Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
0
votes
1answer
36 views

Key renewal when the sequence counter is only 32-bit

If we look at the use-case that our sequence counter within our TLS communication is only 32-bit, would an automatic key re-newal be necessary a lot more frequently? We're going to use state-of-the-...
0
votes
0answers
27 views

Need for DHKE in TLS [duplicate]

Why does TLS as used in https need DHKE? Since the server presents a certificate with a public key, can that not be used for session key establishment? The client (browser) can generate a session key, ...
0
votes
0answers
7 views

What will be the key size for rsa, ecdhe and ecdsa from the cipher suite given? [migrated]

From the cipher suites tls_rsa_with_aes_128_cbc_sha256 and tls_ecdhe_ecdsa_with_aes_128_cbc_sha256 how do I know what will be ...
2
votes
2answers
3k views

How does SSL work on the browser

I recently bought an SSL certificate from a website and was able to make it work on my Apache server. As far as I know, it uses asymmetric keys and the private key is stored on the server while the ...
1
vote
0answers
51 views

How to increase Poly1305 performance?

I was analysing the Chacha20 algorithm and the Poly1305 MAC generation from RFC 7539. It seems that the Chacha20 is quite faster compared to AES on CPUs without hardware support like AES-NI. But ...
0
votes
0answers
21 views

Is ChangeCipherSpec a part of handshake message in tls 1.2?

Is changecipherspec a part of handshake message in transport layer security (tls) 1.2 because according to rfc5246"ChangeCipherSpec messages, alerts, and any other record types are not handshake ...
0
votes
1answer
29 views

What is the relation between record layer and handshake messages in tls 1.2? [closed]

In tls 1.2 what exactly is the relation between record layer and handshake messages...
1
vote
0answers
30 views

Can Encrypt-then-MAC be used with session ticket resumption?

In TLS 1.2, say a session ticket is created for the current session (Session Tickets RFC 5077), and the current session uses the Encrypt-then-MAC extension RFC 7366 (I.E. both client and server ...
37
votes
3answers
7k views

Why was AES CBC removed in TLS 1.3?

I don't quite understand why AES CBC was removed in TLS1.3. From what I know CBC is the most secure Mode of operation for the AES block cipher (if you can say it like that). It only needs a TRND IV ...
0
votes
1answer
59 views

What MAC did SSLv3.0 use? How did it compare to HMAC in TLS 1.0 and above?

According to Wikipedia: TLS has a variety of security measures: Using a message digest enhanced with a key (so only a key-holder can check the MAC). The HMAC construction used by most TLS cipher ...
0
votes
1answer
48 views

OpenSSL cipher suite support / key requirement for ecdhe_ecdsa_with_aes128_cbc_sha256

I hope this is the right place for that kind of question. So actually I am trying to test the TLS implementation of some industrial device. I have to write my own TLS implementation for this, for ...
2
votes
2answers
77 views

Is it possible to create a ciphersuite for TLS 1.3 using only the Keccak-sponge/duplex?

Now that Keccak has been chosen as SHA-3 we see that there have been defined quite a few related modes, including authenticated cipher modes, the KMAC message authentication mode, XOF's and whatnot. ...
0
votes
1answer
490 views

Does make sense utilize TLS and Noise Protocol in the same application?

Nowadays I work maintaining an web application written in Node.js and we use HTTPS with TLS 1.2. We have to implement a new feature related to security on this application, all HTTP messages must be ...
13
votes
4answers
8k views

Is there a standard for OpenSSL-interoperable AES encryption?

Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64). I hear it's ...
1
vote
1answer
524 views

DH Elliptic Curves: Why choose a fixed base point?

I am having a first look at the TLS key exchange using Diffie Hellman and try to understand the Elliptic Curve variant of it. So if a client and a server agree on using ECDH for key exchange and they ...
43
votes
5answers
57k views

What's the appeal of using ChaCha20 instead of AES?

I read about ChaCha20 being used in TLS by Google, SSH, and towards standardization in general. What's the appeal of using something other than AES, what with AES receiving dedicated CPU instructions ...
1
vote
1answer
77 views

ECDSA signature with Brainpool curves in TLS possible?

