Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
5
votes
1answer
5k views

Elliptic Curve SSL performance: ECDHE and/or ECDSA?

I have a question about the performance benefits (in terms of server-side CPU load) of ECC (Elliptic Curve cryptography) cipher suites in SSL/TLS. It is a known fact that ECC is very good for ...
48
votes
1answer
76k views

What is the difference between .pem , .csr , .key and .crt?

I'm new to SSL / TLS and I want to work with the OpenSSL toolkit. I don't know what .pem and .csr stands for? I do know that <...
2
votes
1answer
197 views

TLS with NULL chipersuite [closed]

In the case of using a cipher suite with all algorithms NULL e.g.: TLS_NULL_WITH_NULL_NULL the protection against replay, swapping and filtering is guaranteed? (I am talking about message protection, ...
0
votes
1answer
78 views

SSL 2.0 Finished Message

Reference to SSL 2.0 specs. from: Mozilla - SSL 2.0 Can I conclude that SSL 2.0 Finish messages does not provide AMC for all the messages sent/received by both parties (as in TLS 1.2)? Due to lack of ...
1
vote
1answer
883 views

How is pre-master secret encrypted when ECC is used?

The certificate used in https://de.wikipedia.org/wiki/Authenticated_Encryption has public key ECC public key parameter ECDSA key usage digital signature It is used to setup a secure TLS connection. ...
4
votes
1answer
241 views

Combination of TLS_PSK and TLS False Start

I am evaluating the use of TLS 1.2 for a low powered embedded environment. After looking at RFC 7925 (TLS for IoT) I was wondering if the combination of the TLS_PSK_WITH_AES_128_CCM_8 cipher suite (...
1
vote
1answer
387 views

Certificate Verify in SSLv3

I'm trying to figure out the SSLv3 protocol for educational purposes and having hard time understanding mutual certificate authentication. When the client requested to provide a certificate it also ...
3
votes
3answers
384 views

Does the Shappening mean HTTPS can be broken?

For years we've been warned that SHA-1 is weaker than originally thought and should not be used. This reached its peak with the Shappening and experts from Schneier on down have been warning that we ...
15
votes
4answers
10k views

Best choice out of these six TLS cipher suites

I have a small embedded platform that supports 6 TLS ciphers. Is there a good/better/best one to chose? I was looking around on the web for some kind of rating system or list of ciphers that have ...
3
votes
1answer
84 views

When a client connects to a SSL/TLS encrypted server it hashes the certificate, right?

This is a very basic question about hashing: When a client connects to a SSL/TLS encrypted server it hashes the certificate, right? So, an attacker could steal the public certificate in the transfer ...
0
votes
1answer
142 views

Is the RC4 KSA the same as an extractor?

I am studying the RC4 stream cipher, particularly when it used to be applied in the TLS/SSL protocol. Is it safe to say the KSA acts like an extractor taking in the shared secret key, k (between ...
2
votes
3answers
6k views

How is session key generated for TLS?

I would like to understand better what happens during establishment of SSL/TLS secure connection. The Client wants to establish a connection - ClientHello The server answers with a ServerHello. This ...
21
votes
2answers
40k views

What's the difference between RSA and Diffie-Hellman? [duplicate]

I've been reading on a lot of websites that same thing: RSA is for communication using the public and private key for both the server and client, where Diffie-Hellman is just for exchanging the same ...
0
votes
2answers
327 views

PKPA to Supercede TLS/AES etc?

I wont give the name of the company, but here's a quote from a white paper they published: Our innovative Polymorphic Key Progression Algorithm (PKPA) technology is designed to overcome the flaws ...
3
votes
1answer
251 views

How does the GCM encryption limit affect TLS connections?

According to the Wikipedia article on Galois/Counter Mode, GCM is limited to encrypting $2^{39} − 256$ bits of plain text (64 GiB) for any given key and initialization vector. In light of this limit, ...
0
votes
2answers
138 views

Akamai's Legacy SSL/TLS Cipher Profiles

I'm conducting a research regarding CDN security, and have noticed that in the following document https://community.akamai.com/docs/DOC-5175 A cipher suite named "ak-akamai-pfs-supported" includes the ...
2
votes
1answer
948 views

TLS handshake proof of private key posession

At what stage in below TLS connection setup did the server prove to client that it possesses the private key corresponding to its public RSA key. I have used TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 ...
2
votes
1answer
190 views

Why don't I see the IV in the FINISHED fragment in TLS_RSA_WITH_AES_256_CBC_SHA communication with OpenSSL?

