Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
1
vote
1answer
318 views

TLS false start / early data

How often such mechanisms are used by application. Is it real requirement to support these features for TLS ?
1
vote
0answers
57 views

Custom encryption scheme for SSL

Suppose that messages transmitted over SSL are modified as follows: the message is splitted in blocks, $B_1, ..., B_m$ (each with at most $2^{14}$ bytes) for each block $B_i$ we do: ...
3
votes
2answers
2k views

TLS re-negotiation vs resumption

Please explain the difference between TLS re-negotiation and resumption. My understanding is as follows: in the context of TLS 1.2, re-negotiation and resumption look the same, but the former can be ...
1
vote
1answer
476 views

How does Naver Line PC client obtain private key for end-to-end encryption (letter-sealing)?

When I download Naver Line PC client onto my PC, a six-digit number will be shown on the PC client for me to enter the number into my Line app on my mobile phone for decrypting the old and new ...
1
vote
1answer
60 views

Tls 1.3 ClientHello legacy_session_id as zero length vector alignment

Looking at tls 1.3 draft 23: https://tools.ietf.org/html/draft-ietf-tls-tls13-23 Section 4.1.2 shows, for a freshly established connection (no previous session from tls 1.2 or earlier) the ...
3
votes
1answer
908 views

What is the difference between these two TLS suites?

I am comparing the security information of two different HTTPS connections in the Google Chrome (v63.0.3239.132) security tab in developer tools. The information for each of the two connections is ...
4
votes
0answers
94 views

Implications of TLS-SRP client with improper N validation?

During development of a client side application of TLS-SRP, i noticed a bug that allows an attacker spoofing as the server to send custom, but non-arbitrary $N$ values, with the client accepting them. ...
0
votes
1answer
280 views

Interpreting the Hash type in a TLS ciphersuite

There are ciphersuites with SHA256, and SHA384. In the following TLS ciphersuite, the SHA types is not specified. Does this always refer to SHA1 (there is SHA0 as well) so which one of them? ...
0
votes
1answer
1k views

What are the major differences between SET and SSL?

SET and SSL are usually used as secure payment protocols. What are the major differences between them? Which one is better?
14
votes
8answers
18k views

Why is SSL on top of TCP?

Why is SSL not under TCP (the Transport layer)?
0
votes
1answer
3k views

how to validate cert when signed cert has authority key id but signing cert doesn't?

Say I have the following signing cert: ...
4
votes
1answer
955 views

TLS Handshake with DH

I try to understand the TLS Handshake with DH. I googled the concepts and I think I understood the basics. But there are somethings I'm still struggling with. I also read the following two posts Why ...
39
votes
2answers
28k views

Is Triple DES still considered safe to use?

What it says on the tin. Is it still used in things like TLS?
79
votes
5answers
266k views

How secure is AES-256?

The cipher AES-256 is used among other places in SSL/TLS across the Internet. It's considered among the top ciphers. In theory it's not crackable since the combinations of keys are massive. Although ...
1
vote
1answer
755 views

How does HTTPS transfer the symmetric key?

How is the server's public key used to encrypt the symmetric key in a way so that only the sever's private key can decrypt the cipher? The client uses the server’s public key to encrypt the ...
1
vote
1answer
185 views

Cut through mode for TLS AES-CBC / SHA ciphersuite

I am looking at RFC5246 and it seems that AES-CBC/SHA cipher suites cannot be implemented in a cut-through mode. Let's suppose that received record spans two segments. As i understood HMAC ...
5
votes
1answer
2k views

TLS RSA Certificate with Elliptic Curve Negotiation

When I look at Google's Public Key in Firefox I get PKCS #1 SHA-256 With RSA Encryption Yet according to SSL Labs Google has EC 256 bits / SHA256withRSA and supports ...
-1
votes
2answers
965 views

How does registration authority verify entity's identity for SSL? [closed]

In the answer here: Verification of identity by certification authority, it states that for European eIdentity you must provide your passport or ID card, but that this practice is quite different ...
0
votes
1answer
444 views

What order should these HTTPS ciphers go in to maximize security?

