Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

3
votes
2answers
35 views

JWT Login Security

I am new to security and I am wondering if JWT is secure enough. From what I have read online the flow goes like this. 1. Clients logs in by sending their credentials to the identity provider. 2. ...
0
votes
0answers
30 views

CBC related TLS cipher suites to be disabled in the server side

I understand the TLS cipher suites using CBC mode are susceptible to timing attacks. From that understanding it seems that the cipher suites using GCM (CTR-based) are safe to use considering they don'...
2
votes
2answers
23 views

Does the Server Key Exchange sign a hash or text

In TLS 1.2 when using ECDHE_RSA, the ServerKeyExchange message contains a signature over the server's ECDHE public parameters. My question is: Is the signature over ...
1
vote
1answer
62 views

How Elliptic-Curve affects the Server Key Exchange parameters

In Finite Field DHE, the server sends the following parameters in the server key exchange message: $p$: prime $g$: group $g^b$: the server's public DH key In DHE_RSA (non anonymous DHE), the server ...
0
votes
0answers
50 views

Is it necessary to encrypt messages client side if using HTTPS? [migrated]

I am creating a messaging service for an app I'm developing and right now the data flow is as follows: Send: message sent to server => message encrypted based on user's public key and signed using ...
0
votes
0answers
20 views

How to use a retrieved Fixed DH shared key with wireshark? [closed]

I have a .pcap file from a communication recorded from A to B. The communication is encrypted and Fixed DH was used to establish a shared secret. The parameters g and p were chosen such that an ...
0
votes
1answer
43 views

When using Client Certificates, is it usual to generate your own?

We're building a webservice for a third party customer who wants us to use "two-way SSL". By which I understand them to mean they want us to host the site using https, and to require that include a ...
3
votes
3answers
337 views

What is different below two Ciphersuites?

I have two questions; I need an explanation for the differences of below two cipher suites. How do they work with SSL/TLS protocol? (my main concern first one doesn't have '...
1
vote
2answers
57 views

signature with Bleichenbacher’s attack

I understood Bleichenbacher & ROBOTO attack, however I have some trouble understanding Section 3.5 of ROBOT attack which discusses retrieving private keys. https://www.usenix.org/system/files/...
0
votes
1answer
70 views

Cipher Block Chaining (CBC) encryption in SSL

Is cipher block chaining (CBC) mode used in SSL encryption? If block reordering is already protected by SSL and TCP sequence numbers, what added advantage does CBC provide?
0
votes
1answer
39 views

How is the TLS 1.2 sequence number generated?

In the other ciphers supported by TLS 1.2, namely stream cipher and CBC block cipher mode, the sequence number is implicitly in the MAC (RFC5246, 6.2.3.1): ...
0
votes
1answer
55 views

Tls protocols: is the simple diffie hellman key exchange still used these days?

Or did it mostly get replaced by ecdh for key exchange and rsa for authentication ?
2
votes
1answer
55 views

Does DROWN attack break 2048-bit key itself or just the plaintext encrypted with the RSA key

Does the DROWN attack enable breaking strong RSA keys (e.g. the 2048-bit key itself) or enable breaking the plaintext (i.e. pre-master key) that is encrypted with a 2048-bit (or any strong) RSA, if ...
1
vote
0answers
37 views

Is my way safe to remove SSL CA Cert by DHT and PoW NodeID for a decentralized system?

To implement a decentralized system, I wrote a TLS like P2P net stack. The main idea is removing CA Cert from the whole system by using a DHT for Naming and Key Exchange. I am not a crypto expert, so ...
0
votes
1answer
42 views

How does OpenVPN work?

I'm confused with the technologies that OpenVPN uses. The official site mentions it uses SSL/TLS in-place of IKEv1/IKEv2, and uses IPSec ESP to secure the data, and yet that it isn't compatible with ...
1
vote
1answer
23 views

How to prove to a third-party that a given response came from a specific domain?

Suppose I've got a response from a website using https. Is it possible to store the certificate and keys exchange to prove to a third-party that the response came from that domain?
8
votes
1answer
166 views

Can the lengths of HTTPS requests be used to deduce which public pages on a site are visited?

