Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
2
votes
1answer
38 views

What does the running transcript hash in RFC-8446: TLS 1.3 do?

From RFC8446: In general, implementations can implement the transcript by keeping a running transcript hash value based on the negotiated hash. Note, however, that subsequent post-handshake ...
1
vote
1answer
12 views

What salt should be used when generating TLS 1.3 CertificateVerify message?

When signing handshake messages digest, the MGF1 function takes some salt value with same length as the digest has. But what content must be in salt's buffer? I explored the source code of libnettle, ...
0
votes
0answers
25 views

What SSL library is used by MS Edge? [closed]

IE uses/used SChannel, but I haven't been able to confirm what library Edge uses. I'm trying to profile different libraries used by modern browsers.
0
votes
2answers
59 views

What does TLS 1.2 mean by SHA functions?

I'm looking at the technical docs for TLS 1.2 and it says it uses SHA (so hashing algorithms): 7.4.1.4.1. Signature Algorithms But hashing just digests an input, to do things like user authentication....
-1
votes
1answer
73 views

How much security does using TLS provide?

If someone tells me their service uses TLS 1.2 or higher, how much 'guaranteed' security does this provide? Is it possible to correctly claim to be using TLS 1.2 or 1.3 and still be insecure? For ...
3
votes
0answers
53 views

Openssl speed vs TLS speed with postquantum KEM

I'm studying the performance of postquantum KEM in TLS with the OQS (OQS is a project that integrate liboqs to openssl). I don't know why, but the KEM algorithms performance in TLS is 10 times slower ...
0
votes
1answer
105 views

Prior art: SSH key authn over TLS?

I’m developing an application that runs over TLS. In addition to password-based authentication we’d like to be able to use SSH keys. Is there any prior art in using SSH keys for authentication over ...
1
vote
1answer
40 views

Server authentication in TLS 1.2 with static DH

For (EC)DHE cipher suites, server authenticates itself by proving the possession of the private key matching its certificate by signing ServerKeyExchange message (...
8
votes
3answers
5k views

What is different below two Ciphersuites?

I have two questions; I need an explanation for the differences of below two cipher suites. How do they work with SSL/TLS protocol? (my main concern first one doesn't have '...
-1
votes
1answer
37 views

Can X3DH algorithm implementation be avoided to thwart Man-in-the-Middle Attack during End-to-End Encryption with Diffie-Hellman Algo, When using SSL

For End-to-End Encryption in chats using Diffie-Hellman Algo the concept of Extended Triple Diffie-Hellman (X3DH) is used to prevent Man-in-the-middle attack (MITM) (courtesy: https://www.qed42.com/...
1
vote
0answers
37 views

How does TLS 1.3 sign key exchange?

From this site: https://tls13.ulfheim.net/ and from https://tools.ietf.org/html/rfc8446#section-2 I can't find the part in which the exchange of keys is signed, isn't one of the parties "...
0
votes
0answers
19 views

Why does AES_GCM sometimes has a SHA for integrity? [duplicate]

For example the following suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 From what I understand the SHA384 at the end is used to authenticate the message, which is exactly what MAC does, and the mode ...
1
vote
1answer
60 views

What hash is concatenating with the data to be signed in TLS 1.3 CertificateVerify message?

According to specification, to create data that will be signed with server private key for CertificateVerify message, we need to concatenate 64 space characters, the string "TLS 1.3, server ...
5
votes
1answer
3k views

What is the 'Version Incompatibility" Problem in TLS 1.1/1.2 and 1.0?

It's unclear to me if there are multiple problems, or a single one, (and just what that problem is) with servers incorrectly negotiating down from a client offering 1.1 or 1.2 to something they ...
1
vote
1answer
69 views

How does TLS 1.3 work with PQC signatures?

I know that the first step in TLS 1.3 with modern signatures is hash the message with SHA256/SHA384/SHA512. Do PQC signatures work the same as modern algorithms in TLS 1.3?
12
votes
3answers
19k views

How does a client verify a server certificate?

As far as I know, when I request a certificate from Verisign (for example), and after they approved that I is me, they create a certificate (for me) that contains the digital signature and public key. ...
1
vote
2answers
70 views

What symmetric algo does TLS use?

