Skip to main content

Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
148 votes
1 answer
239k views

What are the differences between .pem, .csr, .key, .crt and other such file extensions?

I'm new to SSL / TLS, and I want to work with the OpenSSL toolkit. What do .pem and .csr stand for? I do know that ...
Richard R. Matthews's user avatar
97 votes
2 answers
38k views

Why doesn't SSH use TLS?

Most cryptographically protected protocols use TLS these days. This applies to mail protocols, HTTP and many others. The newly designed QUIC has also adopted TLS as its cryptography layer. However, ...
juhist's user avatar
  • 1,267
87 votes
5 answers
280k views

How secure is AES-256?

The cipher AES-256 is used among other places in SSL/TLS across the Internet. It's considered among the top ciphers. In theory it's not crackable since the combinations of keys are massive. Although ...
Gustav's user avatar
  • 1,065
63 votes
5 answers
101k views

What's the appeal of using ChaCha20 instead of AES?

I read about ChaCha20 being used in TLS by Google, SSH, and towards standardization in general. What's the appeal of using something other than AES, what with AES receiving dedicated CPU instructions ...
JDługosz's user avatar
  • 733
63 votes
5 answers
30k views

Technical feasibility of decrypting https by replacing the computer's PRNG

Intel has an on-chip RdRand function which supposedly bypasses the normally used entropy pool for /dev/urandom and directly injects output. Now rumors are going on that Intel works together with the ...
Luc's user avatar
  • 1,528
52 votes
7 answers
33k views

Google is using RC4, but isn't RC4 considered unsafe?

Why is Google using RC4 for their HTTPS/SSL? $ openssl s_client -connect www.google.com:443 | grep "Cipher is" New, TLSv1/SSLv3, Cipher is RC4-SHA Isn't RC4 ...
Jonas Lejon's user avatar
49 votes
2 answers
80k views

Differences between the terms "pre-master secret", "master secret", "private key", and "shared secret"?

Both crypto.SE and security.SE have excellent Q&As about how TLS generates session keys (I have linked some at the bottom). In reading these threads I'm having troubles with terminology since the ...
Mike Ounsworth's user avatar
45 votes
3 answers
39k views

Is Triple DES still considered safe to use?

What it says on the tin. Is it still used in things like TLS?
Melab's user avatar
  • 3,655
44 votes
5 answers
167k views

What is the SSL private key file format?

I was researching about how to encrypt with RSA. I understood everything but not the format of the private keys. In the phpseclib (RSA in PHP), you can import your private key (private.key format) ...
tor's user avatar
  • 563
39 votes
3 answers
11k views

Why was AES CBC removed in TLS 1.3?

I don't quite understand why AES CBC was removed in TLS1.3. From what I know CBC is the most secure Mode of operation for the AES block cipher (if you can say it like that). It only needs a TRND IV ...
Richard R. Matthews's user avatar
38 votes
2 answers
80k views

What's the difference between RSA and Diffie-Hellman? [duplicate]

I've been reading the same thing on a lot of websites: RSA is for communication using the public and private key for both the server and client, whereas Diffie-Hellman is just for exchanging the same ...
user3407319's user avatar
31 votes
7 answers
22k views

How can SSL secure a two-way communication with only one key-pair?

As I understand it, SSL involved the use of a public-private key pair. How does this enable two-way communication? Suppose I have some server with which I wish to communicate securely. I connect to ...
GWLlosa's user avatar
  • 659
28 votes
3 answers
39k views

How can I use SSL/TLS with Perfect Forward Secrecy?

I'm new to the field of cryptography, but I want to make the web a better web by setting up the sites that I host with Perfect Forward Secrecy. I have a list of questions regarding the setup of ...
Clay Freeman's user avatar
27 votes
2 answers
2k views

Why did TLS 1.3 prohibit PGP authentication?

There is a specification, in Informational(!) RFC 6091, for using PGP keys in TLS authentication, although I don’t think it has ever been implemented outside of GnuTLS (it’s certainly not in OpenSSL). ...
Alex Shpilkin's user avatar
24 votes
3 answers
39k views

How can Cipher Block Chaining (CBC) in SSL be attacked?

I am trying to understand how CBC-mode in SSL/TLS can be attacked. I have been looking around online but all examples and explanations are very hard to understand and follow. Can you give a simple ...
antonpug's user avatar
  • 341
23 votes
2 answers
20k views

What is the purpose of four different secrets shared by client and server in SSL/TLS?

I was looking through the working of SSL V3, and found that a connection state is defined by a set of things, including client write mac secret, server write mac secret, server write key, client ...
user5507's user avatar
  • 1,923
23 votes
2 answers
29k views

Why is TLS susceptible to protocol downgrade attacks?