I want to set up a very secure-from-MITM-attacks server. I have these algorithms enabled in my nginx and I'm getting an A+ on ssllabs.com but it's complaining that my cipher strength isn't 100% and ...
0
votes
1answer
53 views

What is the default behaviour, if no ciphers are enabled

Lets assume for example, that a server is configured to use TLS 1.0 and there are no ciphers enabled for it. What will be the default behaviour if a client connects to it? Will the server use any ...
1
vote
1answer
245 views

How HMAC is calculated for TLS AES_128_CBC_SHA

The RFC 5246 defines generic block cipher as follow: struct { opaque IV[SecurityParameters.record_iv_length]; ...
0
votes
1answer
136 views

Changing the public key in an MD5 certificate

Given a valid, signed X.509 certificate using the MD5 digest algorithm and an RSA public key, how feasible would it be to generate a public key which would, all other parts of the certificate being ...
0
votes
1answer
364 views

SHA2 Certificate generating (create Signed Certificate) [closed]

i was requested to write a programmer that can generate A SHA2 certificate. So i wrote a tester class to try and mimic Keytool process of generating One (referencing base of this: url https://www....
11
votes
2answers
17k views

At what stage is DHE and RSA used during the SSL/TLS handshake?

At what stage of the SSL/TLS handshake is the DHE and RSA used and what is the purpose of using a pre-master secret when you could just use RSA to exchange the symmetric key (i.e. AES) for further ...
1
vote
1answer
192 views

Can we use higher strength SHA along with lower strength RSA key in SSL?

I have noticed when the RSA public key is 2048 bit, SHA-256 bit used for signatures. When the key is 3072 bit, SHA-384 bit used. When the key is 4096 bit, SHA-512 bit used. I have tried the ...
2
votes
1answer
1k views

The number of keys generated in TLS 1.2?

In section 6.3. Key Calculation in the standard documentation here, I see the following: The master secret is expanded into a sequence of secure bytes, which is then split to a client write MAC ...
6
votes
4answers
2k views

The difference between MACs vs. HMACs vs. PRFs

I have some confusion regarding the difference between MACs and HMACs and PRFs and when to use which term. If the function is computed using a hash and secret key like the following, is this a HMAC ...
0
votes
1answer
119 views

For TLS AES_CCM mode how does CBC_MAC work when the message length is not aligned to block size?

Even after goign through lot of specs I failed to understand how CBC-MAC works, specifically in case we have message not aligned to 16 bytes. Are there any padding bytes?
1
vote
1answer
286 views

The parameters included in TLS 1.2 server signature in the ServerKeyExchange

In TLS 1.2, section 7.4.3 in the standard documentation on Server Key Exchange Message, it says that the parameters covered by ...
4
votes
1answer
2k views

Clarification needed in TLS 1.2 key derivation process

Reference to TLS 1.2 standard documentation section 6.3 regarding the key generation here: To generate the key material, compute ...
3
votes
1answer
814 views

TLS 1.3: the key_share in a ClientHello after a HelloRetryRequest

In TLS 1.3 draft-21, if there is a ClientHello with a key_share, say, $(G_1, g^x)$, the server can send a ...
2
votes
1answer
790 views

Is TLS 1.2 compression methods in client_hello a mandatory field?

As stated int he question, is compression methods list in the client_hello in TLS 1.2 a mandatory field (it is clear that it is mandatory in session_resumption, but not clear to me whether it is ...
1
vote
1answer
459 views

What is the format of the TLS extension field?

In the TLS 1.2 protocol, the client may send extensions. My question is: what is the format of this field? is it a list? In TLS 1.2 client hello, the standard says:...
16
votes
1answer
1k views

Who issued the first SSL certificate?

