Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
3
votes
1answer
576 views

TLS 1.3: the key_share in a ClientHello after a HelloRetryRequest

In TLS 1.3 draft-21, if there is a ClientHello with a key_share, say, $(G_1, g^x)$, the server can send a ...
15
votes
1answer
812 views

Who issued the first SSL certificate?

When SSL was introduced in ~1996, there was only a few CAs issuing certificates for that specific use and a few sites which actually used SSL. Which Certification Authority issued the first SSL ...
1
vote
1answer
55 views

The correct use of the term “TLS session”

TLS consists of sub-protocols including the handshake where the key-exchange is and the record protocol. If I want to use a statement like: both parties negotiate a ciphersuite that defines the ...
1
vote
1answer
327 views

What is the format of the TLS extension field?

In the TLS 1.2 protocol, the client may send extensions. My question is: what is the format of this field? is it a list? In TLS 1.2 client hello, the standard says:...
3
votes
2answers
610 views

How to recognize Authenticated Encryption with Associated Data ciphersuites

I have some doubts regarding AEAD ciphersuites and I need some clarification. In the following ciphersuites list: ...
0
votes
1answer
59 views

Encrypted cerficiate signature for server certificate and intermediate certificate in packet capture

If we view the certificate chain using Firefox, we can see the certificate signature of "server certificate" and its "intermediate-CA" right after the "certificate signature algorithm" in the ...
1
vote
1answer
418 views

How to correctly evaluate the security of DH in TLS

I'm trying to understand and evaluate the security impact of DH in TLS. As far as I can tell, there are four major different implementations of DH in TLS. DH DHE ECDH ECDHE With the ephemeral DH's, ...
2
votes
1answer
438 views

How does the TLS cipher suite DHE-RSA-AES128-CCM8 work without hashing algorithm

I came across cipher suites without hashing algorithm, when inspecting the mbedTLS (previously Polar SSL) TLS cipher suite list. For example: TLS-DHE-RSA-WITH-AES-128-CCM-8 (OpenSSL: DHE-RSA-AES128-...
2
votes
2answers
1k views

Security of CCM in TLS, in comparison to GCM, SHA or SHA2 for the digest

I've been looking into TLS cipher suites of OpenSSL and mbedTLS (previously called PolarSSL) and noticed that mbedTLS supports the CCM mode of operation (See list here), whereas OpenSSL does not. If I ...
8
votes
1answer
868 views

Why would one choose DTLS-SRTP versus just RTP over DTLS?

If I understand DTLS-SRTP correctly, DTLS is used to exchange keys and then the endpoints switch to SRTP for encryption. What is the benefit of this setup versus just sending RTP over DTLS? Is it just ...
7
votes
1answer
906 views

Why was Vaudenay's original padding oracle attack not exploitable on TLS 1.0?

Reading Password Interception in a SSL/TLS Channel that was released in 2003: At Eurocrypt’02, Vaudenay presented vulnerabilities in padding schemes used for block ciphers in CBC mode. He used a ...
0
votes
1answer
675 views

Default mode of operation in TLS cipher suites

I've been trying to evaluate the security of a list of cipher suites and I've come across cipher suites, not explicitly featuring a mode of operation. Form this list (openvpn --show-tls), one of such ...
4
votes
1answer
2k views

DSS security in comparison to ECDSA or RSA

OpenVPN allows the users to choose the TLS cipher suite, depending on the deployed SSL/TLS library. With OpenSSL 1.0.2g and OpenVPN 2.3.11 this is a rather long list (Full list). Amongst the many ...
0
votes
1answer
53 views

Does any popular symmetric cipher allow for direct re-ciphering?

Let's say I have some data ciphered using key, $K_1$, in to format $D_1$, which I want to convert into format $D_2$ that can be decrypted using $K_2$. So I know $D_1, K_1$ and $K_2$. I want to ...
0
votes
1answer
235 views

Assure Integrity and authenticity

I want to assure integrity and authenticity in data sent trough a TLS channel. What are the best techniques? For integrity a hash (sha, bcrypt,...) should do the job right? And for authenticity? ...
0
votes
1answer
61 views

Question about TLS v1.2 Ciphers on my Web Server

I need some help to understand the Ciphers being used by my web server running TLS v1.2. What I understand is that my web server is configured to use only the listed methods of encryption. I suspect ...
8
votes
3answers
596 views

Why does TLS 1.3 use random-looking nonces for AEAD?

