Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
1 vote
1 answer
35 views

Classical vs Quantum-Safe Algorithms and Protocols / Application Approach

Various proposals are being explored for X509 V3 certificates in a Post Quantum Cryptography (PQC) world. Currently, these include just having a certificate for classical and PQ, having a hybrid ...
user avatar
  • 133
0 votes
0 answers
37 views

Which cipher is more secure TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA or TLS_RSA_WITH_AES_256_GCM_SHA384?

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA supports forward secrecy but it doesn't use GCM mode and use SHA1 TLS_RSA_WITH_AES_256_GCM_SHA384 uses GCM mode and SHA2 but it doesn't support forward secrecy. ...
user avatar
  • 19
0 votes
1 answer
29 views

IIS Crypto 3.2 not getting rid of Diffie Hellman algorithms of less than 2048 bits ... or am I missing something?

I'm trying to stop a server using Diffie Hellman algorithms of less than 2048 bits ..but I'm getting confusing results I've run ...
user avatar
0 votes
0 answers
24 views

PSK based resumption vs session ID/ticket based resumption in TLS

I was reading about TLS 1.3, and noticed how session resumption was done via PSKs instead of Session IDs/Session Tickets. But from what I've understood, PSKs just seem like a combination of Session ...
user avatar
1 vote
1 answer
37 views

Version rollback attack prevention in TLS 1.2?

Are there any methods to prevent version rollback attack while using TLS 1.2 (apart from disabling lower versions)? I've read about how TLS 1.3 provides a downgrade protection mechanism which is ...
user avatar
3 votes
1 answer
89 views

Why is the maximum record size in TLS 1.3 limited to $2^{14}$ bytes?

RFC 8446 limits the maximum data carried withing single TLSv1.3 message to $2^{14}$ bytes, specifically in section 5.1: The record layer fragments information blocks into TLSPlaintext records ...
user avatar
  • 31
1 vote
2 answers
74 views

Is it safe to sign message with a TLS private key?

I want to sign all of the HTML and JavaScript from my site with the site's TLS private key. (The hex signature will be preceded with a <!-- comment which is ...
user avatar
  • 701
0 votes
1 answer
25 views

How to use OpenSSL to prove non-repudiation

If I download https://example.com/foo.txt, how can I prove to a third party that I got it from https://example.com. I understand that their private key is used to secure the channel, rather than to ...
user avatar
  • 701
2 votes
1 answer
71 views

Does TLS use use two symmetric keys in the same way SSH does? One for client to server and one for server to client communication?

As described in the SSH RFC an initial IV to server, initial IV to client, encryption key client to server, encryption key server to client, integrity key client to server, and an integrity key server ...
user avatar
  • 63
1 vote
1 answer
40 views

On the correctness of the padding example of RFC 5246

The PKCS#7 padding is defined in rfc5652#section-6.3 Some content-encryption algorithms assume the input length is a multiple of k octets, where k is greater than one. For such algorithms, the input ...
user avatar
  • 43k
1 vote
0 answers
40 views

Why are handshake and master secrets distinct in TLS?

In TLS 1.3, handshake messages (except for ClientHello and ServerHello) are protected by keys derived from the handshake secret. After the handshake completes, master secret is derived from the ...
user avatar
  • 111
0 votes
1 answer
118 views

How is TLS 1.3 application data encrypted with AES-GCM sent 'over the wire'?

I've been trying to manually decrypt some TLS 1.3 traffic for educational reasons, and have stumbled across a roadblock. So far, I've been able to complete most of the key schedule, including deriving ...
user avatar
  • 121
-1 votes
1 answer
64 views

Manually decrypt the signature in a digital certificate [closed]

I've exported the root CA cert (ISRG Root X1) used by StackOverflow's digital certificate, as a DER encoded binary X.509 (.cer) file and used openssl in cmd to find out the modulus/exponent: ...
user avatar
2 votes
1 answer
141 views

How to find the public key in a digital certificate

I can see what I think should be the public key in the Details tab for StackOverflow's certificate (see screenshot below). However, it is 2160 (num of chars (540) multiplied by 4 = 2160) bits long, ...
user avatar
0 votes
0 answers
45 views

TLS sanity check

I know there are some tools to check if a certificate is according to the standards like zlint or if the certificate has been logged. But are there tools that work on the rest of the connection like ...
user avatar
1 vote
1 answer
171 views

Why is SHA384 used in TLS cipher suites for AES_256_GCM instead of SHA256?