Even the up to date RFC 8446 lists at the page 41 as the options for the ECDSA in e.g. TLS_ECDHE_ECDSA_WITH_... only NIST curves: ...
3
votes
1answer
144 views

Do the session keys have the same value on both sides during TLS?

I have two questions about the sessions keys generated during the last steps of the Handshake phase: Do the "client write key" and the "server write key" have the same value, even ...
1
vote
0answers
40 views

Security of CCM using 8 byte MAC within TLS

In the Dutch "IT Security Guidelines for Transport Layer Security (TLS)" the ciphersuites using AES-128-CCM_8 (i.e. CCM with a 64 bit authentication tag) are considered "insufficient&...
3
votes
1answer
193 views

On what basis is padding chosen in OpenSSL?

I am using CAPI Engine in OpenSSL and I did some test. When I use TLS 1.0 or 1.1, during handshake and RSA signing, PKCS padding is chosen. When I use TLS 1.2, RSA signing uses PSS padding. What ...
78
votes
1answer
117k views

What is the difference between .pem, .csr, .key and .crt and other such file extensions?

I'm new to SSL / TLS and I want to work with the OpenSSL toolkit. I don't know what .pem and .csr stands for? I do know that <...
4
votes
0answers
109 views

RSASSA-PSS in TLS 1.2

I know it is possible to use RSASSA-PKCS1-v1_5 with client certificates in TLS 1.3. But what about the other way around: using RSASSA-PSS with client certificates in TLS 1.2? Is it possible to use ...
1
vote
1answer
73 views

Why does TLS 1.3 AES cipher require both a server and client traffic key/iv?

During the TLS 1.3 handshake using the cipher suite TLS_AES_128_GCM_SHA256 a server and client traffic key/iv will be derived using HKDF based on the shared secret, see rfc8446 #7.1 Why is it ...
8
votes
1answer
2k views

Compare RFC 5246 SessionID re-use versus RFC 5077 Session Resumption?

Can you help me understand the differences, both algorithmic and practical, between RFC 5246 SessionID re-use and RFC 5077 Session Resumption? Both appear to be ways to nail up a second TLS session ...
8
votes
1answer
440 views

Cipher suites: same name, different IDs, why?

Sorry if I missed with a community to ask. Recently I stumbled on a fact that the same cipher suite can be designated by two different IDs, and this is not a typo nor single occasion. For instance: ...
0
votes
0answers
32 views

Why is MAC encrypted in TLS data transmission? [duplicate]

Referring the slide 16 from this link: I want to ask why is MAC encrypted along with the data to be transmitted. Why isn't MAC just appended at the end of encrypted data ?
0
votes
1answer
61 views

Prior art: SSH key authn over TLS?

I’m developing an application that runs over TLS. In addition to password-based authentication we’d like to be able to use SSH keys. Is there any prior art in using SSH keys for authentication over ...
1
vote
1answer
89 views

Are TLS connections in china mostly encrypted with AES or with SM4?

What is the dominant symmetric cipher used for TLS connections in China? Is it AES, as it is in the US, or is it SM4?
21
votes
3answers
33k views

How can Cipher Block Chaining (CBC) in SSL be attacked?

I am trying to understand how CBC-mode in SSL/TLS can be attacked. I have been looking around online but all examples and explanations are very hard to understand and follow. Can you give a simple ...
3
votes
1answer
176 views

DTLS vs direct use of AES. What are the threats unique for direct use of AES instead of DTLS?

For regular traffic in mesh network (between Internet of Thing devices) customer decided to use one of two options: DTLS PSK ciphersuite - DTLS based on pre-shared symmetric key or direct use of AES -...
2
votes
1answer
253 views

TLS 1.2 is still secure or should we move to TLS 1.3?

There are some vulnerability such POODLE, that allows the attacker to gain access to encrypted blocks of data and then gain exposure to plain text information using side channels. Another ...
7
votes
1answer
507 views

How do client and server agree on the values of p and g during DHE exchange?

How do the communicating parties using Finite Field DHE agree on the values of the $p$ and $g$ variables? Are their values fixed for each DHE group? Reading through the TLS 1.3 RFC (8446), the client ...
1
vote
2answers
202 views

Why is a MAC verification algorithm required when we can simply create a new MAC and compare the received one with the one calculated?

