Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
3 votes
1 answer
99 views

Key Committing AES-GCM

There is a handful of attacks against AEAD, and GCM in particular, which demonstrates that it is feasible for an attacker $\mathcal{A}$ to obtain a ciphertext $C$ which encrypts to multiple key/...
user avatar
0 votes
1 answer
56 views

How SSL (similar version) works?

My book suggested the following protocol to replace SSL: A lot of the terms are familiar to me from the Original SSL, like ChangeCipherSpec message which means ...
user avatar
  • 3
1 vote
2 answers
45 views

Why does AES-GCM means No MAC key, instead of MAC key what they are going to use?

From RFC 5246, section 6.2.3.3: AEAD Ciphers: AEAD ciphers take as input a single key, a nonce, a plaintext, and "additional data" to be included in the authentication check, as described in ...
user avatar
  • 49
3 votes
1 answer
158 views

I didn't understand why both an implicit and an explicit nonce is used in AES-GCM in TLS 1.2

As per my understanding that the nonce of AES-GCM in SSL has 3 parts: . salt, 4 bytes, generated in handshake, not changed in whole session . nonce_explicit, 8 bytes, chosen by the sender and ...
user avatar
  • 49
0 votes
0 answers
12 views

Make certificate and private key available only to a single app [migrated]

I want to make a smart card reader app, that sends read data to a server. In order to be certain in the integrity of the data, I want to use a client certificate to communicate with the server and I ...
user avatar
3 votes
2 answers
472 views

Is HMAC part of the TLS/SSL process?

Does HMAC take part in TLS/SSL? When the client and the server pass the TLS handshake and create a common SESSION key, do they also HMAC each message that is being sent out for the purpose of data ...
user avatar
0 votes
0 answers
23 views

Tools to debug handshake failure after client key exchange, change cipher spec and encrypted handshake message TLS1.2

Hello I have been receiving Description : Handshake failure after sending client encrypted handshake message to the server. Is there any tools I can use instead of wireshark to detect the source of ...
user avatar
1 vote
1 answer
77 views

TLS 1.2 client finish message

Im working on TLS1.2 on cipher suite ECDHE_ECDSA_AES_128_CBC_SHA256. Im currently at the stage of client encrypted message where I always got error on wireshark from the server saying that Fatal, ...
user avatar
1 vote
1 answer
188 views

Non-committing authenticated encryption schemes vs committing authenticated encryption schemes

I'm told that TLS 1.3 supports only non-committing authenticated encryption schemes. What is a non-committing authenticated encryption scheme? What is the difference between committing and non-...
user avatar
  • 37
1 vote
1 answer
45 views

Classical vs Quantum-Safe Algorithms and Protocols / Application Approach

Various proposals are being explored for X509 V3 certificates in a Post Quantum Cryptography (PQC) world. Currently, these include just having a certificate for classical and PQ, having a hybrid ...
user avatar
  • 145
0 votes
0 answers
42 views

Which cipher is more secure TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA or TLS_RSA_WITH_AES_256_GCM_SHA384?

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA supports forward secrecy but it doesn't use GCM mode and use SHA1 TLS_RSA_WITH_AES_256_GCM_SHA384 uses GCM mode and SHA2 but it doesn't support forward secrecy. ...
user avatar
  • 19
0 votes
1 answer
49 views

IIS Crypto 3.2 not getting rid of Diffie Hellman algorithms of less than 2048 bits ... or am I missing something?

I'm trying to stop a server using Diffie Hellman algorithms of less than 2048 bits ..but I'm getting confusing results I've run ...
user avatar
0 votes
0 answers
37 views

PSK based resumption vs session ID/ticket based resumption in TLS

I was reading about TLS 1.3, and noticed how session resumption was done via PSKs instead of Session IDs/Session Tickets. But from what I've understood, PSKs just seem like a combination of Session ...
user avatar
1 vote
1 answer
37 views

Version rollback attack prevention in TLS 1.2?

Are there any methods to prevent version rollback attack while using TLS 1.2 (apart from disabling lower versions)? I've read about how TLS 1.3 provides a downgrade protection mechanism which is ...
user avatar
3 votes
1 answer
132 views

Why is the maximum record size in TLS 1.3 limited to $2^{14}$ bytes?

RFC 8446 limits the maximum data carried withing single TLSv1.3 message to $2^{14}$ bytes, specifically in section 5.1: The record layer fragments information blocks into TLSPlaintext records ...
user avatar
  • 31
1 vote
2 answers
76 views

Is it safe to sign message with a TLS private key?