TLS cipher suites use SHA256 as the hash when using AES_128_GCM and CHACHA20_POLY1305, but SHA384 when using AES_256_GCM. The TLS Cipher Suite Registry contains no cipher suites that use ...
user avatar
  • 2,533
1 vote
2 answers
52 views

Use of custom DH parameters for TLS decryption

There are several ways to decrypt TLS e.g. in an enterprise environment. I did not see using "backdoored" DH parameters being mentioned somewhere though according to my understanding it ...
user avatar
0 votes
2 answers
96 views

How can I dentify the ECDHE group value used in a TLS session

In ECDHE, the group is a public value. I want to get this value for a session. I inspected the session using Wireshark. Under the ServerHello -> Key share extension -> Key share entry, I found ...
user avatar
0 votes
1 answer
29 views

SSLv3 ServerKeyExchange SIgnature struct mismatch

Im playing with implementing SSLv3 in Go according to rfc6101. I can deserialize ServerKeyExchange until ServerKeyExchange.signed_params. The cipher suite is ...
user avatar
  • 1
6 votes
1 answer
292 views

TLS 1.3 - Why have no encrypt-then-MAC modes been specified?

I have been scratching my head for a while why TLS 1.3 does not include any encrypt-then-MAC (EtM) modes. All the previous problems in TLS have been caused by MAC then and encrypt. Whereas encrypt ...
user avatar
  • 71
1 vote
1 answer
57 views

Revealing original message length having random padding

If I have a message that has a fixed unknown length $L$, and we add to it's TLS encryption a random sized padding $0\leq n \leq N$ so the sent message if $L+n$. I'm also able to make the target re-...
user avatar
  • 143
1 vote
4 answers
135 views

Does SSL connection provide integrity?

I'm new to cryptography and I'm trying to implement a secure chat application using OpenSSL. I want to ensure that public messages (which will be shown to all users) cannot be altered during ...
user avatar
  • 19
2 votes
2 answers
151 views

Why do people use protocols like PGP, when TLS already exists?

TLS is the standard cryptography protocol on the internet, and many websites use it to secure their communications. However, for personal use, most people use other protocols like PGP, instead of ...
user avatar
0 votes
1 answer
43 views

Simple Key Exchange, One Server

I am trying to better understand how TLS works. I understand in the normal use case you need various random values generated and used in the key exchange, to prevent some MITM reusing a previous ...
user avatar
  • 183
0 votes
1 answer
141 views

Using AES-CBC in TLS1.2

Is AES-CBC still vulnerable in TLS1.2 Or does the vulnerability only work for lower TLS versions? If not, why was it deleted in TLS 1.3?
user avatar
2 votes
2 answers
918 views

Which block cipher mode of operation does TLS 1.3 use?

Which block cipher mode of operation does TLS 1.3 use? I assume it is a block cipher mode that provides authentication (like GCM).
user avatar
3 votes
1 answer
95 views

Concatenation of password and TOTP - possible issues

I have come across a two factor login mechanism using Time based OTP (TOTP). TOTP (6 digits) is shown to the user in an app. There are two ways of logging in. Method 1: User inputs the username and ...
user avatar
0 votes
0 answers
41 views

Is it possible to extract a signature from a HTTPS webpage?

Let's say I want to prove to someone that a webpage claims X. I could take a screenshot, but it could easily be doctored. However, the webpage's contents are encrypted by the domain using its private ...
user avatar
  • 123
0 votes
0 answers
17 views

HPKP on OS or library level

Among the major operating systems (Windows, MacOS, Linux) or common TLS libraries (Schannel, openssl, boringssl) is their any way to pin certificates on a global level? So not just per application but ...
user avatar
1 vote
1 answer
97 views

Read ECDHE traffic with Wireshark or the like

There is some https traffic from a specific server (which I have the certificate and private key) that I need legitimately be able to read. This traffic doesn’t come via browser so besides the ...
user avatar
2 votes
0 answers
31 views

SSL/TLS Forward secrecy with 2 KEM public keys

As we know, NIST PQC project is at its 3rd round, with draft standard expected to arrive in the next (few) year(s). An unfortunate fact is that, we're not seeing many signature schemes general-purpose ...
user avatar
  • 6,541
2 votes
1 answer
106 views

In TLS, does the client know the server's public key before starting the data exchange?

I am reading about the logjam attack. I was asked if the attack could be prevented by checking the integrity of the Server Hello message. My answer would be no because the man-in-the-middle can still ...
user avatar
  • 43
0 votes
0 answers
25 views

Authentication between two servers using PKA

I've run into an small issue regarding authentication between 2 services (One way communication) using public and private key authentication (Elliptic Curve, secp256k1). The services will communicate ...
user avatar
1 vote
0 answers
36 views

Security proof for TLS 1.x

In JKSS12, a proof for the handshake in TLS-DHE 1.2 is given, assuming (among other things) the PRF-ODH hypothesis on the PRF used to derive keys. It is also stated that, if TLS 1.2 was to be modified ...
user avatar
  • 41
2 votes
1 answer
97 views

In TLS 1.3, is the Binder Key in a non-PSK derived key schedule always a consistent value?

