Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
0
votes
2answers
101 views

Self signed certificate for mobile app and backend from same company

My company's product is Android and iOS mobile app which connects to our own backend. All interactions of the mobile app are with backend developed by our own company. In such a situation, can the ...
1
vote
1answer
344 views

Clarifications regarding ciphers and Nmap scan

I'm running the below Nmap command to test the strength of the cipher suites I have used in my host nmap -sV --script ssl-enum-ciphers -p 443 <host> The ...
9
votes
2answers
3k views

What's the difference between rsa_pss_pss_* and rsa_pss_rsae_* schemes?

I'm trying to understand the difference between rsa_pss_pss_ and rsa_pss_rsae_. The picture shows the extension of TLS1.3's ...
1
vote
1answer
90 views

Does semi-honest adversary eavesdrop honest parties communication?

Assume we have a multi-party computation protocol and the protocol definition, where both of them consider a semi-honest adversary, without explicitly assuming the type of channel the parties want to ...
1
vote
1answer
783 views

TLS 1.3: HKDF-Expand

In RFC5869 I found that the function of the HKDF-Expand on the input assumes the parameter $L$ which denotes length of output keying material in octets ($\leq 255*\text{Hash}_{Length}$), and then the $...
2
votes
0answers
165 views

What kind of RSA padding mode is it?

1: I have a HTTPS server and I added hooks in RSA decryption procedure to dump error RSA input(client key exchange). 2: I get some RSA input that I couldn't check padding successfully(It's usual) and ...
2
votes
1answer
81 views

What should be broken to break a cipher with perfect forward secrecy?

What should be broken to break a cipher with perfect forward secrecy as a passive observer? RSA/EC analog, (EC)DHE or both?
2
votes
1answer
136 views

X.509 strong authentication protocols

Is there also a protocol definition in X.509? In "Handbook of Applied Cryptography" by A. Menezes there is a reference to X.509 strong authentication protocol, nevertheless, I could not find the ...
2
votes
0answers
65 views

Are there any one-way operations that could be used for Diffie-Hellman post-quantum? (See criteria)

With quantum-computers looming, there is a need for Public Key Cryptosystems that can withstand attacks by quantum-computers. Are there any known one-way operations that fit the following criteria? ...
2
votes
2answers
4k views

Why is a Diffie-Hellman key exchange required when RSA is already being used for key exchange in TLS?

Specifically with TLS, What is RSA used for during key exchange? What is Diffie-Hellman used for? Since RSA already provides authenticity and confidentiality, why is Diffie-Hellman used during the ...
1
vote
1answer
83 views

What 32 bytes TLS data records for?

I've captured my tor client network traffic and noticed that in every packet it sends 2 TLS records first of which is always 32 bytes long. The first TLS record seems not to be carrying any data. What ...
0
votes
3answers
182 views

Is this a correct SSL explanation in layman's terms?

I'm looking to provide a basic / layman's explanation of SSLs to clients and want to be sure it is correct. My explanation is below and would appreciate any feedback / corrections. Basically, the ...
1
vote
0answers
49 views

MAC with key supplied afterwards

Looking at HMAC and KMAC it seems that the key is always required up front, i.e. before starting to process any other data. However, in many protocols the key may not be known it advance. For instance,...
2
votes
1answer
73 views

SSL and first step of handshaking

When I connect to a secure sever that has is equipped with SSL certificate. Logically, the first step is the handshake to discuss the cipher suites etc. However, the very first time my web browser ...
1
vote
1answer
6k views

IPSec vs SSL : Similarities and Differences

I am studying SSL and IPSec. I can pretty much nail down the "very high level" differences and similarities between the two, but am struggling to find a "lower level" (but not too deep) look. This ...
1
vote
1answer
472 views

How is a fake private key used in CloudHSM?

I've noticed that AWS CloudHSM uses an openssl command to generate a fake private key for web servers that offloads cryptographic functions to a CloudHSM. How does this key work? And what purpose does ...
1
vote
1answer
156 views

What does GHASH really do?

