Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
2
votes
1answer
506 views

Cipher Block Chaining (CBC) encryption in SSL

Is cipher block chaining (CBC) mode used in SSL encryption? If block reordering is already protected by SSL and TCP sequence numbers, what added advantage does CBC provide?
0
votes
1answer
473 views

How is the TLS 1.2 sequence number generated?

In the other ciphers supported by TLS 1.2, namely stream cipher and CBC block cipher mode, the sequence number is implicitly in the MAC (RFC5246, 6.2.3.1): ...
1
vote
1answer
919 views

Tls protocols: is the simple diffie hellman key exchange still used these days?

Or did it mostly get replaced by ecdh for key exchange and rsa for authentication ?
2
votes
1answer
106 views

Does DROWN attack break 2048-bit key itself or just the plaintext encrypted with the RSA key

Does the DROWN attack enable breaking strong RSA keys (e.g. the 2048-bit key itself) or enable breaking the plaintext (i.e. pre-master key) that is encrypted with a 2048-bit (or any strong) RSA, if ...
0
votes
1answer
462 views

How does OpenVPN work?

I'm confused with the technologies that OpenVPN uses. The official site mentions it uses SSL/TLS in-place of IKEv1/IKEv2, and uses IPSec ESP to secure the data, and yet that it isn't compatible with ...
2
votes
0answers
53 views

Is my way safe to remove SSL CA Cert by DHT and PoW NodeID for a decentralized system?

To implement a decentralized system, I wrote a TLS like P2P net stack. The main idea is removing CA Cert from the whole system by using a DHT for Naming and Key Exchange. I am not a crypto expert, so ...
0
votes
1answer
123 views
1
vote
1answer
55 views

How to prove to a third-party that a given response came from a specific domain?

Suppose I've got a response from a website using https. Is it possible to store the certificate and keys exchange to prove to a third-party that the response came from that domain?
2
votes
1answer
141 views

What's the `ticket_age_add` and `obfuscated_ticket_age ` used for in TLS 1.3

In RFC, I only find such description: This addition prevents passive observers from correlating connections unless tickets are reused ...
2
votes
1answer
682 views

In TLS 1.3 handshake, what's “PSK binders” used for?

PSK handhanke works like session ticket resumption in TLS 1.2, but I found a set of PSK binder for each identity(ticket) in TLS 1.3, why ...
4
votes
1answer
231 views

Authentication in TLS protocol

TLS session keys are derived as a result of authenticated key agreement. Is being able to decrypt a record at an endpoint after receiving change_cipher_spec sufficient guarantee that the endpoint is ...
3
votes
2answers
6k views

Authenticated Encryption of UDP packets

I am working on a UDP based file transfer protocol. Congestion Control, Resending of packages and other UDP challenges are dealt with - speedtests shows that the protocol is up to 10 times faster than ...
0
votes
1answer
1k views

What is the most popular cipher suite used in TLS 1.2 for HTTPS?

I'm trying to do some performance (time) calculations over TLS. I have the data I need for a variety of cipher suites but in order for the calculations to generalize well, I need to know if there is a ...
0
votes
2answers
243 views

UDP and AES with C++

I'm implementing different applications that will use UDP to exchange real-time data, thus a low impact on performance is very important. This system will not be connected to the Internet so I just ...
3
votes
2answers
119 views

Private key ECDSA/TLS

Is the private key required once the certificate is hashed and signed? After a certificate is generated, public key is shared within the certificate itself. Is the private key used for any other ...
0
votes
2answers
76 views

How does authentication work differently between asymmetric and symmetric cryptography?

Must Bob and Alice establish a 'connection' before a symmetric or asymmetric encryption scheme is secure? If so, is there ever some expected plaintext whose decryption authenticates the users? In ...
80
votes
2answers
24k views

Why doesn't SSH use TLS?

Most cryptographically protected protocols use TLS these days. This applies to mail protocols, HTTP and many others. The newly designed QUIC has also adopted TLS as its cryptography layer. However, ...
2
votes
1answer
60 views

Does the server signs message body after ssl handshake?