The Key Schedule in the TLS 1.3 RFC starts like this: ...
user avatar
  • 869
1 vote
1 answer
109 views

In TLS 1.3, what is the rational for using different handshake transcripts for Resumption Master Secret vs Application Traffic Secrets?

The TLS 1.3 RFC, section 7.1 lists this as the last part of the key schedule: https://datatracker.ietf.org/doc/html/rfc8446#section-7.1 ...
user avatar
  • 869
1 vote
0 answers
94 views

TLS 1.3 Handshake - Usage of MAC and Digital Signature for CertificateVerify and Finished Message

I was wondering, why the TLS 1.3 handshake employs two different 'messages' that compute an authentication code over the whole handshake. As far as I understand, the CertificateVerify "message&...
user avatar
  • 11
1 vote
0 answers
64 views

How to decrypt raw TLS bytes?

Is there any tool / way to decrypt raw bytes of a TLS 1.2 session, when the master key is known, even if forward secrecy is used? The closest I found is this. I know its possible using Wireshark, but ...
user avatar
2 votes
1 answer
198 views

What does the running transcript hash in RFC-8446: TLS 1.3 do?

From RFC8446: In general, implementations can implement the transcript by keeping a running transcript hash value based on the negotiated hash. Note, however, that subsequent post-handshake ...
user avatar
1 vote
1 answer
57 views

What salt should be used when generating TLS 1.3 CertificateVerify message?

When signing handshake messages digest, the MGF1 function takes some salt value with same length as the digest has. But what content must be in salt's buffer? I explored the source code of libnettle, ...
user avatar
  • 127
0 votes
2 answers
161 views

What does TLS 1.2 mean by SHA functions?

I'm looking at the technical docs for TLS 1.2 and it says it uses SHA (so hashing algorithms): 7.4.1.4.1. Signature Algorithms But hashing just digests an input, to do things like user authentication....
user avatar
-1 votes
1 answer
88 views

How much security does using TLS provide?

If someone tells me their service uses TLS 1.2 or higher, how much 'guaranteed' security does this provide? Is it possible to correctly claim to be using TLS 1.2 or 1.3 and still be insecure? For ...
user avatar
3 votes
0 answers
82 views

Openssl speed vs TLS speed with postquantum KEM

I'm studying the performance of postquantum KEM in TLS with the OQS (OQS is a project that integrate liboqs to openssl). I don't know why, but the KEM algorithms performance in TLS is 10 times slower ...
user avatar
  • 75
1 vote
1 answer
59 views

Server authentication in TLS 1.2 with static DH

For (EC)DHE cipher suites, server authenticates itself by proving the possession of the private key matching its certificate by signing ServerKeyExchange message (...
user avatar
-1 votes
1 answer
65 views

Can X3DH algorithm implementation be avoided to thwart Man-in-the-Middle Attack during End-to-End Encryption with Diffie-Hellman Algo, When using SSL

For End-to-End Encryption in chats using Diffie-Hellman Algo the concept of Extended Triple Diffie-Hellman (X3DH) is used to prevent Man-in-the-middle attack (MITM) (courtesy: https://www.qed42.com/...
user avatar
1 vote
0 answers
52 views

How does TLS 1.3 sign key exchange?

From this site: https://tls13.ulfheim.net/ and from https://www.rfc-editor.org/rfc/rfc8446#section-2 I can't find the part in which the exchange of keys is signed, isn't one of the parties "...
user avatar
  • 11
0 votes
0 answers
21 views

Why does AES_GCM sometimes has a SHA for integrity? [duplicate]

For example the following suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 From what I understand the SHA384 at the end is used to authenticate the message, which is exactly what MAC does, and the mode ...
user avatar
  • 11
1 vote
1 answer
151 views

What hash is concatenating with the data to be signed in TLS 1.3 CertificateVerify message?

According to specification, to create data that will be signed with server private key for CertificateVerify message, we need to concatenate 64 space characters, the string "TLS 1.3, server ...
user avatar
  • 127
1 vote
1 answer
95 views

How does TLS 1.3 work with PQC signatures?

I know that the first step in TLS 1.3 with modern signatures is hash the message with SHA256/SHA384/SHA512. Do PQC signatures work the same as modern algorithms in TLS 1.3?
user avatar
  • 75
1 vote
2 answers
95 views

What symmetric algo does TLS use?

So my understanding of TLS is that it uses asymmetric cryptography such as DH to perform a key exchange, once this has occurred it then used an symmetric algorithm for the data exchange. (Obviously I ...
user avatar

1
2 3 4 5
12