I try to understand the GCM-MODE used in TLS. The problem I have had is described below. 1:textbook describes how GHASH works: 2: I get some debuginfo from openssl code that contain enc_key(32 bytes)...
1
vote
1answer
120 views

What kind of ciphers does not depend on order of operation?

What kind of cipher does not depend on order of operation ? For Instance if we have two operations encryption Enc(m,k), decryption Dec(m,k) and some message m. For which ciphers the following is ...
2
votes
1answer
75 views

CAs are pre-loaded on the system, but how is it able to get intermediate certs?

I have the following X509 certificate: ...
3
votes
1answer
1k views

What role does RSA play in DHE_RSA cipher suite?

I've read in this article, that encrypting a premaster key with a RSA public key is not safe from forward secrecy attacks. If an adversary, records all communication between a client and a server. And ...
0
votes
1answer
1k views

What is the Peer Signing digest on an OpenSSL s_client connection?

For a little background, I am trying resolve an issue with an ISAM (reverse proxy) appliance not being able to connect to a server due to it failing to complete a TLS connection. A server that is ...
1
vote
1answer
254 views

TLS false start / early data

How often such mechanisms are used by application. Is it real requirement to support these features for TLS ?
1
vote
0answers
56 views

Custom encryption scheme for SSL

Suppose that messages transmitted over SSL are modified as follows: the message is splitted in blocks, $B_1, ..., B_m$ (each with at most $2^{14}$ bytes) for each block $B_i$ we do: ...
3
votes
2answers
1k views

TLS re-negotiation vs resumption

Please explain the difference between TLS re-negotiation and resumption. My understanding is as follows: in the context of TLS 1.2, re-negotiation and resumption look the same, but the former can be ...
1
vote
1answer
435 views

How does Naver Line PC client obtain private key for end-to-end encryption (letter-sealing)?

When I download Naver Line PC client onto my PC, a six-digit number will be shown on the PC client for me to enter the number into my Line app on my mobile phone for decrypting the old and new ...
1
vote
1answer
50 views

Tls 1.3 ClientHello legacy_session_id as zero length vector alignment

Looking at tls 1.3 draft 23: https://tools.ietf.org/html/draft-ietf-tls-tls13-23 Section 4.1.2 shows, for a freshly established connection (no previous session from tls 1.2 or earlier) the ...
3
votes
1answer
766 views

What is the difference between these two TLS suites?

I am comparing the security information of two different HTTPS connections in the Google Chrome (v63.0.3239.132) security tab in developer tools. The information for each of the two connections is ...
2
votes
1answer
974 views

Raw public keys vs PSK in TLS

Is there any advantage in using raw public keys (RFC 7250) in comparison with pre-shared keys (RFC 4279) in TLS, when I need client authentication and have an unique key per client deployed to them ...
4
votes
0answers
88 views

Implications of TLS-SRP client with improper N validation?

During development of a client side application of TLS-SRP, i noticed a bug that allows an attacker spoofing as the server to send custom, but non-arbitrary $N$ values, with the client accepting them. ...
0
votes
1answer
269 views

Interpreting the Hash type in a TLS ciphersuite

There are ciphersuites with SHA256, and SHA384. In the following TLS ciphersuite, the SHA types is not specified. Does this always refer to SHA1 (there is SHA0 as well) so which one of them? ...
0
votes
1answer
2k views

how to validate cert when signed cert has authority key id but signing cert doesn't?

Say I have the following signing cert: ...
1
vote
0answers
96 views

Does TLS 1.3 really send PSKs encrypted?

In the following link it says: When a 1.3 client connects to a 1.3 server they agree on a resumption key (or PSK, pre-shared key), and the server gives the client a Session Ticket that will help it ...
13
votes
8answers
15k views

Why is SSL on top of TCP?

Why is SSL not under TCP (the Transport layer)?
0
votes
1answer
876 views

What are the major differences between SET and SSL?