The process of verifying integrity through MAC involves two separate algorithms (as mentioned here). On the server side, a signing algorithm runs which calculates ...
0
votes
1answer
44 views

Trying to understand the struct HkdfLabel from tls1.3 RFC8446

I'm looking at RFC 8446 section 7.1 and trying to understand the following: ...
1
vote
2answers
70 views

How to derive a private/public keypair from a random seed?

For RSA, my understanding is that large primes are found randomly to build a private/public keypair. If a static seed can be used in that random search process, it should be possible to derive the ...
0
votes
1answer
121 views

TLS 1.2 AES-GCM decryption problem

I'm trying to decrypt a PCAP encrypted with TLS 1.2. I have the private key and Wireshark is able to decrypt the data so what I am doing should work but there is obviously something wrong. The ...
0
votes
1answer
76 views

Diffie-Hellman parameter for use in TLS derived from given finite-field group

I'm interested in cryptography, but unfortunately haven't found the time to dive into the topic much. I have done some quantum encryption stuff back in the day, but that isn't helping me with my ...
0
votes
1answer
54 views

OpenSSL - What Data Is Used To Create A Certificate's Digital Signature?

I am coming up-to-speed on OpenSSL certificates. In all of my research I see where "data" is hashed to create a hash value that is used as the basis for a certificate's digital signature. This hash ...
2
votes
2answers
894 views

What could be the problem with this TLS 1.2 Client Finished Message approach?

Can someone make sure I'm creating my Client finished message properly as I've been working at this for days and keep getting a Bad record MAC error and I have no idea what I'm doing wrong. First ...
1
vote
1answer
112 views

Debug client certificate authentication on path with openssl

Website on https://example.com/login will request client certificate authentication. If it was directly on https://example.com then using ...
0
votes
0answers
70 views

Diffie-Hellman + Asymetric encryption kept simple, or alternatives to TLS

I am working on a system that includes our dear friends Alice, Bob, and a server that is only partially trusted. I have spent the majority of the day reading up on various cryptography methods, but I ...
2
votes
1answer
66 views

Chrome TLS 1.3 no TLS resumption with not secure connections

I am testing TLS 1.3 on a slower IoT device (120Mhz ARM). In my tests Chrome with TLS 1.3 will not allow TLS resumption (Session Tickets) when you have an not secure connection e.g. because of an user ...
3
votes
1answer
152 views

How are initialization vectors used in TLS 1.1?

From my understanding, TLS 1.0 can use CBC to encrypt data. To do so, it creates one initialization vector (IV), and then uses the previous ciphertext block as the IV for the next record. I made this ...
1
vote
3answers
75 views

Why doesn't TLS provide E2EE?

Why doesn't TLS provide end-to-end encryption? This question is somewhat related to this, this and this. If you want to talk to someone, say, through facebook, the TLS connection ends in the ...
1
vote
1answer
52 views

What is the difference between DROWN and ROBOT vulnerability?

It seems like the main idea is the same for both the vulnerabilities then what is the difference?
1
vote
1answer
86 views

Safe way to derive IV from the DH shared keys for AES-GCM?

I am preparing to use AES-GCM to make a secure communication program. Here is the procedure DH key exchange to get shared keys SHA256(shared keys) Use AES-GCM to encrypt a message while the key only ...
0
votes
1answer
48 views

Why is the server's public key always used in SSL encryption and never the client's public key?

I spent a lot of time looking for an answer to this question, but the majority of answers never explicitly explain why the client's public key is never used; it's always the server's public key that's ...
62
votes
5answers
30k views

Technical feasibility of decrypting https by replacing the computer's PRNG

Intel has an on-chip RdRand function which supposedly bypasses the normally used entropy pool for /dev/urandom and directly injects output. Now rumors are going on that Intel works together with the ...
1
vote
2answers
68 views

Standards for finite-field discrete log cryptography

The NIST and TLS standards for Diffie-Hellman key exchange over a finite field all work in a subgroup of ${\mathbb Z}_p^*$ having prime order $q$, where $p = 2q+1$. On the other hand, DSA has a larger ...
0
votes
2answers
381 views

Is HTTPS encryption using the RSA algorithm?

According to this article HTTPS and RSA is the same thing: https://tiptopsecurity.com/how-does-https-work-rsa-encryption-explained/ From other sources I learn that they are both asymmetric encryption ...

1
2 3 4 5
11