Questions tagged [tls]
SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.
471
questions
5
votes
1answer
5k views
Elliptic Curve SSL performance: ECDHE and/or ECDSA?
I have a question about the performance benefits (in terms of server-side CPU load) of ECC (Elliptic Curve cryptography) cipher suites in SSL/TLS.
It is a known fact that ECC is very good for ...
48
votes
1answer
76k views
What is the difference between .pem , .csr , .key and .crt?
I'm new to SSL / TLS and I want to work with the OpenSSL toolkit.
I don't know what .pem and .csr stands for?
I do know that <...
2
votes
1answer
197 views
TLS with NULL chipersuite [closed]
In the case of using a cipher suite with all algorithms NULL e.g.: TLS_NULL_WITH_NULL_NULL the protection against replay, swapping and filtering is guaranteed?
(I am talking about message protection, ...
0
votes
1answer
78 views
SSL 2.0 Finished Message
Reference to SSL 2.0 specs. from: Mozilla - SSL 2.0
Can I conclude that SSL 2.0 Finish messages does not provide AMC for all the messages sent/received by both parties (as in TLS 1.2)? Due to lack of ...
1
vote
1answer
883 views
How is pre-master secret encrypted when ECC is used?
The certificate used in https://de.wikipedia.org/wiki/Authenticated_Encryption
has
public key ECC
public key parameter ECDSA
key usage digital signature
It is used to setup a secure TLS connection.
...
4
votes
1answer
241 views
Combination of TLS_PSK and TLS False Start
I am evaluating the use of TLS 1.2 for a low powered embedded environment.
After looking at RFC 7925 (TLS for IoT) I was wondering if the combination of
the TLS_PSK_WITH_AES_128_CCM_8 cipher suite (...
1
vote
1answer
387 views
Certificate Verify in SSLv3
I'm trying to figure out the SSLv3 protocol for educational purposes and having hard time understanding mutual certificate authentication.
When the client requested to provide a certificate it also ...
3
votes
3answers
384 views
Does the Shappening mean HTTPS can be broken?
For years we've been warned that SHA-1 is weaker than originally thought and should not be used. This reached its peak with the Shappening and experts from Schneier on down have been warning that we ...
15
votes
4answers
10k views
Best choice out of these six TLS cipher suites
I have a small embedded platform that supports 6 TLS ciphers. Is there a good/better/best one to chose?
I was looking around on the web for some kind of rating system or list of ciphers that have ...
3
votes
1answer
84 views
When a client connects to a SSL/TLS encrypted server it hashes the certificate, right?
This is a very basic question about hashing: When a client connects to a SSL/TLS encrypted server it hashes the certificate, right?
So, an attacker could steal the public certificate in the transfer ...
0
votes
1answer
142 views
Is the RC4 KSA the same as an extractor?
I am studying the RC4 stream cipher, particularly when it used to be applied in the TLS/SSL protocol.
Is it safe to say the KSA acts like an extractor taking in the shared secret key, k (between ...
2
votes
3answers
6k views
How is session key generated for TLS?
I would like to understand better what happens during establishment of SSL/TLS secure connection.
The Client wants to establish a connection - ClientHello
The server answers with a ServerHello. This ...
21
votes
2answers
40k views
What's the difference between RSA and Diffie-Hellman? [duplicate]
I've been reading on a lot of websites that same thing: RSA is for communication using the public and private key for both the server and client, where Diffie-Hellman is just for exchanging the same ...
0
votes
2answers
327 views
PKPA to Supercede TLS/AES etc?
I wont give the name of the company, but here's a quote from a white paper they published:
Our innovative Polymorphic Key Progression Algorithm (PKPA) technology is designed to overcome the flaws ...
3
votes
1answer
251 views
How does the GCM encryption limit affect TLS connections?
According to the Wikipedia article on Galois/Counter Mode, GCM is limited to encrypting $2^{39} − 256$ bits of plain text (64 GiB) for any given key and initialization vector. In light of this limit, ...
0
votes
2answers
138 views
Akamai's Legacy SSL/TLS Cipher Profiles
I'm conducting a research regarding CDN security, and have noticed that in the following document https://community.akamai.com/docs/DOC-5175
A cipher suite named "ak-akamai-pfs-supported" includes the ...
2
votes
1answer
948 views
TLS handshake proof of private key posession
At what stage in below TLS connection setup did the server prove to client that it possesses the private key corresponding to its public RSA key.