I thought of this recently: There are some websites which have many publicly accessible pages, some of which could be embarrassing despite being public (e.g. Wikipedia). The HTML for these pages also ...
0
votes
0answers
24 views

Is there a way to quickly verify a TLS Notary proof?

I am experimenting with a Proof-of-Delivery concept where participants need to prove that they served a web-page to a user. I am familiar with the concept of TLS Notary proofs which also contain a ...
2
votes
1answer
81 views

In TLS 1.3 handshake, what's “PSK binders” used for?

PSK handhanke works like session ticket resumption in TLS 1.2, but I found a set of PSK binder for each identity(ticket) in TLS 1.3, why ...
2
votes
1answer
34 views

What's the `ticket_age_add` and `obfuscated_ticket_age ` used for in TLS 1.3

In RFC, I only find such description: This addition prevents passive observers from correlating connections unless tickets are reused ...
0
votes
1answer
45 views

What is the most popular cipher suite used in TLS 1.2 for HTTPS?

I'm trying to do some performance (time) calculations over TLS. I have the data I need for a variety of cipher suites but in order for the calculations to generalize well, I need to know if there is a ...
0
votes
2answers
111 views

UDP and AES with C++

I'm implementing different applications that will use UDP to exchange real-time data, thus a low impact on performance is very important. This system will not be connected to the Internet so I just ...
3
votes
2answers
57 views

Private key ECDSA/TLS

Is the private key required once the certificate is hashed and signed? After a certificate is generated, public key is shared within the certificate itself. Is the private key used for any other ...
62
votes
2answers
9k views

Why doesn't SSH use TLS?

Most cryptographically protected protocols use TLS these days. This applies to mail protocols, HTTP and many others. The newly designed QUIC has also adopted TLS as its cryptography layer. However, ...
2
votes
1answer
25 views

Does the server signs message body after ssl handshake?

So after SSL handshake the master secret is used to securely transfer data encrypted using symmetric cryptography. My question is simple: after SSL handshake, when the server (for example my bank) ...
0
votes
2answers
67 views

How does authentication work differently between asymmetric and symmetric cryptography?

Must Bob and Alice establish a 'connection' before a symmetric or asymmetric encryption scheme is secure? If so, is there ever some expected plaintext whose decryption authenticates the users? In ...
0
votes
2answers
77 views

TLS1.2 AES 128 CBC Encrypted Data size is not a multiple of block size [closed]

I know that TLS ciphers such as TLS_RSA_WITH_AES_128_CBC_SHA transmit data as shown https://tools.ietf.org/html/rfc5246#section-6.2.3.2. From my understanding the ciphertext MUST be a multiple of the ...
2
votes
1answer
43 views

TLS Extension signature_algorithms values

I hate asking for a reference, but I'm having a hard time finding this. The iana page on tls extensions just links me back to rfc5246 where it only has the following values: ...
1
vote
1answer
250 views

HMAC Key Sizes for MD5, SHA1, SHA224|256|384|512

I'm trying to find an authoritative source for the HMAC Key sizes for each of the hashing algorithms below. Specifically for TLS implementations of HMAC. I found this table in RFC5246: ...
1
vote
1answer
93 views

does TLS 1.3 use ECDSA-Sig-Value encoded signatures for Ed25519 / Ed448?

Quoting The Transport Layer Security (TLS) Protocol Version 1.3: ECDSA algorithms Indicates a signature algorithm using ECDSA [ECDSA], the corresponding curve as defined in ANSI X9.62 [...
7
votes
1answer
461 views

TLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

TLS 1.2 defines a number of cipher suites that employ AES-GCM, e.g.: ...
4
votes
1answer
109 views

TLS: Risks of using a NULL cipher with encryption implemented in application?

We have a browser-launched JNLP/WebStart application that is no longer able to establish client-server CORBA/IIOP communications across TLS 1.0/1.1 due to relying on a cipher suite that uses an ...
1
vote
1answer
55 views

Advantages of a TLS handshake over pre-shared public keys

Lets assume the following setup: A vendor manufactures IoT devices where each is able to generate an individual private/public key-pair. Only the public key is exposed, the private key is assumed to ...
3
votes
2answers
577 views

Are TLS 1.2 AES-CBC and AES-GCM Authenticated Encryption ciphersuites?