I want to sign all of the HTML and JavaScript from my site with the site's TLS private key. (The hex signature will be preceded with a <!-- comment which is ...
user avatar
  • 711
0 votes
1 answer
39 views

How to use OpenSSL to prove non-repudiation

If I download https://example.com/foo.txt, how can I prove to a third party that I got it from https://example.com. I understand that their private key is used to secure the channel, rather than to ...
user avatar
  • 711
2 votes
1 answer
73 views

Does TLS use use two symmetric keys in the same way SSH does? One for client to server and one for server to client communication?

As described in the SSH RFC an initial IV to server, initial IV to client, encryption key client to server, encryption key server to client, integrity key client to server, and an integrity key server ...
user avatar
  • 63
1 vote
1 answer
45 views

On the correctness of the padding example of RFC 5246

The PKCS#7 padding is defined in rfc5652#section-6.3 Some content-encryption algorithms assume the input length is a multiple of k octets, where k is greater than one. For such algorithms, the input ...
user avatar
  • 43.4k
1 vote
0 answers
40 views

Why are handshake and master secrets distinct in TLS?

In TLS 1.3, handshake messages (except for ClientHello and ServerHello) are protected by keys derived from the handshake secret. After the handshake completes, master secret is derived from the ...
user avatar
  • 111
1 vote
1 answer
188 views

How is TLS 1.3 application data encrypted with AES-GCM sent 'over the wire'?

I've been trying to manually decrypt some TLS 1.3 traffic for educational reasons, and have stumbled across a roadblock. So far, I've been able to complete most of the key schedule, including deriving ...
user avatar
  • 131
-1 votes
1 answer
78 views

Manually decrypt the signature in a digital certificate [closed]

I've exported the root CA cert (ISRG Root X1) used by StackOverflow's digital certificate, as a DER encoded binary X.509 (.cer) file and used openssl in cmd to find out the modulus/exponent: ...
user avatar
2 votes
1 answer
170 views

How to find the public key in a digital certificate

I can see what I think should be the public key in the Details tab for StackOverflow's certificate (see screenshot below). However, it is 2160 (num of chars (540) multiplied by 4 = 2160) bits long, ...
user avatar
0 votes
0 answers
45 views

TLS sanity check

I know there are some tools to check if a certificate is according to the standards like zlint or if the certificate has been logged. But are there tools that work on the rest of the connection like ...
user avatar
1 vote
1 answer
241 views

Why is SHA384 used in TLS cipher suites for AES_256_GCM instead of SHA256?

TLS cipher suites use SHA256 as the hash when using AES_128_GCM and CHACHA20_POLY1305, but SHA384 when using AES_256_GCM. The TLS Cipher Suite Registry contains no cipher suites that use ...
user avatar
  • 2,698
1 vote
2 answers
60 views

Use of custom DH parameters for TLS decryption

There are several ways to decrypt TLS e.g. in an enterprise environment. I did not see using "backdoored" DH parameters being mentioned somewhere though according to my understanding it ...
user avatar
0 votes
2 answers
114 views

How can I dentify the ECDHE group value used in a TLS session

In ECDHE, the group is a public value. I want to get this value for a session. I inspected the session using Wireshark. Under the ServerHello -> Key share extension -> Key share entry, I found ...
user avatar
0 votes
1 answer
34 views

SSLv3 ServerKeyExchange SIgnature struct mismatch

Im playing with implementing SSLv3 in Go according to rfc6101. I can deserialize ServerKeyExchange until ServerKeyExchange.signed_params. The cipher suite is ...
user avatar
  • 1
6 votes
1 answer
309 views

TLS 1.3 - Why have no encrypt-then-MAC modes been specified?

I have been scratching my head for a while why TLS 1.3 does not include any encrypt-then-MAC (EtM) modes. All the previous problems in TLS have been caused by MAC then and encrypt. Whereas encrypt ...
user avatar
  • 111
1 vote
1 answer
58 views

Revealing original message length having random padding

If I have a message that has a fixed unknown length $L$, and we add to it's TLS encryption a random sized padding $0\leq n \leq N$ so the sent message if $L+n$. I'm also able to make the target re-...
user avatar
  • 143
1 vote
4 answers
147 views

Does SSL connection provide integrity?

I'm new to cryptography and I'm trying to implement a secure chat application using OpenSSL. I want to ensure that public messages (which will be shown to all users) cannot be altered during ...
user avatar
  • 19
2 votes
2 answers
168 views

Why do people use protocols like PGP, when TLS already exists?