In TLS 1.3, it seems that nonces for AEAD are constructed by XORing the recorded sequence number with the server/client_write_IV (which is generated during the handshake). Thus, nonces are random-...
-1
votes
1answer
213 views

Why using a nonce not more than once in SSL/TLS [duplicate]

Why it is highly recommended to use a nonce once and only once in SSL/TLS? Same question with key streams in stream ciphers? What sort of attack(s) could take place if ever a nonce/key stream is used ...
0
votes
2answers
515 views

Why is a certificate needed at client side

I was wondering why you need a certificate of the server at client side. Can't you just fetch it from the CA itself? I am using mbedtls to program some small client, and in all the client examples ...
4
votes
1answer
101 views

Does DTLS Change_Cipher re-transmission use same epoch as original one or the new one?

DTLS endpoints are required to re-transmit the entire flight of handshake messages in case there is a timeout. Before timeout event, the transmit epoch can change at record protocol. Which epoch is ...
1
vote
1answer
53 views

Are applications aware of data records received before and after tls rehandshake?

It seems that a tls endpoint can pump more data records even when it has received a re-handshake request from peer. Also in dtls, new data records would get accepted even while rehandshake is in ...
1
vote
1answer
233 views

Why TLS uses in-band handshake signalling

TLS uses handshake protocol to compute session keys to be used later to protect bulk of application data transfer. The handshake protocol and application protocol uses same transport layer port. ...
2
votes
1answer
609 views

TLS: Does Diffie-Hellman make private keys useless

When we are using TLS these days we use DH to establish a session key. So where in the TLS protocol do we determine that the host that we're talking to actually possesses the private key corresponding ...
5
votes
1answer
824 views

Is TLS finished message encryption at record protocol redundant?

TLS finished message is encrypted under the record protocol's current cipher state. Being able to authenticate FINISHED message at record protocol proves that the genuineness of peer endpoint. ...
0
votes
1answer
237 views

Verify authenticity of TLS/HTTPS communication

I have a question regarding https/tls. Lets say a client requests a website from a server via https. The client stores the entire traffic and his secrets to disk. Can i afterwards verify the ...
4
votes
1answer
1k views

TLS1.3 encrypted handshake

I read that TLS 1.3 supports encrypted handshake. Is it achieved using encrypted_extensions? Does it mean that the records which contains handshake messages are encrypted/protected from the point of ...
2
votes
0answers
66 views

TLS handshake parallelization

As I understand, during TLS handshake phase, it is not legal for an endpoint to send its own handshake messages till the time it processes its peer's entire flight of messages completely. E.g. ...
4
votes
1answer
212 views

Authentication in TLS protocol

TLS session keys are derived as a result of authenticated key agreement. Is being able to decrypt a record at an endpoint after receiving change_cipher_spec sufficient guarantee that the endpoint is ...
2
votes
0answers
313 views

Why TLS finished handshake message contains hash of handshake messages

TLS handshake message FINISHED contains a PRF computation using master secret over hash of handshake messages exchanged so far. The application data records can flow only after the TLS endpoint has ...
-1
votes
1answer
134 views

Use of extra AES on top of SSL protocol [closed]

A client is communicating with a server through https, which should provide them with the security they need. I would like to add an extra layer of security. The protocol would look something like : ...
0
votes
1answer
278 views

Security of RSA Keys in OpenSSL

So when genrating a private key / or key pair in OpenSSL ther is the -nodes tag to deactivate the encryption of the private key . i looked it up and It means "no DES" . So no DES is used . Why is DES ...
3
votes
1answer
156 views

BEAST Attack: from guessing to decoding

I understood the XOR trick that allows an attacker to guess a block of a previously sent message from the client to the server: the attacker forces the client to send the message $\tilde{m} = c_n \...
1
vote
1answer
892 views

ECC certificate works with all browsers and ssl labs- but not chrome [closed]

I have an https implementation, using mbedtls. I have installed two certificate - one is a plain RSA 2048 bit certificate, and another is an ECC 256 bit certificate. I can connect using all browsers -...
5
votes
1answer
1k views

