Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
6
votes
1answer
376 views

How do client and server agree on the values of p and g during DHE exchange?

How do the communicating parties using Finite Field DHE agree on the values of the $p$ and $g$ variables? Are their values fixed for each DHE group? Reading through the TLS 1.3 RFC (8446), the client ...
1
vote
2answers
172 views

Why is a MAC verification algorithm required when we can simply create a new MAC and compare the received one with the one calculated?

The process of verifying integrity through MAC involves two separate algorithms (as mentioned here). On the server side, a signing algorithm runs which calculates ...
0
votes
0answers
28 views

Man in the middle on public encryption by sending vecitem your public key and save the real one [closed]

I was reading on public encryption and I read that if you connect from somebody else network he cant figure the massage you send. but what if he commit simple man in middle just that instead passing ...
0
votes
1answer
37 views

Trying to understand the struct HkdfLabel from tls1.3 RFC8446

I'm looking at RFC 8446 section 7.1 and trying to understand the following: ...
0
votes
0answers
24 views

Tools for testing TLS throughput [closed]

I want to knwo if there are any open-source tools for testing the throughput of TLS protocol implements such as OpenSSL?Intern command line in OpenSSL is ok if there is one.
0
votes
1answer
37 views

Prior art: SSH key authn over TLS?

I’m developing an application that runs over TLS. In addition to password-based authentication we’d like to be able to use SSH keys. Is there any prior art in using SSH keys for authentication over ...
1
vote
2answers
57 views

How to derive a private/public keypair from a random seed?

For RSA, my understanding is that large primes are found randomly to build a private/public keypair. If a static seed can be used in that random search process, it should be possible to derive the ...
1
vote
1answer
150 views

DTLS vs direct use of AES. What are the threats unique for direct use of AES instead of DTLS?

For regular traffic in mesh network (between Internet of Thing devices) customer decided to use one of two options: DTLS PSK ciphersuite - DTLS based on pre-shared symmetric key or direct use of AES -...
0
votes
1answer
83 views

TLS 1.2 AES-GCM decryption problem

I'm trying to decrypt a PCAP encrypted with TLS 1.2. I have the private key and Wireshark is able to decrypt the data so what I am doing should work but there is obviously something wrong. The ...
0
votes
1answer
44 views

Diffie-Hellman parameter for use in TLS derived from given finite-field group

I'm interested in cryptography, but unfortunately haven't found the time to dive into the topic much. I have done some quantum encryption stuff back in the day, but that isn't helping me with my ...
0
votes
1answer
45 views

OpenSSL - What Data Is Used To Create A Certificate's Digital Signature?

I am coming up-to-speed on OpenSSL certificates. In all of my research I see where "data" is hashed to create a hash value that is used as the basis for a certificate's digital signature. This hash ...
2
votes
2answers
836 views

What could be the problem with this TLS 1.2 Client Finished Message approach?

Can someone make sure I'm creating my Client finished message properly as I've been working at this for days and keep getting a Bad record MAC error and I have no idea what I'm doing wrong. First ...
0
votes
1answer
34 views

Debug client certificate authentication on path with openssl

Website on https://example.com/login will request client certificate authentication. If it was directly on https://example.com then using ...
0
votes
0answers
67 views

Diffie-Hellman + Asymetric encryption kept simple, or alternatives to TLS

I am working on a system that includes our dear friends Alice, Bob, and a server that is only partially trusted. I have spent the majority of the day reading up on various cryptography methods, but I ...
2
votes
1answer
58 views

Chrome TLS 1.3 no TLS resumption with not secure connections

I am testing TLS 1.3 on a slower IoT device (120Mhz ARM). In my tests Chrome with TLS 1.3 will not allow TLS resumption (Session Tickets) when you have an not secure connection e.g. because of an user ...
3
votes
1answer
134 views

How are initialization vectors used in TLS 1.1?

From my understanding, TLS 1.0 can use CBC to encrypt data. To do so, it creates one initialization vector (IV), and then uses the previous ciphertext block as the IV for the next record. I made this ...
1
vote
3answers
69 views

Why doesn't TLS provide E2EE?

