Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
1
vote
1answer
55 views

How are public keys securely and reliably obtained across the internet?

I've just decided to start learning all about PKIs, and I have come across what seems like a paradox. When fetching a public key from either a server or a CA, how can we be sure that the public key ...
-1
votes
0answers
34 views

Made a server certificate from a CA that we've been using, but we get an error in the ssl handshake

when I run a check everything looks fine... openssl verify -CAfile ca-crt.pem serverin-crt.pem serverin-crt.pem: OK but when I try to connect from a client machine with the same ca file, it doesn't ...
3
votes
0answers
44 views

Does Openssl 1.1.1 library supports sending multiple identities as part of PSK?

Does Openssl 1.1.1 supports sending multiple ticket identities as part of PSK? i have gone through the openssl code and i don't see that openssl supports it. could someone please confirm it if i ...
1
vote
1answer
41 views

Questions regarding static Diffie-Hellman (ephemeral-static) usage in TLS

It looks to me that there 3 main variants of Diffie-Hellman in SSL/TLS. Anonymous mode; Static mode; Ephemeral mode. In case of static DH the server owns an X.509 certificate with a DH public key ...
3
votes
1answer
114 views

Static Diffie-Hellman in TLS

Static Diffie-Hellman (cipher suites with DH in their name but neither DHE or DH_anon - ...
2
votes
1answer
44 views

Generate a per data shared secret vs per session

I have read about SSL that they persist the shared-secret for the entire session. However, someone in stackoverflow suggested a way of generating a shared secret for each data to send and then send ...
7
votes
1answer
276 views

Which TLS features are vulnerable to chosen-prefixes collision on SHA-1?

Gaëtan Leurent and Thomas Peyrin's preprint From Collisions to Chosen-Prefix Collisions - Application to Full SHA-1 (in volume 1 of proceedings of the forthcoming Eurocrypt 2019) shows a feasible ...
6
votes
2answers
2k views

Why is PerfectForwardSecrecy considered OK, when it has same defects as salt-less password hashing?

PFS suites suffer from the same defects as any other salt-less password hashing scheme. Why is everyone promoting Perfect Forward Secrecy (PFS) ciphersuites so fiercely? Namely, when the group/hash ...
1
vote
0answers
25 views

Which parts of a TLS connection can I safely reuse for DTLS to the same peer?

Suppose I need both encrypted TCP and UDP, say TCP for reliable control signals from server to client and UDP for low latency data from client to server. If I first establish TLS, for the DTLS ...
3
votes
1answer
205 views

How will be cipher selected when client is running on version TLS 1.3 and server is running on TLS 1.2?

How will be cipher selected when a client is running on version TLS 1.3 and server is running on TLS 1.2? The cipher list provided by TLS 1.3 client will be different than the version supported on ...
2
votes
1answer
73 views

What key is used to encrypt the certificate and certificate verify message in TLS1.3?

Which key is used to encrypt certificate and certificate verify message in TLS1.3? I could not figure out which one it is reading section 4.4.2 of RFC 8846 and I only saw a vague mention on page 11.
0
votes
1answer
48 views

What SALT value will be used in HKDF_EXTRACT in TLS1.3?

What SALT value will be used in HKDF_EXTRACT while generating the Handshake Secret (when there will not be any PSK)?
1
vote
1answer
95 views

When do clients use TLS in PSK mode?

The TLS protocol can perform the handshake in different modes. Either fresh handshake where new keys are generated, or using Pre Shared Keys (PSK) or what was know as Session Resumption in previous ...
3
votes
2answers
174 views

Which hash is used when providing signature algorithm ED25519 or ED448?

From TLS 1.3 there are two signature algorithms using edDSA: /* EdDSA algorithms */ ed25519(0x0807), ed448(0x0808), All the other signature-...
3
votes
1answer
264 views

Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3?

Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3? How keys can be exchanged then? https://tools.ietf.org/html/draft-ietf-tls-tls13-28
1
vote
0answers
129 views

Which 'info' and 'salt' parameters to use in HKDF for TLS 1.3?

all the following discussion is for HKDF in TLS1.3: Regarding the 'salt' parameter in - HKDF-Extract(salt, IKM) as written in RFC 5869: HKDF without having to protect the secrecy of the salt. In ...
0
votes
1answer
181 views

Is LibreSSL affected? - Downgrade Attack on TLS 1.3

https://news.ycombinator.com/item?id=19111707 https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/february/downgrade-attack-on-tls-1.3-and-vulnerabilities-in-major-tls-libraries/ No ...
2
votes
1answer
311 views

TLS 1.3 Secure Renegotiation not supported [closed]

I get the message "Secure Renegotiation IS NOT supported" if a TLS 1.3 cipher will be chosen at a TLS handshake with openssl s_client. Since TLS 1.3 does not support renegotiation at all I assume that ...
0
votes
0answers
48 views

Understanding TLS certificate

I'm newbie in the word of TLS, and need some verification about my picture. I can use TLS with 3 or 2 participants: 3 participants: Client, server, CA (certification authority). The CA is where the ...
0
votes
1answer
138 views

Public key on Server Key Exchange Generation vs Public key on Server's Certificate

To understand the distinction between TLS 1.2 and TLS 1.3. I am stuck in the past understanding for TLS and the current reference I am studying: As I know certificate goes with owner's public key, ...
1
vote
1answer
211 views

Can a TLS certificate using ECC secp384r1 as PK algorithm uses RSA for signature

If a TLS certificate public-key algorithm is ECC secp384r1 or ECC prime256v1, is it possible to have RSA as a signature ...
0
votes
1answer
179 views

Does RSASSAPSS use RSA signature

I just need to know is it correct to classify the RSASSAPSS scheme and sha[256 | 512 | 1]WithRSAEncryption all under RSA ...
4
votes
2answers
369 views

GMAC vs HMAC in message forgery and bandwidth

Saarinen in his work GCM, GHASH and Weak Keys says that; The GHASH algorithm belongs to a widely studied class of Wegman-Carter polynomial universal hashes. The security bounds known (this and ...
4
votes
0answers
79 views

Can “OPAQUE-over-TLS” authentication be optimized?

So while discussing the issues of password-hashing off-loading in our chat I noticed that it's easy to extend OPAQUE (CFRG draft) to essentially be a better standard password based authentication when ...
3
votes
1answer
395 views

SSL - encrypt with private key and then with public key?

Say there are 2 sides that wish to communicate: side A and side B. Let's say we are looking at side ...
7
votes
1answer
601 views

The 9 lives of Bleichenbacher's CAT, it puts another scratch again

Bleichenbacher demonstrated a padding oracle attack against RSA implementations that follow the PKCS #1 v1.5. Through the years, there are various mitigation techniques developed as OAEP and limiting ...
0
votes
1answer
208 views

Does make sense utilize TLS and Noise Protocol in the same application?

Nowadays I work maintaining an web application written in Node.js and we use HTTPS with TLS 1.2. We have to implement a new feature related to security on this application, all HTTP messages must be ...
1
vote
1answer
60 views

What can eve see when I go to https//paypal.com

If I go to https://paypal.com/ and login, can Eve find the approximate size of the HTTPS request from my browser? Can she see the approximate size of the responses from the paypal server to me? and ...
11
votes
1answer
184 views

How does the process of creating a new secure Elliptic Curve look like?

I'm especially curious about the technique djb would have used to come up with his Curve 25519. Say I have already written down my goals, such as - Twist Secure, Speed, Side Channel resistance, etc. ...
2
votes
1answer
82 views

Why don't the TLS1.3 cipher suites mention the key exchange and digital signature algorithm in names?

Does it mean both RSA and ECDSA certificates can be used with the same cipher suite?
0
votes
1answer
38 views

When a program using openssl library is using a certificate, does the server check if the issuer(s) are still valid

If I have a program acting as TLS server with a certificate signed by a CA, if one of the issuers in the chain becomes invalidated or the date expires, then how does the program using the certificate ...
2
votes
0answers
169 views

Sharing RSA private key between SSH and SSL services. How bad is it?

An appliance uses a curious way of obtaining ssh-rsa host keys: There is a single configuration option "management certificate" that sets RSA private keys both for HTTPS and SSH management. ...
3
votes
1answer
174 views

In a TLS 1.3 connection, how do the client and server choose a mutual cipher suite?