I'm implementing a TLS 1.2 server, comparing against OpenSSL to ensure I'm getting things right, and I've noticed that when the cipher is TLS_RSA_WITH_AES_256_CBC_SHA the IV isn't in the FINISH ...
1
vote
1answer
566 views

Key Generation for TOTP in TLS

So lately I've been studying the TLS Protocol. In particular, going through RFC 2246, section 7.4.7.1, i.e, RSA Encrypted Premaster Secret Message, I encountered: If RSA is being used for key ...
2
votes
2answers
1k views

ECDHE generates a key pair?

From my understanding of the basic Diffie Hellman scheme, the final result is 1 key that is known to both sides and now can be used for symmetric encryption. From my understanding of ECDHE-RSA scheme ...
3
votes
1answer
2k views

Understanding the signature and hashing algorithms in TLS connection debug output

I have an application using TLSv1.2 for communication. I use the option -Djavax.net.debug=all ...
2
votes
1answer
3k views

Why do the majority of SSL cipher suite used CBC?

I am looking at a wireshark capture of the cipher suites sent by my browser to the server during an SSL handshake; however, almost 90% of them use CBC, with 2 or 3 having GCM. Why is CBC most used? ...
4
votes
1answer
717 views

Is using the same HTTPS cipher suite as Google a good idea?

I'm searching for a cipher suite for my HTTPS website, running on the Apache 2 web server, that would offer a good compromise between compatibility with users and security. One idea I had was to ...
0
votes
1answer
92 views

What happens if I remove client certificate from TLS

If I have a TLS authentication process between two entities A and B, like the one outlined below, what would happen to it, if I remove the client's (A) certificate from it? In this case, the ...
6
votes
1answer
932 views

What is the purpose of the “Explicit Nonce” in TLS for AES-GCM and AES-CCM?

TLS uses an explicit (secret) 32-bit nonce in combination with the 64-bit sequence number to create the IV for AES-GCM and the nonce for AES-CCM. However, I wonder why TLS needs the explicit nonce. ...
1
vote
1answer
73 views

Can you type your own keys?

Instead of generating keys, is it possible to type your own? For example, could all the characters be A's for example sake. Or do they have to be generated because they are based off of prime numbers ...
0
votes
1answer
101 views

Is there a way to inercept encrypted https connections by mimicking a cert authority?

In this video, it is shown how encryption can be theoretically intercepted without the client noticing it. In short something in between the connection could make a handshake with the requested ...
4
votes
1answer
827 views

How to handle entropy and CTR DRBG for TLS on embedded system?

I am trying to use mbedTLS on a STM32-Nucleo microcontroller (STM32F746). The TLS library wants a RNG function (naturaly), the STM32 has a hardware RNG verified according to NIST SP 800-22. The ...
1
vote
3answers
3k views

Public key encryption and message integrity

Let's say I want to send an encrypted email thus I encrypt it with the receiver's public key, so that the receiver uses its private key to decrypt it. If someone tampers with the message in between ...
7
votes
1answer
383 views

Detection of weak keys for AES-GCM

There are many papers out there that show that a message authenticated and encrypted by AES-GCM can be forged if the used key is weak (e.g. by Handschuh and Preneel, Saarinen or Procter and Cid). With ...
0
votes
2answers
318 views

What is the hash of this cipher: TLS_RSA_WITH_AES_128_CCM

In TLS 1.3 supported ciphersuite, I find the following ciphersuite: TLS_RSA_WITH_AES_128_CCM Can any one tell me what is the hash function used in this ciphersuite? how could you know that (...
1
vote
1answer
411 views

Does RC4 continue to be used anywhere?

RC4 in TLS is now broken. But the breaking seems to have a lot to do with how web transactions work in general. Is there any application outside of the web where RC4 is still used? I know that WEP is ...
4
votes
1answer
1k views

Random Bytes in TLS Handshake

During the TLS handshake, there are random bytes sent from the server to the client and random bytes sent from the client to the server. Since these bytes are sent in clear text, what is the ...
0
votes
1answer
273 views

Is there a TLS extension for generating unique IVs for AES GCM?

