Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
23
votes
2answers
53k views

What's the difference between RSA and Diffie-Hellman? [duplicate]

I've been reading on a lot of websites that same thing: RSA is for communication using the public and private key for both the server and client, where Diffie-Hellman is just for exchanging the same ...
43
votes
2answers
49k views

Differences between the terms “pre-master secret”, “master secret”, “private key”, and “shared secret”?

Both crypto.SE and security.SE have excellent Q&As about how TLS generates session keys (I have linked some at the bottom). In reading these threads I'm having troubles with terminology since the ...
2
votes
1answer
62 views

Generate a per data shared secret vs per session

I have read about SSL that they persist the shared-secret for the entire session. However, someone in stackoverflow suggested a way of generating a shared secret for each data to send and then send ...
3
votes
1answer
471 views

How does padding oracle attack work with bytes larger than possible length?

I am trying to understand how the POODLE attack would actually be implemented. In the original security advisory from Möller, Duong and Kotowicz [POODLE 14] the following example is presented: Assume ...
7
votes
1answer
379 views

Which TLS features are vulnerable to chosen-prefixes collision on SHA-1?

Gaëtan Leurent and Thomas Peyrin's preprint From Collisions to Chosen-Prefix Collisions - Application to Full SHA-1 (in volume 1 of proceedings of the forthcoming Eurocrypt 2019) shows a feasible ...
6
votes
2answers
2k views

Why is PerfectForwardSecrecy considered OK, when it has same defects as salt-less password hashing?

PFS suites suffer from the same defects as any other salt-less password hashing scheme. Why is everyone promoting Perfect Forward Secrecy (PFS) ciphersuites so fiercely? Namely, when the group/hash ...
8
votes
1answer
200 views

Can the lengths of HTTPS requests be used to deduce which public pages on a site are visited?

I thought of this recently: There are some websites which have many publicly accessible pages, some of which could be embarrassing despite being public (e.g. Wikipedia). The HTML for these pages also ...
1
vote
0answers
34 views

Which parts of a TLS connection can I safely reuse for DTLS to the same peer?

Suppose I need both encrypted TCP and UDP, say TCP for reliable control signals from server to client and UDP for low latency data from client to server. If I first establish TLS, for the DTLS ...
4
votes
2answers
724 views

Using Lattice-based cryptography for TLS\SSL

Given the general benefits of Lattice-based cryptography, such as: Post quantum Security Security from worst case scenario Efficiency What could the outlook of shifting from RSA \ ECC-based ...
3
votes
1answer
313 views

How will be cipher selected when client is running on version TLS 1.3 and server is running on TLS 1.2?

How will be cipher selected when a client is running on version TLS 1.3 and server is running on TLS 1.2? The cipher list provided by TLS 1.3 client will be different than the version supported on ...
2
votes
1answer
183 views

X.509 strong authentication protocols

Is there also a protocol definition in X.509? In "Handbook of Applied Cryptography" by A. Menezes there is a reference to X.509 strong authentication protocol, nevertheless, I could not find the ...
2
votes
1answer
98 views

What key is used to encrypt the certificate and certificate verify message in TLS1.3?

Which key is used to encrypt certificate and certificate verify message in TLS1.3? I could not figure out which one it is reading section 4.4.2 of RFC 8846 and I only saw a vague mention on page 11.
0
votes
1answer
98 views

What SALT value will be used in HKDF_EXTRACT in TLS1.3?

What SALT value will be used in HKDF_EXTRACT while generating the Handshake Secret (when there will not be any PSK)?
1
vote
0answers
533 views

Which 'info' and 'salt' parameters to use in HKDF for TLS 1.3?

all the following discussion is for HKDF in TLS1.3: Regarding the 'salt' parameter in - HKDF-Extract(salt, IKM) as written in RFC 5869: HKDF without having to protect the secrecy of the salt. In ...
1
vote
1answer
739 views

When do clients use TLS in PSK mode?

The TLS protocol can perform the handshake in different modes. Either fresh handshake where new keys are generated, or using Pre Shared Keys (PSK) or what was know as Session Resumption in previous ...
3
votes
2answers
2k views

TLS Handshake : Server authentication or only Server ‘s Certificate authentication?