So after SSL handshake the master secret is used to securely transfer data encrypted using symmetric cryptography. My question is simple: after SSL handshake, when the server (for example my bank) ...
0
votes
2answers
388 views

TLS1.2 AES 128 CBC Encrypted Data size is not a multiple of block size [closed]

I know that TLS ciphers such as TLS_RSA_WITH_AES_128_CBC_SHA transmit data as shown https://tools.ietf.org/html/rfc5246#section-6.2.3.2. From my understanding the ciphertext MUST be a multiple of the ...
2
votes
1answer
408 views

TLS Extension signature_algorithms values

I hate asking for a reference, but I'm having a hard time finding this. The iana page on tls extensions just links me back to rfc5246 where it only has the following values: ...
4
votes
1answer
5k views

HMAC Key Sizes for MD5, SHA1, SHA224|256|384|512

I'm trying to find an authoritative source for the HMAC Key sizes for each of the hashing algorithms below. Specifically for TLS implementations of HMAC. I found this table in RFC5246: ...
1
vote
1answer
563 views

does TLS 1.3 use ECDSA-Sig-Value encoded signatures for Ed25519 / Ed448?

Quoting The Transport Layer Security (TLS) Protocol Version 1.3: ECDSA algorithms Indicates a signature algorithm using ECDSA [ECDSA], the corresponding curve as defined in ANSI X9.62 [...
8
votes
1answer
3k views

TLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

TLS 1.2 defines a number of cipher suites that employ AES-GCM, e.g.: ...
4
votes
1answer
657 views

TLS: Risks of using a NULL cipher with encryption implemented in application?

We have a browser-launched JNLP/WebStart application that is no longer able to establish client-server CORBA/IIOP communications across TLS 1.0/1.1 due to relying on a cipher suite that uses an ...
1
vote
1answer
158 views

Advantages of a TLS handshake over pre-shared public keys

Lets assume the following setup: A vendor manufactures IoT devices where each is able to generate an individual private/public key-pair. Only the public key is exposed, the private key is assumed to ...
5
votes
2answers
2k views

Are TLS 1.2 AES-CBC and AES-GCM Authenticated Encryption ciphersuites?

In the answer of the following post: Why was AES CBC removed in TLS 1.3?, I quote the following from the chosen answer: After the Lucky13 attack (a timing oracle caused by MAC-then-encrypt), it ...
1
vote
1answer
133 views

What kind of ciphers does not depend on order of operation?

What kind of cipher does not depend on order of operation ? For Instance if we have two operations encryption Enc(m,k), decryption Dec(m,k) and some message m. For which ciphers the following is ...
0
votes
2answers
146 views

Self signed certificate for mobile app and backend from same company

My company's product is Android and iOS mobile app which connects to our own backend. All interactions of the mobile app are with backend developed by our own company. In such a situation, can the ...
2
votes
2answers
548 views

What is a size of mac_length and mac_key_length for TLS cipher suites HMAC using SHA384 and SHA512?

i failed to find explicit definition of hash output size and mac_key_size for hmac based on SHA384 and SHA512. RFC5246 specifies: but defines only
10
votes
2answers
9k views

What's the GCM-SHA 256 of a TLS protocol?

If we read the Google line information about how the cypher the https communication, it reads: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 I understand it's using ...
1
vote
1answer
475 views

Clarifications regarding ciphers and Nmap scan

I'm running the below Nmap command to test the strength of the cipher suites I have used in my host nmap -sV --script ssl-enum-ciphers -p 443 <host> The ...
2
votes
1answer
88 views

What should be broken to break a cipher with perfect forward secrecy?

What should be broken to break a cipher with perfect forward secrecy as a passive observer? RSA/EC analog, (EC)DHE or both?
0
votes
1answer
229 views

Digital certificate issuing man-in-the-middle attack

While obtaining digital certificate the applicant trusts the certificate authority (or registering authority) as CA is digitally certified (and applicant has CA's public key). To certify a domain ...
11
votes
2answers
4k views

What's the difference between rsa_pss_pss_* and rsa_pss_rsae_* schemes?

