Questions tagged [tls]
SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.
645
questions
2
votes
0
answers
70
views
Questions about TLS 1.3 inspection with commercial middleboxes
i'm trying to learn how commercial (for example PaloAlto or Fortigate) middleboxes intercept and decrypt TLS 1.3 traffic. To do that I started observing the TLS traffic between the client, middlebox ...
- 21
0
votes
1
answer
94
views
Hybrid key exchange in TLS 1.3
In Hybrid key exchange in TLS 1.3, they mention that with a hybrid approach, we concatenate the shared secret from each method (say KEM like Kyber768 + classical ECDH X25519 = X22519Kyer768).
...
- 147
0
votes
0
answers
51
views
Framework for manipulating digital signatures
for a research project, i am currently looking for a way to manipulate the digital signature of a HTTPS TLS message flow. More specifically, i am trying to create a working example for a malicious ...
1
vote
1
answer
53
views
TLS 1.2, encrypt_then_mac. No sequence number in packet?
TLS 1.2, if encrypt_then_mac extension is enabled.
Sequence number is used during MAC calculation.
But it's not used during the 'body' encryption.
Here, seq_num is used only when calling MAC() ...
1
vote
1
answer
109
views
TLS 1.3: How is Finished message useful when authenticating via certificates?
I cannot quite understand, if Finished message serves any particular purpose when the server is being authenticated via certificates, or if it there just for "consistency" or "extra ...
- 111
9
votes
1
answer
2k
views
is TLS compression used in modern browsers?
In 2012 CRIME attack effectively killed TLS compression. Has anything changed since 2012 regarding compression in TLS or have modern browsers sacrificed security over performance?
If browsers now use ...
- 409
1
vote
1
answer
50
views
Regarding the Digital Signature Algorithm During Client Authentication in TLS 1.2
In TLS 1.2, when client authentication is carried out, digital signatures are utilized. However, at what point is the specific signature algorithm communicated to the server? It seems to me that the ...
- 11
1
vote
0
answers
49
views
Is the SNI extension signed in TLS 1.3?
In TLS 1.3, and since the server signs the entire handshake messages including the server hello message, in this case, is the SNI extension of the client hello message, is it included in the content ...
- 33
0
votes
0
answers
34
views
How by changing ciphertext can the attacker know the length of the padding in POODLE attack
I try to understand the POODLE attack. I read that the attacker try to change one byte of the last block of the ciphertext. Becasue the last block is only have padding and the last byte is the padding ...
- 31
0
votes
0
answers
48
views
Public key encryption with a large number of users
I'm building an app that will primarily be iOS or Android based. My plan is for every user to have their own key pair. The public key will be stored on the server along with a 128 bit UUID which is ...
- 101
0
votes
0
answers
198
views
Using curl with TLS1.3
I need to test my server with curl 8.2.1 utility.
My server works only with TLS1.3 and cipher 0x1302 - TLS_AES_256_GCM_SHA384.
...
- 95
0
votes
1
answer
60
views
Does TLS1.3 support DHE_EXPORT cipher suite? [duplicate]
I just wanted to know for sure that TLS 1.3 does not support DHE_EXPORT cipher suits.
- 33
3
votes
1
answer
56
views
how 0/n split prevent BEAST attack against TLS?
I read that to mitigrate BEAST attack openSSL tried to inject empty TLS record before each real TLS record. and by doing that there is no opportunity to execute an attack but i dont understand way?
...
- 31
0
votes
0
answers
30
views
Encrypted Alert21- Error code 214
I am working on TLS 1.2 Cipher TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, After send the application data server throws an error message ...
1
vote
0
answers
67
views
TLS 1.3 key_share capture without certificate exchange
I am working on an investigation on TLS 1.3.
I've came across an article of qacafe where they shared a TLS 1.3 handshake sequence. Wireshark capture. In this capture you see that in the Client Hello a ...
1
vote
1
answer
127
views
For TLS-PSK (pre-shared key), should non-ephemeral key exchange be preferred over ephemeral one?
TLS 1.3 specify two pre-shared key exchange modes, which are psk_ke and psk_dhe_ke. The former is a non-ephemeral key exchange ...
- 13
0
votes
0
answers
38
views
How to know details of generating keying material in openssl library?
I am testing my TLS 1.3 server (it does not use openssl library) using openssl s_client utility. I have found out that ...
