Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
79
votes
2answers
23k views

Why doesn't SSH use TLS?

Most cryptographically protected protocols use TLS these days. This applies to mail protocols, HTTP and many others. The newly designed QUIC has also adopted TLS as its cryptography layer. However, ...
79
votes
5answers
266k views

How secure is AES-256?

The cipher AES-256 is used among other places in SSL/TLS across the Internet. It's considered among the top ciphers. In theory it's not crackable since the combinations of keys are massive. Although ...
78
votes
1answer
117k views

What is the difference between .pem, .csr, .key and .crt and other such file extensions?

I'm new to SSL / TLS and I want to work with the OpenSSL toolkit. I don't know what .pem and .csr stands for? I do know that <...
62
votes
5answers
30k views

Technical feasibility of decrypting https by replacing the computer's PRNG

Intel has an on-chip RdRand function which supposedly bypasses the normally used entropy pool for /dev/urandom and directly injects output. Now rumors are going on that Intel works together with the ...
49
votes
7answers
31k views

Google is using RC4, but isn't RC4 considered unsafe?

Why is Google using RC4 for their HTTPS/SSL? $ openssl s_client -connect www.google.com:443 | grep "Cipher is" New, TLSv1/SSLv3, Cipher is RC4-SHA Isn't RC4 ...
43
votes
5answers
57k views

What's the appeal of using ChaCha20 instead of AES?

I read about ChaCha20 being used in TLS by Google, SSH, and towards standardization in general. What's the appeal of using something other than AES, what with AES receiving dedicated CPU instructions ...
43
votes
2answers
48k views

Differences between the terms “pre-master secret”, “master secret”, “private key”, and “shared secret”?

Both crypto.SE and security.SE have excellent Q&As about how TLS generates session keys (I have linked some at the bottom). In reading these threads I'm having troubles with terminology since the ...
41
votes
5answers
129k views

What is the SSL private key file format?

I was researching about how to encrypt with RSA. I understood everything but not the format of the private keys. In the phpseclib (RSA in PHP), you can import your private key (private.key format) ...
39
votes
2answers
28k views

Is Triple DES still considered safe to use?

What it says on the tin. Is it still used in things like TLS?
37
votes
3answers
7k views

Why was AES CBC removed in TLS 1.3?

I don't quite understand why AES CBC was removed in TLS1.3. From what I know CBC is the most secure Mode of operation for the AES block cipher (if you can say it like that). It only needs a TRND IV ...
29
votes
7answers
20k views

How can SSL secure a two-way communication with only one key-pair?

As I understand it, SSL involved the use of a public-private key pair. How does this enable two-way communication? Suppose I have some server with which I wish to communicate securely. I connect to ...
27
votes
2answers
2k views

Why did TLS 1.3 prohibit PGP authentication?

There is a specification, in Informational(!) RFC 6091, for using PGP keys in TLS authentication, although I don’t think it has ever been implemented outside of GnuTLS (it’s certainly not in OpenSSL). ...
27
votes
3answers
38k views

How can I use SSL/TLS with Perfect Forward Secrecy?

I'm new to the field of cryptography, but I want to make the web a better web by setting up the sites that I host with Perfect Forward Secrecy. I have a list of questions regarding the setup of ...
23
votes
2answers
51k views

What's the difference between RSA and Diffie-Hellman? [duplicate]

I've been reading on a lot of websites that same thing: RSA is for communication using the public and private key for both the server and client, where Diffie-Hellman is just for exchanging the same ...
23
votes
2answers
26k views

Why is TLS susceptible to protocol downgrade attacks?

A recent blog post from Ivan Ristić (expert extraordinaire on all things SSL) says: all major browsers are susceptible to protocol downgrade attacks; an active MITM can simulate failure conditions ...
21
votes
3answers
33k views

How can Cipher Block Chaining (CBC) in SSL be attacked?

I am trying to understand how CBC-mode in SSL/TLS can be attacked. I have been looking around online but all examples and explanations are very hard to understand and follow. Can you give a simple ...
20
votes
2answers
7k views

Why do new versions of TLS use an explicit IV for CBC suites?

SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: they used the last part of the previous record, a value that can be predicted by the attacker. ...
18
votes
2answers
16k views

What is the advantage of AEAD ciphers?

What is the advantage of AEAD ciphers? Why is the TLS working group pushing for them? I thought modern cipher suites require SHA256 for authentication. What advantage is there to including Poly1305? ...
18
votes
2answers
16k views

What is the purpose of four different secrets shared by client and server in SSL/TLS?

I was looking through the working of SSL V3, and found that a connection state is defined by a set of things, including client write mac secret, server write mac secret, server write key, client ...
17
votes
2answers
3k views

Is HTTPS secure if someone snoops the initial handshake?

Let's say I'm on an open wireless network that's being actively sniffed and I connect to an HTTPS site. Even though my subsequent traffic is encrypted, couldn't the sniffer use the data from the ...
16
votes
1answer
1k views

Who issued the first SSL certificate?

When SSL was introduced in ~1996, there was only a few CAs issuing certificates for that specific use and a few sites which actually used SSL. Which Certification Authority issued the first SSL ...
15
votes
4answers
12k views

Best choice out of these six TLS cipher suites

I have a small embedded platform that supports 6 TLS ciphers. Is there a good/better/best one to chose? I was looking around on the web for some kind of rating system or list of ciphers that have ...
14
votes
8answers
17k views

Why is SSL on top of TCP?

Why is SSL not under TCP (the Transport layer)?
14
votes
1answer
6k views

Why is CAMELLIA suddenly so widely used?

When nowadays I point my browser to https sites, the cipher that is on most occasions used is Camellia. My browsers (Chrome and Firefox) seem to prefer it, even when AES is available. Is that not ...
14
votes
1answer
3k views

What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?

It seems the only specified CTR mode ciphers in TLS are all GCM based. GCM ciphers run AES-CTR and do authenticated encryption with a MAC based on Galois-field ...
13
votes
4answers
8k views

Is there a standard for OpenSSL-interoperable AES encryption?

Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64). I hear it's ...
13
votes
2answers
2k views

Does a trace of SSL packets provide a proof of data authenticity?

I'm wondering if it would make sense to record a whole HTTPS session, publish its encryption keys and present it to third parties as a proof that this particular data was sent by a given server ...
12
votes
1answer
2k views

Why does TLS 1.3 support two CCM variants?

One of the important improvements introduced in TLS 1.3 is the pruning of the many previously available cipher suites to only five secure options (for symmetric ciphers), that are each supposed to ...
11
votes
2answers
17k views

At what stage is DHE and RSA used during the SSL/TLS handshake?

At what stage of the SSL/TLS handshake is the DHE and RSA used and what is the purpose of using a pre-master secret when you could just use RSA to exchange the symmetric key (i.e. AES) for further ...
11
votes
2answers
488 views

Is RC4 a problem for password-based authentication?

This is a follow-up question to Does TLS use RC4-drop[n]?. As mentioned in section 6 of RFC4345, there are weak distinguishers for RC4 keystreams available that even work for keystreams that ...
11
votes
2answers
4k views

What's the difference between rsa_pss_pss_* and rsa_pss_rsae_* schemes?

I'm trying to understand the difference between rsa_pss_pss_ and rsa_pss_rsae_. The picture shows the extension of TLS1.3's ...
11
votes
1answer
253 views

How does the process of creating a new secure Elliptic Curve look like?

I'm especially curious about the technique djb would have used to come up with his Curve 25519. Say I have already written down my goals, such as - Twist Secure, Speed, Side Channel resistance, etc. ...
11
votes
2answers
17k views

How does a client verify a server certificate?

As far as I know, when I request a certificate from Verisign (for example), and after they approved that me is me, they create a certificate (for me) which contains the digital signature and public ...
10
votes
1answer
1k views

Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3?

Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3? How keys can be exchanged then? https://tools.ietf.org/html/draft-ietf-tls-tls13-28
10
votes
3answers
12k views

How vulnerable is the C rand() in public cryptography protocols?

