Skip to main content

Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
5 votes
1 answer
279 views

Openssl speed vs TLS speed with post-quantum KEM

I'm studying the performance of post-quantum KEM in TLS with the OQS (OQS is a project that integrate liboqs to openssl). I don't know why, but the KEM algorithms performance in TLS is 10 times slower ...
0 votes
1 answer
73 views

Unknown NamedGroup in key_share from Google Chrome

My server has got key_share externsions while TLC 1.3 handshaking: 1 19018 = 0x4a4a = GREASE ...
45 votes
3 answers
39k views

Is Triple DES still considered safe to use?

What it says on the tin. Is it still used in things like TLS?
2 votes
1 answer
131 views

Is there a PQ-TLS that is close to practical?

Are there any cryptographic protocols available for HTTP such as TLS or QUIC with practical or near-practical quantum computer resistance?
2 votes
1 answer
51 views

How to process received 'new_session_ticket' message in TLS 1.3?

I am implementing simple client using TLS 1.3 (my library). The client and a server have sent your 'finished' each other. So, the my client expects application data ...
0 votes
1 answer
74 views

In SSL/TLS, why do we need 2 public keys? [closed]

Server adds its public key in SSL Certificate and send it to client. However, Client already has the public key. If it already has a public key, then it does not need to have server's public key which ...
1 vote
0 answers
95 views

Clarification regarding maximum size of a TLS 1.3 record

RFC8446 states that: the full encoded TLSInnerPlaintext MUST NOT exceed 2^14 + 1 octets It also states: length: The length (in bytes) of the following ...
4 votes
2 answers
342 views

Concatenation of password and TOTP - possible issues

I have come across a two factor login mechanism using Time based OTP (TOTP). TOTP (6 digits) is shown to the user in an app. There are two ways of logging in. Method 1: User inputs the username and ...
0 votes
1 answer
80 views

Is there a TLS cipher suite with perfect forward secrecy (PFS) but without authentication, i.e. anonymous, ephemeral key exchange?

Is there a TLS cipher suite with perfect forward secrecy (PFS) but without authentication, i.e. anonymous key exchange? I am not asking or wish to discuss the principle question whether an ...
0 votes
1 answer
58 views

TLS 1.3 digital certificates and ephemeral Diffie Hellman

There is a lot of confusing information out there regarding the role of digital certificates and the use of Ephimeral Diffie Hellman in how TLS 1.3 operates. Would it be correct to state that the the ...
0 votes
1 answer
192 views

Why does TLS 1.3 (Client/Server) Hello require a random number?

Why does TLS 1.3 (Client/Server) Hello require a random number? Wouldn't a sequence number also work? I do understand that a sequence number is predictable but I don't see why this would be a problem ...
20 votes
4 answers
14k views

Is there a standard for OpenSSL-interoperable AES encryption?

Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64). I hear it's ...
0 votes
0 answers
54 views

Secure key exchange for custom USB device

I'm learning various cryptography protocols and use cases and since I'm developing a USB device and PC application, it would be nice to use encrypted communication. I studied TLS 1.2 key exchange but ...
1 vote
1 answer
25 views

Use of CertificateVerify in TLS_DH_RSA with client authentication?

Does anyone know if CertificateVerify is sent in TLS_DH_RSA with client authentication? Does anyone know the RFC or could explain the meaning of it? With TLS_RSA, a ...
3 votes
1 answer
571 views

TLS_DH_RSA_* cipher, how can static DH use an RSA certificate?

I am confused about TLS_DH_RSA_* ciphers because, for DH to work, the server certificate has to include a DH public key, but for server authentication the server certificate needs an RSA public key. ...
1 vote
2 answers
2k views

How does TLS 1.3 provide authentication without using the public key to verify that the server has a private key?

In the TLS 1.2 handshake, after checking the certificate, the public key from the certificate was used to encrypt the data to create a symmetric encryption key, hence the authentication took place on ...
3 votes
2 answers
2k views

TLS Handshake : Server authentication or only Server ‘s Certificate authentication?