Since reusing IVs is death for AES GCM, it seems like using the fixed IV in the TLS connection state is a phenomenally bad idea. It wouldn't even seem to be a good idea to use the salt + counter ...
2
votes
1answer
275 views

What is the structure of a Server Key Exchange Message structure when using a psk identity hint?

I need to know the structure of a server key exchange message when using a psk identity hint. I know the general structure but I can't find an example of where the identity hint fits in. Thanks.
1
vote
0answers
30 views

How long is the tag T in AES-GCM(Or: Can implementations freely choose t = len(T)?) [duplicate]

I've started to learn about GCM. In the paper I read on page 4 there is the equation: $$ T = \text{MSB}_t(\text{GHASH}(H, A, C) \oplus E(K, Y_0)) $$ It's clear to me that the function $\text{MSB}_t(S)...
2
votes
1answer
437 views

When is AES chosen instead of a stream Cipher (e.g., RC4) during an SSL connection?

During an SSL handshake, the browser sends a list of cipher suites to the server, from which the server selects one option. For data encryption, two of the several possibilities for the ciphers in ...
0
votes
1answer
711 views

What is Group in Diffie-Hellman?

I understand how Diffie-Hellman key-exchange works. Mainly, two parties agrees in a prime $p$ and a generator $g$. Then one party selects its private exponenet $x$, computes its public value $g^x \...
1
vote
1answer
85 views

Clarification on Key exchange approaches in TLS/SSL

When RSA is used for key exchange in SSL, the client basically encrypts some random data using the server's public key and and sends it to the server. This data is then used to compute the shared key ...
2
votes
1answer
159 views

Can you help me understand some details about the attack using SSL3 POODLE bytes?

I have read some articles or books (e.g., “Bulletproof SSL and TLS”) about POODLE, but they still don't answer my questions – which are: From https://www.openssl.org/~bodo/ssl-poodle.pdf, ...
2
votes
3answers
201 views

DIY message level security?

This might be in danger of being too elementary a question for this community but I'm hoping for expert help: Assuming that TLS is not enough to protect messages transmitted between a client and a ...
2
votes
2answers
173 views

Layman's description of the padding oracle attack

I understand that the MAC-then-encrypt approach is susceptible to several attacks including the so called padding oracle attack. I understand that in this attack the attacker modifies the padding and ...
1
vote
1answer
10k views

Secure Cipher Suites supported by JDK versions [closed]

I'm a n00b to cryptography. I've been searching through oracle's java docs, ssl labs, googling and more googling attempting to find an up to date list of cipher suites considered secure for the ...
2
votes
0answers
719 views

Why SSH does not use a certificate authority in the same way as SSL [closed]

SSL requires the use of a trusted third party -- the certificate authority to verify a public key presented by a server to a client. SSH on the other hand relies on the client having the server's ...
2
votes
1answer
534 views

Am I correctly understanding TLS 1.2 PRF (Pseudorandom Function)?

According to RFC 5246 Section 5 PRF(secret, label, seed) = P_<hash>(secret, label + seed) and ...
2
votes
1answer
119 views

Insecure third party connection

My organization processes some PII data and shares it with an outbound connection (outflow only) that is a third party. The data transfer transactions occur without human intervention. That outbound ...
2
votes
0answers
13 views

How to decrypt SSL data on a considered-to-be-compromised host? [closed]

I have a package which I want to encrypt on my machine and send it to another remote machine. If I use asymmetric encryption, I must have the private key on the remote side. However, I don't trust the ...
1
vote
1answer
775 views

Size of Pre-Master Secret?

I am implementing TLS 1.2 and using cipher ECDHE_RSA_WITH_AES_128_GCM_SHA256 According to RFC 5346 Section 8.1 length of premaster secret will vary depending on key exchange method. So, what is the ...
2
votes
1answer
157 views

DTLS 1.2 Key Expansion

I am using DTLS 1.2 and my cipher is TLS_ECDHE_WITH_AES_128_GCM_SHA256 According to RFC 5246(RFC 5246 key calculation) i am calculating keys but i can not find the size of these keys in this RFC. ...
1
vote
0answers
134 views

DTLS 1.2 Finished message

I am implementing DTLS 1.2 and using ECDHE_RSA_AES_128_GCM_SHA256 cipher suit. Below is my client finished message Can anyone explain this message? How many bytes for verify data? Is there ...