- 95
0
votes
0
answers
14
views
A reason of "SSL_ERROR_RX_MALFORMED_HELLO_RETRY_REQUEST" error in FF when connecting wirh Firefox (TLS 1.3)
I am trying to test my server program which implements TLS 1.3 connection - it should establish TLS 1.3 connection.
My server uses a self-signed certificate, created in ...
- 95
0
votes
1
answer
137
views
How to define RSA padding for RSA encryption in openssl 3.0?
I am studying openssl 3.0 (Windows, C++) in order to encrypt data using RSA. More specifically, I need to sign a CertificateVerify server message in TLS 1.3. The ...
- 95
0
votes
0
answers
44
views
How I can force the openssl "s_client" utility to generate predefined random bytes in it's ClientHello?
I'm testing my server application (TLS 1.3) using s_client program from the openssl library and I need to force the ...
- 95
0
votes
1
answer
164
views
How to force openssl/s_client to send a keyshare for the specific elliptic curve (secp256r1)?
I want to test my server application (TLS 1.3) using s_client program from the openssl library and I need to get from the ...
- 95
3
votes
1
answer
465
views
How does TLS 1.3 restrict the Diffie-Hellman parameters to ones that are known to be secure?
In previous versions of TLS, the choice of the Diffie-Hellman parameters was up to the participants. This resulted in some implementations choosing incorrectly, resulting in vulnerable implementations ...
- 33
3
votes
1
answer
202
views
Is there open-source test tool that operate TLS server/client with unexpected behaviors
I'm working in an embedded system that uses TLS v1.2 protocol for network security and it acts as a client.
Now I want to test some TLS security functions that require connecting with a TLS server and ...
- 31
1
vote
1
answer
118
views
Using of the Transcript-Hash in TLS 1.3
The section 4.4.1 of the RFC 8446 tells about Transcript-Hash.
My questions about the transcript-hash are:
Must a server hash (a) all own sent messages, enumerate in the section 4.4.1, or (b) own ...
- 95
1
vote
1
answer
117
views
Forming ECC key (TLS) in X9.63 format
I am studying TLS handshaking by example a program tlse, which uses libtomcrypt library.I see that in line 5236 (link above) the program call libtomcrypt procedure ...
- 95
1
vote
1
answer
107
views
Where in the TLS 1.3 record is the sequence number located?
The sequence number should be a 64 bit number in every TLS record, but the record header layer is only 5 bytes long and I am looking at a Wireshark pcap, where the TLS record only includes the header ...
- 113
2
votes
1
answer
58
views
Should a certificate message of a server be encypted in TLS 1.3?
Section 2 of RFC 8446 says about the phase "Key Exchange": … Everything after this phase is encrypted.
The "Certificate" message is sent after &...
- 95
3
votes
2
answers
178
views
"Supported groups" in RFC 8446 (TLS 1.3)
What is meant by "supported groups" in the section 4.2.7. "Supported Groups" of RFC 8446:
/* Finite Field Groups (DHE) */
ffdhe2048(0x0100), ffdhe3072(0x0101), etc:
Is the digits - ...
- 95
0
votes
1
answer
46
views
Why is IV in RFC8448 examples only 12 octets instead of 16?
I am working on manual decryption of application data in TLS 1.3 by going through example in RFC8448. I successfully derived and expanded key and IV, but the IV in examples is only 12 bytes long ...
- 113
0
votes
1
answer
77
views
Its Tls 1.2 Padding required when message ist multiple of block length?
When I want to encrypt a 16 byte long message with AES-128-CBC using int TLS 1.2 do I need to add a 16 byte block of padding or can I just encrypt the message without padding ?
1
vote
1
answer
141
views
Difference between "key_share" extension and "server_key_exchange" message in TLS 1.3
Could anyone explain me the difference between "key_share" extension and "server_key_exchange" message in TLS (1.3) ?
If I understood right, these "packets" of data are ...
- 95
0
votes
1
answer
51
views
Prove a response was received from the particular Tor hidden service
Consider a Tor hidden service. I want to retrieve the main page of such website in such a way that I can later prove to a skeptical third party that the website with this certificate (identified by ...
2
votes
1
answer
118
views
How to create TLS 1.3 Key Derivation test cases
I'm trying to create some test cases for a TLS library for the Key Derivation outlined in RFC 8446 7.1.
I tried to get this information from openssl using the ...
- 191
1
vote
3
answers
129
views
How do certificates add data to public key and how is this implemented into TLS?