I have some difficulty understanding the way in which the Server is really authenticated by Client in TLS handshake (in case of using RSA key exchange). When Client receives Server ‘s Certificate and ...
2 votes
0 answers
75 views

Tor Key Exchange Client - Middle Node

I am currently exploring the workings of the Tor network, specifically how the Diffie-Hellman (DH) key exchange protocol is employed to establish shared secret keys between the client and each relay ...
2 votes
0 answers
96 views

Questions about TLS 1.3 inspection with commercial middleboxes

i'm trying to learn how commercial (for example PaloAlto or Fortigate) middleboxes intercept and decrypt TLS 1.3 traffic. To do that I started observing the TLS traffic between the client, middlebox ...
2 votes
3 answers
999 views

Where is Challenge/Response and Certifcate Verification in TLS-DHE

We have been give a task to identify the following three components in TLS-DHE: Diffie Hellman Key Exchange I am fairly certain that this Part can be found in the Exchange of SKE and CKE, since they ...
0 votes
1 answer
298 views

Hybrid key exchange in TLS 1.3

In Hybrid key exchange in TLS 1.3, they mention that with a hybrid approach, we concatenate the shared secret from each method (say KEM like Kyber768 + classical ECDH X25519 = X22519Kyer768). ...
3 votes
1 answer
446 views

Is there open-source test tool that operate TLS server/client with unexpected behaviors

I'm working in an embedded system that uses TLS v1.2 protocol for network security and it acts as a client. Now I want to test some TLS security functions that require connecting with a TLS server and ...
0 votes
0 answers
56 views

Framework for manipulating digital signatures

for a research project, i am currently looking for a way to manipulate the digital signature of a HTTPS TLS message flow. More specifically, i am trying to create a working example for a malicious ...
1 vote
1 answer
60 views

TLS 1.2, encrypt_then_mac. No sequence number in packet?

TLS 1.2, if encrypt_then_mac extension is enabled. Sequence number is used during MAC calculation. But it's not used during the 'body' encryption. Here, seq_num is used only when calling MAC() ...
1 vote
1 answer
230 views

TLS 1.3: How is Finished message useful when authenticating via certificates?

I cannot quite understand, if Finished message serves any particular purpose when the server is being authenticated via certificates, or if it there just for "consistency" or "extra ...
10 votes
1 answer
3k views

is TLS compression used in modern browsers?

In 2012 CRIME attack effectively killed TLS compression. Has anything changed since 2012 regarding compression in TLS or have modern browsers sacrificed security over performance? If browsers now use ...
1 vote
1 answer
144 views

Regarding the Digital Signature Algorithm During Client Authentication in TLS 1.2

In TLS 1.2, when client authentication is carried out, digital signatures are utilized. However, at what point is the specific signature algorithm communicated to the server? It seems to me that the ...
1 vote
0 answers
71 views

Is the SNI extension signed in TLS 1.3?

In TLS 1.3, and since the server signs the entire handshake messages including the server hello message, in this case, is the SNI extension of the client hello message, is it included in the content ...
0 votes
0 answers
36 views

How by changing ciphertext can the attacker know the length of the padding in POODLE attack

I try to understand the POODLE attack. I read that the attacker try to change one byte of the last block of the ciphertext. Becasue the last block is only have padding and the last byte is the padding ...
0 votes
0 answers
57 views

Public key encryption with a large number of users

I'm building an app that will primarily be iOS or Android based. My plan is for every user to have their own key pair. The public key will be stored on the server along with a 128 bit UUID which is ...
0 votes
0 answers
1k views

Using curl with TLS1.3

I need to test my server with curl 8.2.1 utility. My server works only with TLS1.3 and cipher 0x1302 - TLS_AES_256_GCM_SHA384. ...
0 votes
1 answer
86 views

Does TLS1.3 support DHE_EXPORT cipher suite? [duplicate]

I just wanted to know for sure that TLS 1.3 does not support DHE_EXPORT cipher suits.
3 votes
1 answer
73 views

how 0/n split prevent BEAST attack against TLS?