When SSL was introduced in ~1996, there was only a few CAs issuing certificates for that specific use and a few sites which actually used SSL. Which Certification Authority issued the first SSL ...
2
votes
2answers
899 views

TLS Finished message: is it MAC or HMAC

In several academic literature, the term Finished MACs is used frequently. I wonder, is it really a MAC or HMAC? I am looking at literature in TLS 1.2 vs. TLS 1.2 specs. The specs of TLS 1.2 Finished ...
1
vote
1answer
55 views

The correct use of the term “TLS session”

TLS consists of sub-protocols including the handshake where the key-exchange is and the record protocol. If I want to use a statement like: both parties negotiate a ciphersuite that defines the ...
3
votes
2answers
705 views

How to recognize Authenticated Encryption with Associated Data ciphersuites

I have some doubts regarding AEAD ciphersuites and I need some clarification. In the following ciphersuites list: ...
0
votes
1answer
63 views

Encrypted cerficiate signature for server certificate and intermediate certificate in packet capture

If we view the certificate chain using Firefox, we can see the certificate signature of "server certificate" and its "intermediate-CA" right after the "certificate signature algorithm" in the ...
2
votes
1answer
509 views

How to correctly evaluate the security of DH in TLS

I'm trying to understand and evaluate the security impact of DH in TLS. As far as I can tell, there are four major different implementations of DH in TLS. DH DHE ECDH ECDHE With the ephemeral DH's, ...
2
votes
1answer
629 views

How does the TLS cipher suite DHE-RSA-AES128-CCM8 work without hashing algorithm

I came across cipher suites without hashing algorithm, when inspecting the mbedTLS (previously Polar SSL) TLS cipher suite list. For example: TLS-DHE-RSA-WITH-AES-128-CCM-8 (OpenSSL: DHE-RSA-AES128-...
3
votes
2answers
2k views

Security of CCM in TLS, in comparison to GCM, SHA or SHA2 for the digest

I've been looking into TLS cipher suites of OpenSSL and mbedTLS (previously called PolarSSL) and noticed that mbedTLS supports the CCM mode of operation (See list here), whereas OpenSSL does not. If I ...
8
votes
1answer
1k views

Why would one choose DTLS-SRTP versus just RTP over DTLS?

If I understand DTLS-SRTP correctly, DTLS is used to exchange keys and then the endpoints switch to SRTP for encryption. What is the benefit of this setup versus just sending RTP over DTLS? Is it just ...
7
votes
1answer
1k views

Why was Vaudenay's original padding oracle attack not exploitable on TLS 1.0?

Reading Password Interception in a SSL/TLS Channel that was released in 2003: At Eurocrypt’02, Vaudenay presented vulnerabilities in padding schemes used for block ciphers in CBC mode. He used a ...
4
votes
1answer
3k views

DSS security in comparison to ECDSA or RSA

OpenVPN allows the users to choose the TLS cipher suite, depending on the deployed SSL/TLS library. With OpenSSL 1.0.2g and OpenVPN 2.3.11 this is a rather long list (Full list). Amongst the many ...
0
votes
1answer
795 views

Default mode of operation in TLS cipher suites

I've been trying to evaluate the security of a list of cipher suites and I've come across cipher suites, not explicitly featuring a mode of operation. Form this list (openvpn --show-tls), one of such ...
0
votes
1answer
55 views

Does any popular symmetric cipher allow for direct re-ciphering?

Let's say I have some data ciphered using key, $K_1$, in to format $D_1$, which I want to convert into format $D_2$ that can be decrypted using $K_2$. So I know $D_1, K_1$ and $K_2$. I want to ...
0
votes
1answer
65 views

Question about TLS v1.2 Ciphers on my Web Server

I need some help to understand the Ciphers being used by my web server running TLS v1.2. What I understand is that my web server is configured to use only the listed methods of encryption. I suspect ...
0
votes
1answer
277 views

Assure Integrity and authenticity

I want to assure integrity and authenticity in data sent trough a TLS channel. What are the best techniques? For integrity a hash (sha, bcrypt,...) should do the job right? And for authenticity? ...
-1
votes
1answer
241 views

Why using a nonce not more than once in SSL/TLS [duplicate]

Why it is highly recommended to use a nonce once and only once in SSL/TLS? Same question with key streams in stream ciphers? What sort of attack(s) could take place if ever a nonce/key stream is used ...
4
votes
5answers
2k views

Would this simple encrypted chat program be feasible using One Time Pads?

Lets say I want to build a simple chat program that has encryption that is impossible to crack for anyone, even a theoretical government with a massive super computer. Ok here's my idea. You'll need ...

1
3 4
5
6 7
11