I'm trying to understand the difference between rsa_pss_pss_ and rsa_pss_rsae_. The picture shows the extension of TLS1.3's ...
1
vote
1answer
109 views

Does semi-honest adversary eavesdrop honest parties communication?

Assume we have a multi-party computation protocol and the protocol definition, where both of them consider a semi-honest adversary, without explicitly assuming the type of channel the parties want to ...
2
votes
0answers
182 views

What kind of RSA padding mode is it?

1: I have a HTTPS server and I added hooks in RSA decryption procedure to dump error RSA input(client key exchange). 2: I get some RSA input that I couldn't check padding successfully(It's usual) and ...
2
votes
0answers
65 views

Are there any one-way operations that could be used for Diffie-Hellman post-quantum? (See criteria)

With quantum-computers looming, there is a need for Public Key Cryptosystems that can withstand attacks by quantum-computers. Are there any known one-way operations that fit the following criteria? ...
2
votes
1answer
82 views

SSL and first step of handshaking

When I connect to a secure sever that has is equipped with SSL certificate. Logically, the first step is the handshake to discuss the cipher suites etc. However, the very first time my web browser ...
2
votes
1answer
1k views

Raw public keys vs PSK in TLS

Is there any advantage in using raw public keys (RFC 7250) in comparison with pre-shared keys (RFC 4279) in TLS, when I need client authentication and have an unique key per client deployed to them ...
1
vote
1answer
11k views

Secure Cipher Suites supported by JDK versions [closed]

I'm a n00b to cryptography. I've been searching through oracle's java docs, ssl labs, googling and more googling attempting to find an up to date list of cipher suites considered secure for the ...
1
vote
1answer
94 views

What 32 bytes TLS data records for?

I've captured my tor client network traffic and noticed that in every packet it sends 2 TLS records first of which is always 32 bytes long. The first TLS record seems not to be carrying any data. What ...
0
votes
3answers
231 views

Is this a correct SSL explanation in layman's terms?

I'm looking to provide a basic / layman's explanation of SSLs to clients and want to be sure it is correct. My explanation is below and would appreciate any feedback / corrections. Basically, the SSL ...
1
vote
0answers
50 views

MAC with key supplied afterwards

Looking at HMAC and KMAC it seems that the key is always required up front, i.e. before starting to process any other data. However, in many protocols the key may not be known it advance. For instance,...
29
votes
7answers
20k views

How can SSL secure a two-way communication with only one key-pair?

As I understand it, SSL involved the use of a public-private key pair. How does this enable two-way communication? Suppose I have some server with which I wish to communicate securely. I connect to ...
1
vote
1answer
7k views

IPSec vs SSL : Similarities and Differences

I am studying SSL and IPSec. I can pretty much nail down the "very high level" differences and similarities between the two, but am struggling to find a "lower level" (but not too deep) look. This ...
1
vote
1answer
566 views

How is a fake private key used in CloudHSM?

I've noticed that AWS CloudHSM uses an openssl command to generate a fake private key for web servers that offloads cryptographic functions to a CloudHSM. How does this key work? And what purpose does ...
1
vote
1answer
216 views

What does GHASH really do?

I try to understand the GCM-MODE used in TLS. The problem I have had is described below. 1:textbook describes how GHASH works: 2: I get some debuginfo from openssl code that contain enc_key(32 bytes)...
2
votes
1answer
85 views

CAs are pre-loaded on the system, but how is it able to get intermediate certs?

I have the following X509 certificate: ...
3
votes
1answer
2k views

What role does RSA play in DHE_RSA cipher suite?

I've read in this article, that encrypting a premaster key with a RSA public key is not safe from forward secrecy attacks. If an adversary, records all communication between a client and a server. And ...
1
vote
1answer
2k views

What is the Peer Signing digest on an OpenSSL s_client connection?

For a little background, I am trying resolve an issue with an ISAM (reverse proxy) appliance not being able to connect to a server due to it failing to complete a TLS connection. A server that is ...

1 2 3
4
5
11