In the answer of the following post: Why was AES CBC removed in TLS 1.3?, I quote the following from the chosen answer: After the Lucky13 attack (a timing oracle caused by MAC-then-encrypt), it ...
1
vote
2answers
57 views

What is a size of mac_length and mac_key_length for TLS cipher suites HMAC using SHA384 and SHA512?

i failed to find explicit definition of hash output size and mac_key_size for hmac based on SHA384 and SHA512. RFC5246 specifies: but defines only
0
votes
2answers
35 views

Self signed certificate for mobile app and backend from same company

My company's product is Android and iOS mobile app which connects to our own backend. All interactions of the mobile app are with backend developed by our own company. In such a situation, can the ...
0
votes
0answers
33 views

Is there anything out to generate certificates using VXEdDSA?

As the title says - Is there anything out to generate certificates using VXEdDSA? And if there isn't what options do I have for hardening security on tls 1.3 with ed25519 certificate so that a ...
1
vote
1answer
57 views

Clarifications regarding ciphers and Nmap scan

I'm running the below Nmap command to test the strength of the cipher suites I have used in my host nmap -sV --script ssl-enum-ciphers -p 443 <host> The ...
6
votes
2answers
283 views

What's the difference between rsa_pss_pss_* and rsa_pss_rsae_* schemes?

I'm trying to understand the difference between rsa_pss_pss_ and rsa_pss_rsae_. The picture shows the extension of TLS1.3's ...
1
vote
1answer
33 views

Does semi-honest adversary eavesdrop honest parties communication?

Assume we have a multi-party computation protocol and the protocol definition, where both of them consider a semi-honest adversary, without explicitly assuming the type of channel the parties want to ...
0
votes
0answers
132 views

TLS 1.3: HKDF-Expand

In RFC5869 I found that the function of the HKDF-Expand on the input assumes the parameter $L$ which denotes length of output keying material in octets ($\leq 255*\text{Hash}_{Length}$), and then the $...
2
votes
0answers
78 views

What kind of RSA padding mode is it?

1: I have a HTTPS server and I added hooks in RSA decryption procedure to dump error RSA input(client key exchange). 2: I get some RSA input that I couldn't check padding successfully(It's usual) and ...
2
votes
1answer
37 views

What should be broken to break a cipher with perfect forward secrecy?

What should be broken to break a cipher with perfect forward secrecy as a passive observer? RSA/EC analog, (EC)DHE or both?
3
votes
0answers
55 views

X.509 strong authentication protocols

Is there also a protocol definition in X.509? In "Handbook of Applied Cryptography" by A. Menezes there is a reference to X.509 strong authentication protocol, nevertheless, I could not find the ...
2
votes
0answers
50 views

Are there any one-way operations that could be used for Diffie-Hellman post-quantum? (See criteria)

With quantum-computers looming, there is a need for Public Key Cryptosystems that can withstand attacks by quantum-computers. Are there any known one-way operations that fit the following criteria? ...
1
vote
2answers
645 views

Why is a Diffie-Hellman key exchange required when RSA is already being used for key exchange in TLS?

Specifically with TLS, What is RSA used for during key exchange? What is Diffie-Hellman used for? Since RSA already provides authenticity and confidentiality, why is Diffie-Hellman used during the ...
1
vote
1answer
39 views

What 32 bytes TLS data records for?

I've captured my tor client network traffic and noticed that in every packet it sends 2 TLS records first of which is always 32 bytes long. The first TLS record seems not to be carrying any data. What ...
-1
votes
1answer
33 views

How does the Client Validation the Server Certificate

After receiving a certificate from a server, how does the browser validate it? Does it have to communicate with the CA for instance or can do this itself with a calculation?
1
vote
3answers
76 views

Is this a correct SSL explanation in layman's terms?

I'm looking to provide a basic / layman's explanation of SSLs to clients and want to be sure it is correct. My explanation is below and would appreciate any feedback / corrections. Basically, the ...