TLS 1.2 PRF with HMAC-SHA256

I am implementing support for TLS 1.2 for the IBM mainframe operating system z/VSE in Assembler language, but am having difficultly getting the PRF to work. I am validating with the values described ...
0
votes
2answers
604 views

Best approach for storing private key

I'm working on a web service application which uses a self signed certificate. I apologize up front if this turns to be a dumb question. When using openssl for generating private key, it reveals (as ...
1
vote
1answer
802 views

TLS Key Exchange content in DHE vs. ECDHE

When the key exchnage is DHE, the server key exchange message contains the key paramteres: g^y (the server's public DHE value), g, p. Can you clarify to me what is the server key exchange content if ...
0
votes
1answer
412 views

Can you explain what is whitelisting in TLS False Start

In TLS clinet false start mechanism, the standard says the following: The symmetric cipher defined by the cipher suite negotiated in this handshake has been ...
2
votes
0answers
113 views

CRIME - attack TLS compression

In the CRIME attack slides at the Ekoparty presentation (where it was first introduced), I didn't get something. In slides 32-35 ( https://www.ekoparty.org/archive/2012/CRIME_ekoparty2012.pdf ) When ...
2
votes
1answer
491 views

Cipher suite priority

I've been tasked with defining a list of cipher suites to use. The requirements for the cipher suites are the following: Symmetric Algorithm: AES-256 Key Exchange: ECDH P-384, DH 3072-bit, RSA ...
2
votes
1answer
324 views

Clinet's nonce in TLS

In TLS, both client and server send nonces int heir hello messages. How the server identify whether the client hello is replayed or not? does the server maintain cach of previous nonce? for how long? ...
-2
votes
1answer
94 views

Is this cryptographically secure?

If I securely (manually) give/put two computer (Alice and Bob) a secret key, they can securely communicate to each other (?) Alice encrypt a message (maxlength = secret key length) and send it to Bob,...
1
vote
1answer
86 views

TLS-conformant ciphertexts and SSLv2-conformant ciphertexts for Blechenbacher attack for DROWN attack

This is regarding the published paper on the DROWN attack (https://drownattack.com/drown-attack-original-report.pdf) It was mentioned in the paper that for TLS, RSA PKCS#1 v1.5 is used to encapsulate ...
4
votes
1answer
76 views

Why are some websites seemingly immune to self-signed certificate MitM attacks?

I recently did an experiment using MitM to gain account information (username and password) while accessing websites. I used two PCs in the scenario; one as the target, running Internet Explorer, and ...
3
votes
1answer
91 views

How can I validate a given Server-Certificate behind a HTTPS-connection?

I know more or less about how TLS works in principle. But how can I be sure, that the certificate behind a server's web site (e.g. tele-banking from my bank) has been issued to my bank and not to ...
2
votes
1answer
279 views

ClientKeyExchange in static DH

I am confused about the content of ClientKeyExchange in case if the key-exchange is static DH. The TLS 1.2 standard says under section 7.4.7 in https://tools.ietf.org/html/rfc5246#page-57: If the ...
4
votes
1answer
313 views

Can the TLS 1.3 PSK-DHE handshake be turned into a PAKE?

Recently, we had the question whether there's a PAKE that uses more standard, higher-level primitives than what SRP offers. Now this made me think and ask myself: TLS does have a PSK mode, can't we ...
1
vote
1answer
4k views

What is a pre-shared key in TLS/SSL and why does master key is not used instead of session key?

i have understood the SSL handshake flow .The confusion are - What is the pre-shared key here ? Is it the pre-master key or it is the random number that is generated by server and client.? 2.I get ...
3
votes
1answer
313 views

What kind of data is appended to the message encrypted in AES128-CBC?

I'm currently using wireshark to analyse TLSv1 traffic. I generate the traffic to an Apache (OpenSSL) using the following java (jdk 6) code : ...
2
votes
1answer
260 views

CBC Padding Oracle in SSL3. Why only in SSL3 not in TLS1,TLS1.1, etc

I read about PODDLE attack which downgrades the TLS version to SSL 3.0 to exploit CBC padding oracle attack. I looked at the specs for TLS 1.1 And found CBC is still used in its ciphersuites. Why is ...
1
vote
1answer
1k views

What is actual difference between POODLE and BEAST?

I know that both attacks are based on the fact that the cipher used for communication is block cipher with CBC mode of operation and that is vulnerable because of predictable IV. Furthermore the ...