I have used TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
...
2
votes
1answer
190 views
Why don't I see the IV in the FINISHED fragment in TLS_RSA_WITH_AES_256_CBC_SHA communication with OpenSSL?
I'm implementing a TLS 1.2 server, comparing against OpenSSL to ensure I'm getting things right, and I've noticed that when the cipher is TLS_RSA_WITH_AES_256_CBC_SHA the IV isn't in the FINISH ...
1
vote
1answer
566 views
Key Generation for TOTP in TLS
So lately I've been studying the TLS Protocol. In particular, going through RFC 2246, section 7.4.7.1, i.e, RSA Encrypted Premaster Secret Message, I encountered:
If RSA is being used for key ...
2
votes
2answers
1k views
ECDHE generates a key pair?
From my understanding of the basic Diffie Hellman scheme, the final result is 1 key that is known to both sides and now can be used for symmetric encryption.
From my understanding of ECDHE-RSA scheme ...
3
votes
1answer
2k views
Understanding the signature and hashing algorithms in TLS connection debug output
I have an application using TLSv1.2 for communication. I use the option -Djavax.net.debug=all
...
2
votes
1answer
3k views
Why do the majority of SSL cipher suite used CBC?
I am looking at a wireshark capture of the cipher suites sent by my browser to the server during an SSL handshake; however, almost 90% of them use CBC, with 2 or 3 having GCM.
Why is CBC most used? ...
4
votes
1answer
717 views
Is using the same HTTPS cipher suite as Google a good idea?
I'm searching for a cipher suite for my HTTPS website, running on the Apache 2 web server, that would offer a good compromise between compatibility with users and security. One idea I had was to ...
0
votes
1answer
92 views
What happens if I remove client certificate from TLS
If I have a TLS authentication process between two entities A and B, like the one outlined below, what would happen to it, if I remove the client's (A) certificate from it? In this case, the ...
6
votes
1answer
932 views
What is the purpose of the “Explicit Nonce” in TLS for AES-GCM and AES-CCM?
TLS uses an explicit (secret) 32-bit nonce in combination with the 64-bit sequence number to create the IV for AES-GCM and the nonce for AES-CCM. However, I wonder why TLS needs the explicit nonce.
...
1
vote
1answer
73 views
Can you type your own keys?
Instead of generating keys, is it possible to type your own? For example, could all the characters be A's for example sake. Or do they have to be generated because they are based off of prime numbers ...
0
votes
1answer
101 views
Is there a way to inercept encrypted https connections by mimicking a cert authority?
In this video, it is shown how encryption can be theoretically intercepted without the client noticing it.
In short something in between the connection could make a handshake with the requested ...
4
votes
1answer
827 views
How to handle entropy and CTR DRBG for TLS on embedded system?
I am trying to use mbedTLS on a STM32-Nucleo microcontroller (STM32F746).
The TLS library wants a RNG function (naturaly), the STM32 has a hardware RNG verified according to NIST SP 800-22.
The ...
1
vote
3answers
3k views
Public key encryption and message integrity
Let's say I want to send an encrypted email thus I encrypt it with the receiver's public key, so that the receiver uses its private key to decrypt it.
If someone tampers with the message in between ...
7
votes
1answer
383 views
Detection of weak keys for AES-GCM
There are many papers out there that show that a message authenticated and encrypted by AES-GCM can be forged if the used key is weak (e.g. by Handschuh and Preneel, Saarinen or Procter and Cid). With ...
0
votes
2answers
318 views
What is the hash of this cipher: TLS_RSA_WITH_AES_128_CCM
In TLS 1.3 supported ciphersuite, I find the following ciphersuite:
TLS_RSA_WITH_AES_128_CCM
Can any one tell me what is the hash function used in this ciphersuite? how could you know that (...
1
vote
1answer
411 views
Does RC4 continue to be used anywhere?
RC4 in TLS is now broken. But the breaking seems to have a lot to do with how web transactions work in general. Is there any application outside of the web where RC4 is still used? I know that WEP is ...
4
votes
1answer
1k views
Random Bytes in TLS Handshake
During the TLS handshake, there are random bytes sent from the server to the client and random bytes sent from the client to the server.
Since these bytes are sent in clear text, what is the ...
0
votes
1answer
273 views
Is there a TLS extension for generating unique IVs for AES GCM?