I just learned about the basics of public cryptography a few weeks ago and I am curious as to why the C rand() function should not be used for crypto schemes. For example, say I want to generate a ...
9
votes
2answers
9k views

What's the GCM-SHA 256 of a TLS protocol?

If we read the Google line information about how the cypher the https communication, it reads: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 I understand it's using ...
9
votes
5answers
15k views

Why do we need asymmetric algorithms for key exchange?

In SSL protocols, both symmetric and asymmetric algorithms are used. Why is it so? The symmetric algorithms are more secure and easier to implement. Why are asymmetric algorithms usually preferred in ...
9
votes
1answer
9k views

What is the purpose of pre master secret in SSL/TLS?

I studied about SSL/TLS and learned that client and server must share keys below. common key for encryption common key for generating message authentication code Then, in SSL/TLS, a client doesn't ...
9
votes
1answer
5k views

Why does AES-GCM need a hash/MAC in TLS?

"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" is just one example for a cipher suite, as far as I'm concerned it means this: It uses the TLS protocol, exchanges keys with Elliptic Curve Diffie Hellman ...
8
votes
2answers
421 views

Is SSL getting faster because it's getting less secure?

There has been some discussion about it being more practical to use SSL due to advances in hardware. From my understanding, stronger public-key encryption means that both encrypting/decrypting and ...
8
votes
1answer
1k views

The 9 lives of Bleichenbacher's CAT, it puts another scratch again

Bleichenbacher demonstrated a padding oracle attack against RSA implementations that follow the PKCS #1 v1.5. Through the years, there are various mitigation techniques developed as OAEP and limiting ...
8
votes
1answer
1k views

Why would one choose DTLS-SRTP versus just RTP over DTLS?

If I understand DTLS-SRTP correctly, DTLS is used to exchange keys and then the endpoints switch to SRTP for encryption. What is the benefit of this setup versus just sending RTP over DTLS? Is it just ...
8
votes
3answers
806 views

Why does TLS 1.3 use random-looking nonces for AEAD?

In TLS 1.3, it seems that nonces for AEAD are constructed by XORing the recorded sequence number with the server/client_write_IV (which is generated during the handshake). Thus, nonces are random-...
8
votes
1answer
3k views

TLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

TLS 1.2 defines a number of cipher suites that employ AES-GCM, e.g.: ...
8
votes
1answer
6k views

SHA1 no longer considered secure for SSL Certificates — what about Cipher Suites?

Many browsers and Internet companies have recently claimed that SSL Certificates with a signature algorithm of SHA1 will imminently no longer be considered secure. Most notably, Google and Google ...
8
votes
1answer
2k views

Compare RFC 5246 SessionID re-use versus RFC 5077 Session Resumption?

Can you help me understand the differences, both algorithmic and practical, between RFC 5246 SessionID re-use and RFC 5077 Session Resumption? Both appear to be ways to nail up a second TLS session ...
8
votes
1answer
440 views

Cipher suites: same name, different IDs, why?

Sorry if I missed with a community to ask. Recently I stumbled on a fact that the same cipher suite can be designated by two different IDs, and this is not a typo nor single occasion. For instance: ...
8
votes
1answer
200 views

Can the lengths of HTTPS requests be used to deduce which public pages on a site are visited?

I thought of this recently: There are some websites which have many publicly accessible pages, some of which could be embarrassing despite being public (e.g. Wikipedia). The HTML for these pages also ...
8
votes
1answer
293 views

What's the reasoning behind the design of the TLS 1.2 PRF?

TLS 1.2 defines a PRF-like construction $P_{hash} : \{0,1\}^* \times \{0,1\}^* \rightarrow \{0,1\}^l$ for key derivation, etc. To quote the spec: We define a data expansion function, ...
8
votes
2answers
4k views

nonce of AES-GCM in SSL

It seems that the nonce of AES-GCM in SSL has 3 parts: salt, 4 bytes, generated in handshake, not changed in whole session nonce_explicit, 8 bytes, chosen by the sender and carried in each SSL record ...

1
2 3 4 5
11