I want to create a self signed PKI for a couple servers I am running. I am finding tutorials with copy paste commands from openssl, and hand waving explanations that describe the general purpose of ...
- 11
1
vote
2
answers
171
views
Entropy for TLS 1.2: how much is needed for linux servers?
I am trying to fix issues with a server where the server keeps freezing up and needs to be restarted. I recently started hearing about entropy and it importance to secure tls keys in linux. The one ...
6
votes
2
answers
2k
views
Is RSA longer supported in TLS 1.3 and are RSA and DH fundamentally different?
I'm watching "SSL, TLS, HTTPS Explained" by ByteByteGo on YouTube and at the end, starting around 5:15, there are two points that are interesting:
in TLS 1.3 RSA is no longer supported as ...
- 171
2
votes
1
answer
68
views
Are there any significant ways in which TLS could still be improved?
With TLS 1.3 supporting only secure, forward-secret cipher suites, are there any significant technological improvements that could still be made to the protocol?
- 21
1
vote
0
answers
1k
views
BAD Record MAC error from the server [closed]
I am working on ssl client because of some server update I was enabling the cipher TLS_DHE_RSA_WITH_AES_128_GCM_SHA256. While handshake with server I was facing Bad Record MAC Alert message from the ...
3
votes
2
answers
305
views
Are the following ciphersuites vulnerable? if so, what are the vulnerabilities?
Following ciphersuites found to be weak in Qualys(https://www.ssllabs.com/ssltest/analyze.html) tool:
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) ECDH x25519 (eq. 3072
bits RSA) ...
- 31
2
votes
0
answers
69
views
How are the `binder hash` and `finished` values calculated in the Resumed 0-RTT Handshake example in TLS 1.3?
I'm trying to understand the implication of the Binder Keys in in a TLS 1.3 resumed handshake. The TLS 1.3 RFC provides an additional RFC with example traces to validate all the math in a TLS 1.3 ...
- 983
19
votes
1
answer
5k
views
Will IBM's Condor quantum processor run Shor's Algorithm to crack a 256-bit Elliptic Curve key?
Yesterday IBM announced that they have a 433 bit quantum computer, called Osprey. There is nothing in the press releases I can find that says whether it can or cannot run Shor's Algorithm.
They also ...
- 343
0
votes
1
answer
38
views
Mapping DH / DHE p & g params to a group
I'm doing a small code that performs a simple SSL/TLS analysis and I'm stuck on determining the size of the key exchange in the case of DH / DHE.
If I take the following example (wireshark capture) :
<...
- 3
1
vote
2
answers
1k
views
How does TLS 1.3 provide authentication without using the public key to verify that the server has a private key?
In the TLS 1.2 handshake, after checking the certificate, the public key from the certificate was used to encrypt the data to create a symmetric encryption key, hence the authentication took place on ...
0
votes
0
answers
57
views
Benchmark SSL/TLS certs: selfsigned vs signed (trusted)
I have two servers. A production server with a signed (trusted ca) cert and a test server with a self-signed cert.
How big is the difference between the two handshakes?
Because when benchmarking the ...
- 101
1
vote
0
answers
153
views
3
votes
1
answer
194
views
In TLS 1.3, is the first Derived Secret always a constant value (in non-PSK handshakes)?
RFC 5869 Defines HKDF-Extract in section 2.2 as:
HKDF-Extract(salt, IKM) -> PRK
TLS 1.3 RFC 8446 defines the first part of the Key Schedule like this:
...
- 983
2
votes
1
answer
109
views
If a server and I had the possibility to sign the encrypted messages we exchange, would it still be useful to use TLS?
Assume to neglect:
The man in the middle attack.
The efficiency of symmetric encryption over asymmetric
I can't understand the usefulness of TLS, with respect to the security, if both parties ...
0
votes
1
answer
52
views
Does TLS convert individual messages to ciphertext? If the network is breached, is the data exposed?
As far as I understand it, TLS creates a tunnel or channel or secure connection between the parties right? Where everything is protected? But hypothetically if the network gets breached, would the raw ...
- 25
3
votes
2
answers
640
views
1
vote
2
answers
614
views
How does a CertificateVerify message prevent MITM attacks in TLS 1.3
I' following along the book "Realworld Cryptography", in chapter 9 where the TLS protocol is introduced, they mention:
Following [authentication], the server can use its certified long-term ...
- 113