TLS is the standard cryptography protocol on the internet, and many websites use it to secure their communications. However, for personal use, most people use other protocols like PGP, instead of ...
user avatar
0 votes
1 answer
43 views

Simple Key Exchange, One Server

I am trying to better understand how TLS works. I understand in the normal use case you need various random values generated and used in the key exchange, to prevent some MITM reusing a previous ...
user avatar
  • 183
0 votes
1 answer
185 views

Using AES-CBC in TLS1.2

Is AES-CBC still vulnerable in TLS1.2 Or does the vulnerability only work for lower TLS versions? If not, why was it deleted in TLS 1.3?
user avatar
2 votes
2 answers
998 views

Which block cipher mode of operation does TLS 1.3 use?

Which block cipher mode of operation does TLS 1.3 use? I assume it is a block cipher mode that provides authentication (like GCM).
user avatar
3 votes
1 answer
96 views

Concatenation of password and TOTP - possible issues

I have come across a two factor login mechanism using Time based OTP (TOTP). TOTP (6 digits) is shown to the user in an app. There are two ways of logging in. Method 1: User inputs the username and ...
user avatar
0 votes
0 answers
41 views

Is it possible to extract a signature from a HTTPS webpage?

Let's say I want to prove to someone that a webpage claims X. I could take a screenshot, but it could easily be doctored. However, the webpage's contents are encrypted by the domain using its private ...
user avatar
  • 123
0 votes
0 answers
17 views

HPKP on OS or library level

Among the major operating systems (Windows, MacOS, Linux) or common TLS libraries (Schannel, openssl, boringssl) is their any way to pin certificates on a global level? So not just per application but ...
user avatar
1 vote
1 answer
107 views

Read ECDHE traffic with Wireshark or the like

There is some https traffic from a specific server (which I have the certificate and private key) that I need legitimately be able to read. This traffic doesn’t come via browser so besides the ...
user avatar
2 votes
0 answers
33 views

SSL/TLS Forward secrecy with 2 KEM public keys

As we know, NIST PQC project is at its 3rd round, with draft standard expected to arrive in the next (few) year(s). An unfortunate fact is that, we're not seeing many signature schemes general-purpose ...
user avatar
  • 6,621
2 votes
1 answer
107 views

In TLS, does the client know the server's public key before starting the data exchange?

I am reading about the logjam attack. I was asked if the attack could be prevented by checking the integrity of the Server Hello message. My answer would be no because the man-in-the-middle can still ...
user avatar
  • 43
0 votes
0 answers
25 views

Authentication between two servers using PKA

I've run into an small issue regarding authentication between 2 services (One way communication) using public and private key authentication (Elliptic Curve, secp256k1). The services will communicate ...
user avatar
1 vote
0 answers
39 views

Security proof for TLS 1.x

In JKSS12, a proof for the handshake in TLS-DHE 1.2 is given, assuming (among other things) the PRF-ODH hypothesis on the PRF used to derive keys. It is also stated that, if TLS 1.2 was to be modified ...
user avatar
  • 41
2 votes
1 answer
105 views

In TLS 1.3, is the Binder Key in a non-PSK derived key schedule always a consistent value?

The Key Schedule in the TLS 1.3 RFC starts like this: ...
user avatar
  • 869
1 vote
1 answer
120 views

In TLS 1.3, what is the rational for using different handshake transcripts for Resumption Master Secret vs Application Traffic Secrets?

The TLS 1.3 RFC, section 7.1 lists this as the last part of the key schedule: https://datatracker.ietf.org/doc/html/rfc8446#section-7.1 ...
user avatar
  • 869
1 vote
0 answers
106 views

TLS 1.3 Handshake - Usage of MAC and Digital Signature for CertificateVerify and Finished Message

I was wondering, why the TLS 1.3 handshake employs two different 'messages' that compute an authentication code over the whole handshake. As far as I understand, the CertificateVerify "message&...
user avatar
  • 11
1 vote
0 answers
67 views

How to decrypt raw TLS bytes?

Is there any tool / way to decrypt raw bytes of a TLS 1.2 session, when the master key is known, even if forward secrecy is used? The closest I found is this. I know its possible using Wireshark, but ...
user avatar
2 votes
1 answer
219 views

What does the running transcript hash in RFC-8446: TLS 1.3 do?

From RFC8446: In general, implementations can implement the transcript by keeping a running transcript hash value based on the negotiated hash. Note, however, that subsequent post-handshake ...
user avatar
1 vote
1 answer
74 views

What salt should be used when generating TLS 1.3 CertificateVerify message?

When signing handshake messages digest, the MGF1 function takes some salt value with same length as the digest has. But what content must be in salt's buffer? I explored the source code of libnettle, ...
user avatar
  • 127
0 votes
2 answers
197 views

What does TLS 1.2 mean by SHA functions?

I'm looking at the technical docs for TLS 1.2 and it says it uses SHA (so hashing algorithms): 7.4.1.4.1. Signature Algorithms But hashing just digests an input, to do things like user authentication....
user avatar

1
2 3 4 5
12