Since reusing IVs is death for AES GCM, it seems like using the fixed IV in the TLS connection state is a phenomenally bad idea. It wouldn't even seem to be a good idea to use the salt + counter ...
2
votes
1answer
275 views
What is the structure of a Server Key Exchange Message structure when using a psk identity hint?
I need to know the structure of a server key exchange message when using a psk identity hint. I know the general structure but I can't find an example of where the identity hint fits in. Thanks.
1
vote
0answers
30 views
How long is the tag T in AES-GCM(Or: Can implementations freely choose t = len(T)?) [duplicate]
I've started to learn about GCM. In the paper I read on page 4 there is the equation:
$$
T = \text{MSB}_t(\text{GHASH}(H, A, C) \oplus E(K, Y_0))
$$
It's clear to me that the function $\text{MSB}_t(S)...
2
votes
1answer
437 views
When is AES chosen instead of a stream Cipher (e.g., RC4) during an SSL connection?
During an SSL handshake, the browser sends a list of cipher suites to the server, from which the server selects one option.
For data encryption, two of the several possibilities for the ciphers in ...
0
votes
1answer
711 views
What is Group in Diffie-Hellman?
I understand how Diffie-Hellman key-exchange works. Mainly, two parties agrees in a prime $p$ and a generator $g$. Then one party selects its private exponenet $x$, computes its public value $g^x \...
1
vote
1answer
85 views
Clarification on Key exchange approaches in TLS/SSL
When RSA is used for key exchange in SSL, the client basically encrypts some random data using the server's public key and and sends it to the server. This data is then used to compute the shared key ...
2
votes
1answer
159 views
Can you help me understand some details about the attack using SSL3 POODLE bytes?
I have read some articles or books (e.g., “Bulletproof SSL and TLS”) about POODLE, but they still don't answer my questions – which are:
From https://www.openssl.org/~bodo/ssl-poodle.pdf,
...
2
votes
3answers
201 views
DIY message level security?
This might be in danger of being too elementary a question for this community but I'm hoping for expert help:
Assuming that TLS is not enough to protect messages transmitted between a client and a ...
2
votes
2answers
173 views
Layman's description of the padding oracle attack
I understand that the MAC-then-encrypt approach is susceptible to several attacks including the so called padding oracle attack. I understand that in this attack the attacker modifies the padding and ...
1
vote
1answer
10k views
Secure Cipher Suites supported by JDK versions [closed]
I'm a n00b to cryptography. I've been searching through oracle's java docs, ssl labs, googling and more googling attempting to find an up to date list of cipher suites considered secure for the ...
2
votes
0answers
719 views
Why SSH does not use a certificate authority in the same way as SSL [closed]
SSL requires the use of a trusted third party -- the certificate authority to verify a public key presented by a server to a client.
SSH on the other hand relies on the client having the server's ...
2
votes
1answer
534 views
Am I correctly understanding TLS 1.2 PRF (Pseudorandom Function)?
According to RFC 5246 Section 5
PRF(secret, label, seed) = P_<hash>(secret, label + seed)
and
...
2
votes
1answer
119 views
Insecure third party connection
My organization processes some PII data and shares it with an outbound connection (outflow only) that is a third party. The data transfer transactions occur without human intervention. That outbound ...
2
votes
0answers
13 views
How to decrypt SSL data on a considered-to-be-compromised host? [closed]
I have a package which I want to encrypt on my machine and send it to another remote machine. If I use asymmetric encryption, I must have the private key on the remote side. However, I don't trust the ...
1
vote
1answer
775 views
Size of Pre-Master Secret?
I am implementing TLS 1.2 and using cipher ECDHE_RSA_WITH_AES_128_GCM_SHA256
According to RFC 5346 Section 8.1 length of premaster secret will vary depending on key exchange method.
So, what is the ...
2
votes
1answer
157 views
DTLS 1.2 Key Expansion
I am using DTLS 1.2 and my cipher is TLS_ECDHE_WITH_AES_128_GCM_SHA256
According to RFC 5246(RFC 5246 key calculation) i am calculating keys but i can not find the size of these keys in this RFC.
...
1
vote
0answers
134 views
DTLS 1.2 Finished message
I am implementing DTLS 1.2 and using ECDHE_RSA_AES_128_GCM_SHA256 cipher suit.
Below is my client finished message
Can anyone explain this message?
How many bytes for verify data?
Is there ...