Why doesn't TLS provide end-to-end encryption? This question is somewhat related to this, this and this. If you want to talk to someone, say, through facebook, the TLS connection ends in the ...
1
vote
1answer
46 views

What is the difference between DROWN and ROBOT vulnerability?

It seems like the main idea is the same for both the vulnerabilities then what is the difference?
11
votes
3answers
7k views

Is there a standard for OpenSSL-interoperable AES encryption?

Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64). I hear it's ...
1
vote
1answer
70 views

Safe way to derive IV from the DH shared keys for AES-GCM?

I am preparing to use AES-GCM to make a secure communication program. Here is the procedure DH key exchange to get shared keys SHA256(shared keys) Use AES-GCM to encrypt a message while the key only ...
0
votes
1answer
42 views

Why is the server's public key always used in SSL encryption and never the client's public key?

I spent a lot of time looking for an answer to this question, but the majority of answers never explicitly explain why the client's public key is never used; it's always the server's public key that's ...
1
vote
1answer
84 views

On what basis is padding chosen in OpenSSL?

I am using CAPI Engine in OpenSSL and I did some test. When I use TLS 1.0 or 1.1, during handshake and RSA signing, PKCS padding is chosen. When I use TLS 1.2, RSA signing uses PSS padding. What ...
61
votes
5answers
29k views

Technical feasibility of decrypting https by replacing the computer's PRNG

Intel has an on-chip RdRand function which supposedly bypasses the normally used entropy pool for /dev/urandom and directly injects output. Now rumors are going on that Intel works together with the ...
1
vote
2answers
66 views

Standards for finite-field discrete log cryptography

The NIST and TLS standards for Diffie-Hellman key exchange over a finite field all work in a subgroup of ${\mathbb Z}_p^*$ having prime order $q$, where $p = 2q+1$. On the other hand, DSA has a larger ...
0
votes
2answers
140 views

Is HTTPS encryption using the RSA algorithm?

According to this article HTTPS and RSA is the same thing: https://tiptopsecurity.com/how-does-https-work-rsa-encryption-explained/ From other sources I learn that they are both asymmetric encryption ...
2
votes
1answer
120 views

Does TLS 1.3 really send PSKs encrypted?

In the following link it says: When a 1.3 client connects to a 1.3 server they agree on a resumption key (or PSK, pre-shared key), and the server gives the client a Session Ticket that will help it ...
1
vote
0answers
50 views

Comparison of end-to-end encryption and TLS

I am writing a comparison paper about security of electronic communication and I want to compare end-to-end encryption and TLS by giving two examples such as Whatsapp and Facebook Messenger. However, ...
0
votes
1answer
101 views

Avoid Logjam TLS Attack?

As the Logjam attack allows a Man-in-the-Middle attacker to downgrade vulnerable TLS connections to 512-bit export-grade cryptography by modifying the ClientHello and ServerHello, can the Logjam ...
2
votes
1answer
129 views

Is there an actually an alternative to using Diffie Hellman in TLS handshake?

After looking into how TLS handshaking works it seems to inherently include the Diffie Hellman algorithm during the point where they generate a shared secret key. However as I look into this some ...
1
vote
0answers
30 views

Does the order of the “Finished” messages matter in SSL/TLS?

In SSL 3.0 and TLS versions 1.0 through 1.2 the last two messages are the "Client Finished" followed by "Server Finished" messages. These messages include an encrypted (under the established session ...
41
votes
4answers
53k views

What's the appeal of using ChaCha20 instead of AES?

I read about ChaCha20 being used in TLS by Google, SSH, and towards standardization in general. What's the appeal of using something other than AES, what with AES receiving dedicated CPU instructions ...
3
votes
1answer
203 views

Diffie-Hellman in Https: How are prime numbers picked?

I am trying to understand https, as I understand https uses the Diffie–Hellman method for keys exchange and then AES for encryption. But Diffie–Hellman needs two prime numbers, where do these come ...
2
votes
1answer
109 views

Why is there no “ephemeral non-DH EC” key exchange in TLS?

In RSA key exchange, the client picks a premaster secret and encrypts it with the RSA public key in the server certificate, and sends it to the server. This offers no forward secrecy. In ECDHE key ...
35
votes
3answers
7k views

Why was AES CBC removed in TLS 1.3?