I read that to mitigrate BEAST attack openSSL tried to inject empty TLS record before each real TLS record. and by doing that there is no opportunity to execute an attack but i dont understand way? ...
0 votes
0 answers
52 views

Encrypted Alert21- Error code 214

I am working on TLS 1.2 Cipher TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, After send the application data server throws an error message ...
1 vote
0 answers
191 views

TLS 1.3 key_share capture without certificate exchange

I am working on an investigation on TLS 1.3. I've came across an article of qacafe where they shared a TLS 1.3 handshake sequence. Wireshark capture. In this capture you see that in the Client Hello a ...
63 votes
5 answers
101k views

What's the appeal of using ChaCha20 instead of AES?

I read about ChaCha20 being used in TLS by Google, SSH, and towards standardization in general. What's the appeal of using something other than AES, what with AES receiving dedicated CPU instructions ...
1 vote
1 answer
270 views

For TLS-PSK (pre-shared key), should non-ephemeral key exchange be preferred over ephemeral one?

TLS 1.3 specify two pre-shared key exchange modes, which are psk_ke and psk_dhe_ke. The former is a non-ephemeral key exchange ...
0 votes
0 answers
44 views

How to know details of generating keying material in openssl library?

I am testing my TLS 1.3 server (it does not use openssl library) using openssl s_client utility. I have found out that ...
0 votes
0 answers
14 views

A reason of "SSL_ERROR_RX_MALFORMED_HELLO_RETRY_REQUEST" error in FF when connecting wirh Firefox (TLS 1.3)

I am trying to test my server program which implements TLS 1.3 connection - it should establish TLS 1.3 connection. My server uses a self-signed certificate, created in ...
0 votes
1 answer
295 views

How to define RSA padding for RSA encryption in openssl 3.0?

I am studying openssl 3.0 (Windows, C++) in order to encrypt data using RSA. More specifically, I need to sign a CertificateVerify server message in TLS 1.3. The ...
0 votes
0 answers
78 views

How I can force the openssl "s_client" utility to generate predefined random bytes in it's ClientHello?

I'm testing my server application (TLS 1.3) using s_client program from the openssl library and I need to force the ...
0 votes
1 answer
352 views

How to force openssl/s_client to send a keyshare for the specific elliptic curve (secp256r1)?

I want to test my server application (TLS 1.3) using s_client program from the openssl library and I need to get from the ...
18 votes
8 answers
23k views

Why is SSL on top of TCP?

Why is SSL not under TCP (the Transport layer)?
3 votes
1 answer
516 views

How does TLS 1.3 restrict the Diffie-Hellman parameters to ones that are known to be secure?

In previous versions of TLS, the choice of the Diffie-Hellman parameters was up to the participants. This resulted in some implementations choosing incorrectly, resulting in vulnerable implementations ...
1 vote
1 answer
281 views

Using of the Transcript-Hash in TLS 1.3

The section 4.4.1 of the RFC 8446 tells about Transcript-Hash. My questions about the transcript-hash are: Must a server hash (a) all own sent messages, enumerate in the section 4.4.1, or (b) own ...
1 vote
1 answer
421 views

Forming ECC key (TLS) in X9.63 format

I am studying TLS handshaking by example a program tlse, which uses libtomcrypt library.I see that in line 5236 (link above) the program call libtomcrypt procedure ...
1 vote
1 answer
213 views

Where in the TLS 1.3 record is the sequence number located?

The sequence number should be a 64 bit number in every TLS record, but the record header layer is only 5 bytes long and I am looking at a Wireshark pcap, where the TLS record only includes the header ...
2 votes
1 answer
69 views

Should a certificate message of a server be encypted in TLS 1.3?

Section 2 of RFC 8446 says about the phase "Key Exchange": … Everything after this phase is encrypted. The "Certificate" message is sent after &...
3 votes
2 answers
223 views

"Supported groups" in RFC 8446 (TLS 1.3)

What is meant by "supported groups" in the section 4.2.7. "Supported Groups" of RFC 8446: /* Finite Field Groups (DHE) */ ffdhe2048(0x0100), ffdhe3072(0x0101), etc: Is the digits - ...
0 votes
1 answer
57 views

Why is IV in RFC8448 examples only 12 octets instead of 16?

I am working on manual decryption of application data in TLS 1.3 by going through example in RFC8448. I successfully derived and expanded key and IV, but the IV in examples is only 12 bytes long ...

1
2 3 4 5
14