A recent blog post from Ivan Ristić (expert extraordinaire on all things SSL) says: all major browsers are susceptible to protocol downgrade attacks; an active MITM can simulate failure conditions ...
D.W.'s user avatar
  • 36.5k
21 votes
2 answers
22k views

What is the advantage of AEAD ciphers?

What is the advantage of AEAD ciphers? Why is the TLS working group pushing for them? I thought modern cipher suites require SHA256 for authentication. What advantage is there to including Poly1305? ...
user3201068's user avatar
20 votes
4 answers
14k views

Is there a standard for OpenSSL-interoperable AES encryption?

Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64). I hear it's ...
David Cary's user avatar
  • 5,674
20 votes
2 answers
9k views

Why do new versions of TLS use an explicit IV for CBC suites?

SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: they used the last part of the previous record, a value that can be predicted by the attacker. ...
CodesInChaos's user avatar
  • 24.9k
19 votes
1 answer
5k views

Will IBM's Condor quantum processor run Shor's Algorithm to crack a 256-bit Elliptic Curve key?

Yesterday IBM announced that they have a 433 bit quantum computer, called Osprey. There is nothing in the press releases I can find that says whether it can or cannot run Shor's Algorithm. They also ...
Simon G.'s user avatar
  • 343
18 votes
8 answers
23k views

Why is SSL on top of TCP?

Why is SSL not under TCP (the Transport layer)?
Raghad Jamil Jawabreh's user avatar
18 votes
2 answers
4k views

Is HTTPS secure if someone snoops the initial handshake?

Let's say I'm on an open wireless network that's being actively sniffed and I connect to an HTTPS site. Even though my subsequent traffic is encrypted, couldn't the sniffer use the data from the ...
user319's user avatar
  • 183
18 votes
1 answer
5k views

Why does TLS 1.3 support two CCM variants?

One of the important improvements introduced in TLS 1.3 is the pruning of the many previously available cipher suites to only five secure options (for symmetric ciphers), that are each supposed to ...
AardvarkSoup's user avatar
17 votes
1 answer
5k views

What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?

It seems the only specified CTR mode ciphers in TLS are all GCM based. GCM ciphers run AES-CTR and do authenticated encryption with a MAC based on Galois-field ...
oberstet's user avatar
  • 447
16 votes
1 answer
2k views

Who issued the first SSL certificate?

When SSL was introduced in ~1996, there was only a few CAs issuing certificates for that specific use and a few sites which actually used SSL. Which Certification Authority issued the first SSL ...
Mark's user avatar
  • 835
15 votes
4 answers
14k views

Best choice out of these six TLS cipher suites

I have a small embedded platform that supports 6 TLS ciphers. Is there a good/better/best one to chose? I was looking around on the web for some kind of rating system or list of ciphers that have ...
user554242's user avatar
15 votes
2 answers
2k views

Does a trace of SSL packets provide a proof of data authenticity?

I'm wondering if it would make sense to record a whole HTTPS session, publish its encryption keys and present it to third parties as a proof that this particular data was sent by a given server ...
d33tah's user avatar
  • 363
14 votes
2 answers
17k views

What's the GCM-SHA 256 of a TLS protocol?

If we read the Google line information about how the cypher the https communication, it reads: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 I understand it's using ...
MyUserIsThis's user avatar
14 votes
2 answers
12k views

What's the difference between rsa_pss_pss_* and rsa_pss_rsae_* schemes?

I'm trying to understand the difference between rsa_pss_pss_ and rsa_pss_rsae_. The picture shows the extension of TLS1.3's ...
Nail Jay's user avatar
  • 317
14 votes
1 answer
6k views

Why is CAMELLIA suddenly so widely used?

When nowadays I point my browser to https sites, the cipher that is on most occasions used is Camellia. My browsers (Chrome and Firefox) seem to prefer it, even when AES is available. Is that not ...
MKK's user avatar
  • 251
13 votes
2 answers
20k views

At what stage is DHE and RSA used during the SSL/TLS handshake?

At what stage of the SSL/TLS handshake is the DHE and RSA used and what is the purpose of using a pre-master secret when you could just use RSA to exchange the symmetric key (i.e. AES) for further ...
Ali Gajani's user avatar
12 votes
5 answers
17k views

Why do we need asymmetric algorithms for key exchange?

In SSL protocols, both symmetric and asymmetric algorithms are used. Why is it so? The symmetric algorithms are more secure and easier to implement. Why are asymmetric algorithms usually preferred in ...
user5507's user avatar
  • 1,923
12 votes
3 answers
16k views

How vulnerable is the C rand() in public cryptography protocols?