I don't quite understand why AES CBC was removed in TLS1.3 . from what I know CBC is the most secure Mode of operation for the AES block cipher ( if you can say it like that ) It only needs a TRND IV ...
3
votes
1answer
128 views

Can a 3rd party decrypt static Diffie Hellman?

Do cipher suites that use static Diffie Hellman (not Ephemeral) allow for the same 3rd party decryption ability as RSA cipher suites? With RSA key exchange, 3rd parties can gain possession of the ...
8
votes
1answer
880 views

The 9 lives of Bleichenbacher's CAT, it puts another scratch again

Bleichenbacher demonstrated a padding oracle attack against RSA implementations that follow the PKCS #1 v1.5. Through the years, there are various mitigation techniques developed as OAEP and limiting ...
1
vote
1answer
169 views

Double 3DES/TDES Encryption

If 3DES/TDES (officially TDEA or Triple DEA - Triple Data Encryption Algorithm) encryption is used twice, using 6 different keys K1-...
1
vote
2answers
165 views

What encryption to choose from the SSL library in python 3?

I've been researching some of the types of encryption that the python SSL library uses. Among them the best I've seen are: ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx = ECDH Au = RSA Enc = AESGCM (256) ...
0
votes
1answer
37 views

Is it possible to multiplex TLS connections by SNI metadata without knowing any keys?

Imagine the following communication diagram: C1-----\ /--B1 C2------P---B2 ...----/ \--... We have multiple C(lients), call them C1, C2, etc. They connect to a ...
0
votes
1answer
37 views

TLS handshake with client later on acting as a server

Is it possible that a client which gets the Digital certificate of the Server during the TLS handshake then acts as a server? Because a server only needs to have a valid digital certificate which it ...
1
vote
0answers
27 views

TLS client authentication from static client image

I'm trying to implement mutual authentication for a TLS connection between a server (ONOS OpenFlow controller) and multiple clients (OpenFlow switches). I'm restricted in that I must create a single ...
0
votes
0answers
37 views

How is Pre Master Secret related to Client.random or Server.random if DH KEX is RSA

For TLS 1.2 cipher Suite AES256-GCM-SHA384, RSA is KEX(key exchagne algorithm). As per standards of RSA Diffie Hellman KEX, after 'ServerHello' message client gets server certificate and it generates ...
1
vote
0answers
36 views

Does SET in any way use SSL?

I just started a course in web security, and I was just wondering quickly if SET in any way would use SSL? I noticed it was developed in part by Netscape. But all I can find is comparisons between the ...
1
vote
1answer
52 views

Is this pairing scheme for establishing trust between two devices with self-signed TLS certs secure from MITM?

Assume two devices (A and B) with self-signed TLS certificates (this part can't change). We want these devices to trust each other. One way to do this is to simply copy A's cert over to B's allowed ...
4
votes
1answer
292 views

Determining if Server/Client's TLS configuration is Vulnerable to SLOTH

In the context of SSL/TLS protocol and SLOTH vulnerability. I want to find out if certain websites(webservers) or applications that use TLS are vulnerable. I need some guidance for this. My idea is ...
2
votes
2answers
280 views

Does the Server Key Exchange sign a hash or text

In TLS 1.2 when using ECDHE_RSA, the ServerKeyExchange message contains a signature over the server's ECDHE public parameters. My question is: Is the signature over ...
0
votes
1answer
339 views

Does RSASSAPSS use RSA signature

I just need to know is it correct to classify the RSASSAPSS scheme and sha[256 | 512 | 1]WithRSAEncryption all under RSA ...
0
votes
1answer
780 views

What is Group in Diffie-Hellman?

I understand how Diffie-Hellman key-exchange works. Mainly, two parties agrees in a prime $p$ and a generator $g$. Then one party selects its private exponenet $x$, computes its public value $g^x \...
-1
votes
1answer
178 views

TLS handshake cryptography AES key query

I am working on a IoT project where I am trying to perform manual handshake (SSL) for certificates and sending data to the server securely using HTTPS POST method. RSA is used for sending Pre-master ...
0
votes
1answer
33 views

RSASSA-PSS-SIGN modBits size

In RFC 8017 modBits is the length in bits of the RSA modulus n I am using 2048 RSA key ...

1
2 3 4 5
11