SET and SSL are usually used as secure payment protocols. What are the major differences between them? Which one is better?
4
votes
1answer
816 views

TLS Handshake with DH

I try to understand the TLS Handshake with DH. I googled the concepts and I think I understood the basics. But there are somethings I'm still struggling with. I also read the following two posts Why ...
1
vote
1answer
620 views

How does HTTPS transfer the symmetric key?

How is the server's public key used to encrypt the symmetric key in a way so that only the sever's private key can decrypt the cipher? The client uses the server’s public key to encrypt the ...
1
vote
1answer
173 views

Cut through mode for TLS AES-CBC / SHA ciphersuite

I am looking at RFC5246 and it seems that AES-CBC/SHA cipher suites cannot be implemented in a cut-through mode. Let's suppose that received record spans two segments. As i understood HMAC ...
2
votes
2answers
138 views

What data Certificate Authority encrypt for CSR?

I have been searching for a detailed explanation but can’t seem to find a low level one. 1) When CA sign the data with its private key, the encrypted data is APPENED to the csr or the whole cert ...
0
votes
1answer
211 views

Digital certificate issuing man-in-the-middle attack

While obtaining digital certificate the applicant trusts the certificate authority (or registering authority) as CA is digitally certified (and applicant has CA's public key). To certify a domain ...
-2
votes
2answers
744 views

How does registration authority verify entity's identity for SSL? [closed]

In the answer here: Verification of identity by certification authority, it states that for European eIdentity you must provide your passport or ID card, but that this practice is quite different ...
34
votes
3answers
7k views

Why was AES CBC removed in TLS 1.3?

I don't quite understand why AES CBC was removed in TLS1.3 . from what I know CBC is the most secure Mode of operation for the AES block cipher ( if you can say it like that ) It only needs a TRND IV ...
0
votes
1answer
358 views

What order should these HTTPS ciphers go in to maximize security?

I want to set up a very secure-from-MITM-attacks server. I have these algorithms enabled in my nginx and I'm getting an A+ on ssllabs.com but it's complaining that my cipher strength isn't 100% and ...
0
votes
1answer
42 views

What is the default behaviour, if no ciphers are enabled

Lets assume for example, that a server is configured to use TLS 1.0 and there are no ciphers enabled for it. What will be the default behaviour if a client connects to it? Will the server use any ...
1
vote
1answer
232 views

How HMAC is calculated for TLS AES_128_CBC_SHA

The RFC 5246 defines generic block cipher as follow: struct { opaque IV[SecurityParameters.record_iv_length]; ...
0
votes
1answer
130 views

Changing the public key in an MD5 certificate

Given a valid, signed X.509 certificate using the MD5 digest algorithm and an RSA public key, how feasible would it be to generate a public key which would, all other parts of the certificate being ...
0
votes
1answer
331 views

SHA2 Certificate generating (create Signed Certificate) [closed]

i was requested to write a programmer that can generate A SHA2 certificate. So i wrote a tester class to try and mimic Keytool process of generating One (referencing base of this: url https://www....
36
votes
2answers
24k views

Is Triple DES still considered safe to use?

What it says on the tin. Is it still used in things like TLS?
1
vote
1answer
142 views

Can we use higher strength SHA along with lower strength RSA key in SSL?

I have noticed when the RSA public key is 2048 bit, SHA-256 bit used for signatures. When the key is 3072 bit, SHA-384 bit used. When the key is 4096 bit, SHA-512 bit used. I have tried the ...
0
votes
1answer
107 views

For TLS AES_CCM mode how does CBC_MAC work when the message length is not aligned to block size?

Even after goign through lot of specs I failed to understand how CBC-MAC works, specifically in case we have message not aligned to 16 bytes. Are there any padding bytes?
4
votes
1answer
359 views

TLS AES_XXX_CCM mode of operation is encrypt-then-mac or mac-then-encrypt?

There are number of definitions completely confusing me. in https://en.wikipedia.org/wiki/CCM_mode we have "As the name suggests, CCM mode combines the well known CBC-MAC with the well known counter ...

1 2 3 4 5 10