I have some difficulty understanding the way in which the Server is really authenticated by Client in TLS handshake (in case of using RSA key exchange). When Client receives Server ‘s Certificate and ...
4
votes
1answer
423 views

TLS AES_XXX_CCM mode of operation is encrypt-then-mac or mac-then-encrypt?

There are number of definitions completely confusing me. in https://en.wikipedia.org/wiki/CCM_mode we have "As the name suggests, CCM mode combines the well known CBC-MAC with the well known counter ...
3
votes
3answers
8k views

How is session key generated for TLS?

I would like to understand better what happens during establishment of SSL/TLS secure connection. The Client wants to establish a connection - ClientHello The server answers with a ServerHello. This ...
2
votes
2answers
197 views

What data Certificate Authority encrypt for CSR?

I have been searching for a detailed explanation but can’t seem to find a low level one. 1) When CA sign the data with its private key, the encrypted data is APPENED to the csr or the whole cert ...
2
votes
0answers
196 views

Sharing RSA private key between SSH and SSL services. How bad is it?

An appliance uses a curious way of obtaining ssh-rsa host keys: There is a single configuration option "management certificate" that sets RSA private keys both for HTTPS and SSH management. ...
4
votes
2answers
1k views

Which hash is used when providing signature algorithm ED25519 or ED448?

From TLS 1.3 there are two signature algorithms using edDSA: /* EdDSA algorithms */ ed25519(0x0807), ed448(0x0808), All the other signature-...
4
votes
4answers
1k views

JWT Login Security

I am new to security and I am wondering if JWT is secure enough. From what I have read online the flow goes like this: Clients log in by sending their credentials to the identity provider. The ...
1
vote
2answers
287 views

If my server utilises an RSA based certificate, why does firefox think I am using Diffie Hellman?

I am not a beginner in crypto, but not that far from it, so please be gentle. I look after a web server app that I generated the SSL certificate for, and I used an RSA public/private keypair. When ...
0
votes
1answer
278 views

Is LibreSSL affected? - Downgrade Attack on TLS 1.3

https://news.ycombinator.com/item?id=19111707 https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/february/downgrade-attack-on-tls-1.3-and-vulnerabilities-in-major-tls-libraries/ No ...
2
votes
1answer
2k views

TLS 1.3 Secure Renegotiation not supported [closed]

I get the message "Secure Renegotiation IS NOT supported" if a TLS 1.3 cipher will be chosen at a TLS handshake with openssl s_client. Since TLS 1.3 does not support renegotiation at all I assume that ...
0
votes
0answers
69 views

Understanding TLS certificate

I'm newbie in the word of TLS, and need some verification about my picture. I can use TLS with 3 or 2 participants: 3 participants: Client, server, CA (certification authority). The CA is where the ...
0
votes
1answer
520 views

Public key on Server Key Exchange Generation vs Public key on Server's Certificate

To understand the distinction between TLS 1.2 and TLS 1.3. I am stuck in the past understanding for TLS and the current reference I am studying: As I know certificate goes with owner's public key, ...
41
votes
5answers
130k views

What is the SSL private key file format?

I was researching about how to encrypt with RSA. I understood everything but not the format of the private keys. In the phpseclib (RSA in PHP), you can import your private key (private.key format) ...
1
vote
1answer
1k views

TLS 1.3: HKDF-Expand

In RFC5869 I found that the function of the HKDF-Expand on the input assumes the parameter $L$ which denotes length of output keying material in octets ($\leq 255*\text{Hash}_{Length}$), and then the $...
1
vote
1answer
543 views

Can a TLS certificate using ECC secp384r1 as PK algorithm uses RSA for signature

If a TLS certificate public-key algorithm is ECC secp384r1 or ECC prime256v1, is it possible to have RSA as a signature ...
8
votes
3answers
833 views

Why does TLS 1.3 use random-looking nonces for AEAD?

In TLS 1.3, it seems that nonces for AEAD are constructed by XORing the recorded sequence number with the server/client_write_IV (which is generated during the handshake). Thus, nonces are random-...
12
votes
1answer
2k views

Why does TLS 1.3 support two CCM variants?

One of the important improvements introduced in TLS 1.3 is the pruning of the many previously available cipher suites to only five secure options (for symmetric ciphers), that are each supposed to ...
4
votes
0answers
154 views

Can “OPAQUE-over-TLS” authentication be optimized?