So my understanding of TLS is that it uses asymmetric cryptography such as DH to perform a key exchange, once this has occurred it then used an symmetric algorithm for the data exchange. (Obviously I ...
2
votes
2answers
102 views

How does TLS with PQC use key encapsulation?

As there don't seem to be any PQC alternatives for Diffie-Hellman (DH / ECDH), DH must have been replaced by key encapsulation using an ephemeral key pair. However, since TLS 1.3 always performs ...
0
votes
1answer
45 views

Key renewal when the sequence counter is only 32-bit

If we look at the use-case that our sequence counter within our TLS communication is only 32-bit, would an automatic key re-newal be necessary a lot more frequently? We're going to use state-of-the-...
1
vote
2answers
116 views

Who provides prime numbers for cryptographic protocols?

I am currently writing a thesis about different cryptographic protocols like DH-Key exchange, TLS or IKE. Most of them rely on a prime number earlier or later, so for security reasons I wondered if ...
51
votes
5answers
69k views

What's the appeal of using ChaCha20 instead of AES?

I read about ChaCha20 being used in TLS by Google, SSH, and towards standardization in general. What's the appeal of using something other than AES, what with AES receiving dedicated CPU instructions ...
3
votes
0answers
15 views

SSL handshake - what is the purpose of the finishedClient message?

I am having some difficulties in understanding why is the finishedClient needed. In case an attacker attempts an attack like a replay attack, it will show ...
4
votes
2answers
84 views

Have any PAKE extensions been added to TLS 1.3?

In TLS 1.2, there was TLS-SRP (RFC 5054,) which provided a password-authenticated key exchange (PAKE) protocol for use with TLS. However, it apparently relied on handshake messages that have been ...
0
votes
1answer
40 views

Symmetric key as proof of ownership of a session?

I have a question, or rather multiple questions that all relate to the same topic. I am building an application with both a frontend (FE) and a backend (BE). All communication between FE and BE is ...
1
vote
3answers
96 views

Where is Challenge/Response and Certifcate Verification in TLS-DHE

We have been give a task to identify the following three components in TLS-DHE: Diffie Hellman Key Exchange I am fairly certain that this Part can be found in the Exchange of SKE and CKE, since they ...
1
vote
1answer
47 views

Is it safe to send a hashed password over HTTPS or what is the most secure method of authentication?

My rudimentary understanding of HTTPS and the Diffie-Hellman key exchange is that the client and server can establish a secured connection by generating the same key based on their private secrets and ...
1
vote
1answer
43 views

Different encryption standards and how they relate to auth and algorithms

The main confusion I have is around the different PKCS and relation with SSL (TLS). I have done a lot of research and have found bits and pieces but not necessarily how these relate, so let me explain ...
2
votes
2answers
1k views

What could be the problem with this TLS 1.2 Client Finished Message approach?

Can someone make sure I'm creating my Client finished message properly as I've been working at this for days and keep getting a Bad record MAC error and I have no idea what I'm doing wrong. First ...
1
vote
1answer
86 views

Is it possible to multiplex TLS connections by SNI metadata without knowing any keys?

Imagine the following communication diagram: C1-----\ /--B1 C2------P---B2 ...----/ \--... We have multiple C(lients), call them C1, C2, etc. They connect to a ...
0
votes
1answer
23 views

Do you need both client and server side support for TLS 1.3 record padding?

When you enable record padding for a client, does a server need a specific option to support this? Or does the other end only need to support TLS 1.3 as well and can handle the padding automatically?
3
votes
2answers
346 views

Why does the TLS spec for TLS-PSK say not to derive the shared secret from a password?

According to a note at the end of section 2.2 of the TLS 1.3 spec (RFC 8446), When using an out-of-band provisioned pre-shared secret, a critical consideration is using sufficient entropy during the ...
1
vote
0answers
19 views

TLS 1.3 clarification needed on hello_hash and subsequent hashes

I am exploring TLS, mainly from the server side at the moment. I am creating a server that will authenticate a client using TLS 1.3 and eventually I will be creating a client authenticating to a ...
6
votes
3answers
292 views

Which Diffie-Hellman Groups does TLS 1.3 support? And should we use TLS 1.3 as a guide?