According to KeyCDN, TLSv1.3 connections are established in a single round trip: While TLS 1.2 requires two round-trips to complete the TLS handshake, 1.3 gets the job done in just one trip If ...
26
votes
2answers
2k views

Why did TLS 1.3 prohibit PGP authentication?

There is a specification, in Informational(!) RFC 6091, for using PGP keys in TLS authentication, although I don’t think it has ever been implemented outside of GnuTLS (it’s certainly not in OpenSSL). ...
2
votes
1answer
33 views

Are Authenticated Encryption ciphersuites supported in legacy TLS versions older than TLS 1.2?

I have read in a paper that Authenticated Encryption (by this I mean those that support GCM mode or ChaCha20 ciphers) are not supported in versions older than TLS 1.2? I could not confirm this as ...
0
votes
2answers
1k views

Why does curl need both root and intermediate certificates in order to securely connect to an HTTP server?

I have created a root certificate, an intermediate certificate, and a server certificate: ...
10
votes
1answer
432 views

Why does TLS 1.3 support two CCM variants?

One of the important improvements introduced in TLS 1.3 is the pruning of the many previously available cipher suites to only five secure options (for symmetric ciphers), that are each supposed to ...
7
votes
1answer
299 views

Cipher suites: same name, different IDs, why?

Sorry if I missed which community to ask. Recently I stumbled upon the fact that the same cipher suite can be designated by two different IDs, and this is not a typo, nor has it happened on a single ...
2
votes
2answers
649 views

The attacker model of the Lucky13 attack in TLS

Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page: The attacks involve detecting small differences in the time at which TLS error messages ...
2
votes
4answers
65 views

TLS ciphersuite without mode of operation

Will there be any security concern if there is no mode of operation specified in the ciphersuite name? For instance, there is no mode of operation in ...
4
votes
4answers
446 views

JWT Login Security

I am new to security and I am wondering if JWT is secure enough. From what I have read online the flow goes like this: Clients log in by sending their credentials to the identity provider. The ...
1
vote
1answer
532 views

CBC related TLS cipher suites to be disabled in the server side

I understand the TLS cipher suites using CBC mode are susceptible to timing attacks. From that understanding it seems that the cipher suites using GCM (CTR-based) are safe to use considering they don'...
2
votes
2answers
116 views

Does the Server Key Exchange sign a hash or text

In TLS 1.2 when using ECDHE_RSA, the ServerKeyExchange message contains a signature over the server's ECDHE public parameters. My question is: Is the signature over ...
1
vote
1answer
157 views

How Elliptic-Curve affects the Server Key Exchange parameters

In Finite Field DHE, the server sends the following parameters in the server key exchange message: $p$: prime $g$: group $g^b$: the server's public DH key In DHE_RSA (non anonymous DHE), the server ...
0
votes
1answer
57 views

When using Client Certificates, is it usual to generate your own?

We're building a webservice for a third party customer who wants us to use "two-way SSL". By which I understand them to mean they want us to host the site using https, and to require that include a ...
3
votes
3answers
1k views

What is different below two Ciphersuites?

I have two questions; I need an explanation for the differences of below two cipher suites. How do they work with SSL/TLS protocol? (my main concern first one doesn't have '...
1
vote
2answers
345 views

signature with Bleichenbacher’s attack

I understood Bleichenbacher & ROBOTO attack, however I have some trouble understanding Section 3.5 of ROBOT attack which discusses retrieving private keys. https://www.usenix.org/system/files/...
1
vote
1answer
265 views

Cipher Block Chaining (CBC) encryption in SSL

Is cipher block chaining (CBC) mode used in SSL encryption? If block reordering is already protected by SSL and TCP sequence numbers, what added advantage does CBC provide?
0
votes
1answer
108 views

How is the TLS 1.2 sequence number generated?

In the other ciphers supported by TLS 1.2, namely stream cipher and CBC block cipher mode, the sequence number is implicitly in the MAC (RFC5246, 6.2.3.1): ...
1
vote
1answer
249 views

Tls protocols: is the simple diffie hellman key exchange still used these days?

Or did it mostly get replaced by ecdh for key exchange and rsa for authentication ?