So while discussing the issues of password-hashing off-loading in our chat I noticed that it's easy to extend OPAQUE (CFRG draft) to essentially be a better standard password based authentication when ...
3
votes
1answer
864 views

SSL - encrypt with private key and then with public key?

Say there are 2 sides that wish to communicate: side A and side B. Let's say we are looking at side ...
11
votes
1answer
255 views

How does the process of creating a new secure Elliptic Curve look like?

I'm especially curious about the technique djb would have used to come up with his Curve 25519. Say I have already written down my goals, such as - Twist Secure, Speed, Side Channel resistance, etc. ...
4
votes
1answer
365 views

Can the TLS 1.3 PSK-DHE handshake be turned into a PAKE?

Recently, we had the question whether there's a PAKE that uses more standard, higher-level primitives than what SRP offers. Now this made me think and ask myself: TLS does have a PSK mode, can't we ...
1
vote
1answer
66 views

What can eve see when I go to https//paypal.com

If I go to https://paypal.com/ and login, can Eve find the approximate size of the HTTPS request from my browser? Can she see the approximate size of the responses from the paypal server to me? and ...
2
votes
1answer
162 views

Why don't the TLS1.3 cipher suites mention the key exchange and digital signature algorithm in names?

Does it mean both RSA and ECDSA certificates can be used with the same cipher suite?
0
votes
1answer
45 views

When a program using openssl library is using a certificate, does the server check if the issuer(s) are still valid

If I have a program acting as TLS server with a certificate signed by a CA, if one of the issuers in the chain becomes invalidated or the date expires, then how does the program using the certificate ...
3
votes
1answer
339 views

In a TLS 1.3 connection, how do the client and server choose a mutual cipher suite?

According to KeyCDN, TLSv1.3 connections are established in a single round trip: While TLS 1.2 requires two round-trips to complete the TLS handshake, 1.3 gets the job done in just one trip If ...
0
votes
2answers
432 views

What is the hash of this cipher: TLS_RSA_WITH_AES_128_CCM

In TLS 1.3 supported ciphersuite, I find the following ciphersuite: TLS_RSA_WITH_AES_128_CCM Can any one tell me what is the hash function used in this ciphersuite? how could you know that (...
27
votes
2answers
2k views

Why did TLS 1.3 prohibit PGP authentication?

There is a specification, in Informational(!) RFC 6091, for using PGP keys in TLS authentication, although I don’t think it has ever been implemented outside of GnuTLS (it’s certainly not in OpenSSL). ...
1
vote
2answers
5k views

Why does curl need both root and intermediate certificates in order to securely connect to an HTTP server?

I have created a root certificate, an intermediate certificate, and a server certificate: ...
2
votes
1answer
45 views

Are Authenticated Encryption ciphersuites supported in legacy TLS versions older than TLS 1.2?

I have read in a paper that Authenticated Encryption (by this I mean those that support GCM mode or ChaCha20 ciphers) are not supported in versions older than TLS 1.2? I could not confirm this as ...
2
votes
2answers
951 views

The attacker model of the Lucky13 attack in TLS

Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page: The attacks involve detecting small differences in the time at which TLS error messages ...
2
votes
4answers
134 views

TLS ciphersuite without mode of operation

Will there be any security concern if there is no mode of operation specified in the ciphersuite name? For instance, there is no mode of operation in ...
1
vote
1answer
1k views

CBC related TLS cipher suites to be disabled in the server side

I understand the TLS cipher suites using CBC mode are susceptible to timing attacks. From that understanding it seems that the cipher suites using GCM (CTR-based) are safe to use considering they don'...
1
vote
1answer
258 views

How Elliptic-Curve affects the Server Key Exchange parameters

In Finite Field DHE, the server sends the following parameters in the server key exchange message: $p$: prime $g$: group $g^b$: the server's public DH key In DHE_RSA (non anonymous DHE), the server ...
0
votes
1answer
90 views

When using Client Certificates, is it usual to generate your own?

We're building a webservice for a third party customer who wants us to use "two-way SSL". By which I understand them to mean they want us to host the site using https, and to require that include a ...
2
votes
2answers
806 views

signature with Bleichenbacher’s attack

I understood Bleichenbacher & ROBOTO attack, however I have some trouble understanding Section 3.5 of ROBOT attack which discusses retrieving private keys. https://www.usenix.org/system/files/...

1 2
3
4 5
11