This is a two part question - and I'm asking as someone moving into a security role, who'll need to standardize practices going forward. (1) I'm curious whether the following 10 different DH Groups ...
2
votes
1answer
110 views

What is the overhead of GCM? And how are GCM tags signed by RSA/PKI?

I'm mainly trying to wrap my head around the pipeline of encryption, hashing and signing. I've read over this question, describing the overhead of GCM, which I understand to be configurable for space-...
1
vote
1answer
41 views

OpenSSL TLSv1.3 record padding

OpenSSL supports TLSv1.3 record padding: https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html but I'm not sure if it works like I think it does. If I would choose a factor of 2 it would make ...
1
vote
1answer
79 views

How does the TLS Client Hello message choose the TLS version? [closed]

Im looking at a Client Hello message in wireshark, the client supports 1.2 and 1.3, but Wireshark says the client used TLSv1.3 record layer when the server hasn't replied yet the choosen version. How ...
2
votes
2answers
1k views

Generating IV in TLS 1.2

I'm writing a TLS 1.2 implementation (in C#) using a custom protocol. My question is how to generate the IV attached to each message, I don't want to use ...
5
votes
2answers
431 views

Clarification on the TLS verification process

I am reading this article in my attempt to understand how the TLS verification and chain of trust works. In the piece I come across a section that I am not sure I understand. In the simplified ...
15
votes
4answers
9k views

Is there a standard for OpenSSL-interoperable AES encryption?

Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64). I hear it's ...
1
vote
2answers
215 views

Stream cipher and block cipher usage in network data encryption

Stream ciphers are usually used for streaming data encryption, such as voice, and also for low layers data encryption. For example, MACSec uses AES-GCM encryption. In L3 ad L4 security protocols (...
2
votes
1answer
57 views

Is client certificate mandatory for two-way TLS?

In One-way Transport Layer Security (TLS), client who initiates the connection verifies the identity of the server or entity it is connecting to, but server not necessarily validates client identity. ...
0
votes
0answers
29 views

Key and Message generated on Client, and validated by Server

(Sorry in advance for my blurry thinking on this: I'm a programmer, not a cryptography expert.) I have a Client/Server web application. The Client needs to be able to alter the local state in ways ...
8
votes
2answers
2k views

Compare RFC 5246 SessionID re-use versus RFC 5077 Session Resumption?

Can you help me understand the differences, both algorithmic and practical, between RFC 5246 SessionID re-use and RFC 5077 Session Resumption? Both appear to be ways to nail up a second TLS session ...
0
votes
1answer
78 views

TLS 1.2 Server Key Exchange problem

Below the Wireshark snapshot of the handshake compliant to the TLS 1.2. The position 1 displays the enum ServerECDHParams where I can use any curve having the own ID RFC8422. I'm free for example to ...
0
votes
0answers
17 views

Is my password database encryption flow secure?

I'm not an expert and I would be very glad if someone could take a look at it and tell if there are any problems with it Things I know/think are problematic using base64 digest + getting the first 32 ...
1
vote
2answers
52 views

Can TLS be used simply to exchange keys using the handshake protocol?

From what I understand, in general, TLS consists of two protocols: 1 - Handshake protocol: uses public-key cryptography (ECDH, DH) to establish a shared secret between the client and server. 2 - ...
3
votes
1answer
68 views

Allowed key types in an SSL certificate

What are the valid key types which can get signed (or generated and signed) by a CA to constitute an SSL certificate? For the keys used in TLS, the key types I have seen are RSA and EC. Anything else? ...
0
votes
1answer
73 views

Elgamal Encryption: Why does Bob get to reuse his keypair while Alice has to generate a new one for every message?

From Christof Paar's book The protocol consists of two phases, the classical DHKE (Steps a–f) which is followed by the message encryption and decryption (Steps g and h, respectively). Bob computes ...
0
votes
0answers
36 views

Need for DHKE in TLS [duplicate]

Why does TLS as used in https need DHKE? Since the server presents a certificate with a public key, can that not be used for session key establishment? The client (browser) can generate a session key, ...
3
votes
2answers
4k views

How does SSL work on the browser

I recently bought an SSL certificate from a website and was able to make it work on my Apache server. As far as I know, it uses asymmetric keys and the private key is stored on the server while the ...

1
2 3 4 5
12