thinking on this: I'm a programmer, not a cryptography expert.) I have a Client/Server web application. The Client needs to be able to alter the local state in ways ...
0
votes
1answer
74 views

TLS 1.2 Server Key Exchange problem

Below the Wireshark snapshot of the handshake compliant to the TLS 1.2. The position 1 displays the enum ServerECDHParams where I can use any curve having the own ID RFC8422. I'm free for example to ...
0
votes
0answers
17 views

Is my password database encryption flow secure?

I'm not an expert and I would be very glad if someone could take a look at it and tell if there are any problems with it Things I know/think are problematic using base64 digest + getting the first 32 ...
1
vote
3answers
87 views

Where is Challenge/Response and Certifcate Verification in TLS-DHE

We have been give a task to identify the following three components in TLS-DHE: Diffie Hellman Key Exchange I am fairly certain that this Part can be found in the Exchange of SKE and CKE, since they ...
1
vote
2answers
50 views

Can TLS be used simply to exchange keys using the handshake protocol?

From what I understand, in general, TLS consists of two protocols: 1 - Handshake protocol: uses public-key cryptography (ECDH, DH) to establish a shared secret between the client and server. 2 - ...
3
votes
1answer
68 views

Allowed key types in an SSL certificate

What are the valid key types which can get signed (or generated and signed) by a CA to constitute an SSL certificate? For the keys used in TLS, the key types I have seen are RSA and EC. Anything else? ...
0
votes
1answer
69 views

Elgamal Encryption: Why does Bob get to reuse his keypair while Alice has to generate a new one for every message?

From Christof Paar's book The protocol consists of two phases, the classical DHKE (Steps a–f) which is followed by the message encryption and decryption (Steps g and h, respectively). Bob computes ...
0
votes
0answers
35 views

Need for DHKE in TLS [duplicate]

Why does TLS as used in https need DHKE? Since the server presents a certificate with a public key, can that not be used for session key establishment? The client (browser) can generate a session key, ...
1
vote
0answers
116 views

How to increase Poly1305 performance?

I was analysing the Chacha20 algorithm and the Poly1305 MAC generation from RFC 7539. It seems that the Chacha20 is quite faster compared to AES on CPUs without hardware support like AES-NI. But ...
0
votes
0answers
38 views

Is ChangeCipherSpec a part of handshake message in tls 1.2?

Is changecipherspec a part of handshake message in transport layer security (tls) 1.2 because according to rfc5246"ChangeCipherSpec messages, alerts, and any other record types are not handshake ...
1
vote
0answers
45 views

Can Encrypt-then-MAC be used with session ticket resumption?

In TLS 1.2, say a session ticket is created for the current session (Session Tickets RFC 5077), and the current session uses the Encrypt-then-MAC extension RFC 7366 (I.E. both client and server ...
0
votes
1answer
77 views

What MAC did SSLv3.0 use? How did it compare to HMAC in TLS 1.0 and above?

According to Wikipedia: TLS has a variety of security measures: Using a message digest enhanced with a key (so only a key-holder can check the MAC). The HMAC construction used by most TLS cipher ...
0
votes
1answer
93 views

OpenSSL cipher suite support / key requirement for ecdhe_ecdsa_with_aes128_cbc_sha256

I hope this is the right place for that kind of question. So actually I am trying to test the TLS implementation of some industrial device. I have to write my own TLS implementation for this, for ...
0
votes
1answer
45 views

Key renewal when the sequence counter is only 32-bit

If we look at the use-case that our sequence counter within our TLS communication is only 32-bit, would an automatic key re-newal be necessary a lot more frequently? We're going to use state-of-the-...
2
votes
2answers
119 views

Is it possible to create a ciphersuite for TLS 1.3 using only the Keccak-sponge/duplex?

Now that Keccak has been chosen as SHA-3 we see that there have been defined quite a few related modes, including authenticated cipher modes, the KMAC message authentication mode, XOF's and whatnot. ...
1
vote
1answer
569 views

DH Elliptic Curves: Why choose a fixed base point?

I am having a first look at the TLS key exchange using Diffie Hellman and try to understand the Elliptic Curve variant of it. So if a client and a server agree on using ECDH for key exchange and they ...
1
vote
1answer
206 views

ECDSA signature with Brainpool curves in TLS possible?

Even the up to date RFC 8446 lists at the page 41 as the options for the ECDSA in e.g. TLS_ECDHE_ECDSA_WITH_... only NIST curves: ...
3
votes
1answer
225 views

Do the session keys have the same value on both sides during TLS?

I have two questions about the sessions keys generated during the last steps of the Handshake phase: Do the "client write key" and the "server write key" have the same value, even ...
0
votes
0answers
51 views

Security of CCM using 8 byte MAC within TLS

In the Dutch "IT Security Guidelines for Transport Layer Security (TLS)" the ciphersuites using AES-128-CCM_8 (i.e. CCM with a 64 bit authentication tag) are considered "insufficient&...
4
votes
0answers
341 views

RSASSA-PSS in TLS 1.2

I know it is possible to use RSASSA-PKCS1-v1_5 with client certificates in TLS 1.3. But what about the other way around: using RSASSA-PSS with client certificates in TLS 1.2? Is it possible to use ...
1
vote
1answer
91 views

Why does TLS 1.3 AES cipher require both a server and client traffic key/iv?

During the TLS 1.3 handshake using the cipher suite TLS_AES_128_GCM_SHA256 a server and client traffic key/iv will be derived using HKDF based on the shared secret, see rfc8446 #7.1 Why is it ...
0
votes
0answers
34 views

Why is MAC encrypted in TLS data transmission? [duplicate]

Referring the slide 16 from this link: I want to ask why is MAC encrypted along with the data to be transmitted. Why isn't MAC just appended at the end of encrypted data ?
1
vote
1answer
95 views

Are TLS connections in china mostly encrypted with AES or with SM4?

What is the dominant symmetric cipher used for TLS connections in China? Is it AES, as it is in the US, or is it SM4?
2
votes
1answer
2k views

TLS 1.2 is still secure or should we move to TLS 1.3?

There are some vulnerability such POODLE, that allows the attacker to gain access to encrypted blocks of data and then gain exposure to plain text information using side channels. Another ...
7
votes
1answer
522 views

How do client and server agree on the values of p and g during DHE exchange?

How do the communicating parties using Finite Field DHE agree on the values of the $p$ and $g$ variables? Are their values fixed for each DHE group? Reading through the TLS 1.3 RFC (8446), the client ...

1
2 3 4 5
11