I just learned about the basics of public cryptography a few weeks ago and I am curious as to why the C rand() function should not be used for crypto schemes. For example, say I want to generate a ...
jeffrey's user avatar
  • 221
12 votes
4 answers
21k views

How does a client verify a server certificate?

As far as I know, when I request a certificate from Verisign (for example), and after they approved that I is me, they create a certificate (for me) that contains the digital signature and public key. ...
Royi Namir's user avatar
11 votes
2 answers
552 views

Is RC4 a problem for password-based authentication?

This is a follow-up question to Does TLS use RC4-drop[n]?. As mentioned in section 6 of RFC4345, there are weak distinguishers for RC4 keystreams available that even work for keystreams that ...
lxgr's user avatar
  • 1,788
11 votes
1 answer
3k views

Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3?

Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3? How keys can be exchanged then? https://datatracker.ietf.org/doc/html/draft-ietf-tls-tls13-28
Nathan Aw's user avatar
  • 2,277
11 votes
1 answer
316 views

How does the process of creating a new secure Elliptic Curve look like?

I'm especially curious about the technique djb would have used to come up with his Curve 25519. Say I have already written down my goals, such as - Twist Secure, Speed, Side Channel resistance, etc. ...
Cookies's user avatar
  • 213
10 votes
1 answer
3k views

is TLS compression used in modern browsers?

In 2012 CRIME attack effectively killed TLS compression. Has anything changed since 2012 regarding compression in TLS or have modern browsers sacrificed security over performance? If browsers now use ...
pacman's user avatar
  • 439
10 votes
3 answers
9k views

What is different below two Ciphersuites?

I have two questions; I need an explanation for the differences of below two cipher suites. How do they work with SSL/TLS protocol? (my main concern first one doesn't have '...
uma's user avatar
  • 231
10 votes
1 answer
3k views

Why is the maximum record size in TLS 1.3 limited to $2^{14}$ bytes?

RFC 8446 limits the maximum data carried withing single TLSv1.3 message to $2^{14}$ bytes, specifically in section 5.1: The record layer fragments information blocks into TLSPlaintext records ...
Vlad's user avatar
  • 211
9 votes
2 answers
442 views

Is SSL getting faster because it's getting less secure?

There has been some discussion about it being more practical to use SSL due to advances in hardware. From my understanding, stronger public-key encryption means that both encrypting/decrypting and ...
Gelatin's user avatar
  • 193
9 votes
1 answer
20k views

How does TLS_FALLBACK_SCSV help?

After reading through https://datatracker.ietf.org/doc/html/draft-ietf-tls-downgrade-scsv-0, I could understand that this option is recommened for use when one has legacy SSL Servers which only ...
dpb's user avatar
  • 193
9 votes
1 answer
13k views

What is the purpose of pre master secret in SSL/TLS?

I studied about SSL/TLS and learned that client and server must share keys below. common key for encryption common key for generating message authentication code Then, in SSL/TLS, a client doesn't ...
moriteru's user avatar
9 votes
1 answer
3k views

The 9 lives of Bleichenbacher's CAT, it puts another scratch again

Bleichenbacher demonstrated a padding oracle attack against RSA implementations that follow the PKCS #1 v1.5. Through the years, there are various mitigation techniques developed as OAEP and limiting ...
kelalaka's user avatar
  • 49k
9 votes
3 answers
2k views

Why does TLS 1.3 use random-looking nonces for AEAD?

In TLS 1.3, it seems that nonces for AEAD are constructed by XORing the recorded sequence number with the server/client_write_IV (which is generated during the handshake). Thus, nonces are random-...
Raoul722's user avatar
  • 2,836
9 votes
1 answer
7k views

Why does AES-GCM need a hash/MAC in TLS?

"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" is just one example for a cipher suite, as far as I'm concerned it means this: It uses the TLS protocol, exchanges keys with Elliptic Curve Diffie Hellman ...
hl3mukkel's user avatar
  • 499
9 votes
1 answer
5k views

TLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

TLS 1.2 defines a number of cipher suites that employ AES-GCM, e.g.: ...
weaver's user avatar
  • 193
9 votes
1 answer
6k views

SHA1 no longer considered secure for SSL Certificates -- what about Cipher Suites?

Many browsers and Internet companies have recently claimed that SSL Certificates with a signature algorithm of SHA1 will imminently no longer be considered secure. Most notably, Google and Google ...
Eddie's user avatar
  • 983
9 votes
2 answers
6k views

nonce of AES-GCM in SSL

It seems that the nonce of AES-GCM in SSL has 3 parts: salt, 4 bytes, generated in handshake, not changed in whole session nonce_explicit, 8 bytes, chosen by the sender and carried in each SSL record ...
wub's user avatar
  • 223

1
2 3 4 5
14