Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
1
vote
4answers
95 views

Does SSL connection provide integrity?

I'm new to cryptography and I'm trying to implement a secure chat application using OpenSSL. I want to ensure that public messages (which will be shown to all users) cannot be altered during ...
2
votes
2answers
107 views

Why do people use protocols like PGP, when TLS already exists?

TLS is the standard cryptography protocol on the internet, and many websites use it to secure their communications. However, for personal use, most people use other protocols like PGP, instead of ...
0
votes
1answer
35 views

Simple Key Exchange, One Server

I am trying to better understand how TLS works. I understand in the normal use case you need various random values generated and used in the key exchange, to prevent some MITM reusing a previous ...
0
votes
1answer
79 views

Using AES-CBC in TLS1.2

Is AES-CBC still vulnerable in TLS1.2 Or does the vulnerability only work for lower TLS versions? If not, why was it deleted in TLS 1.3?
2
votes
2answers
786 views

Which block cipher mode of operation does TLS 1.3 use?

Which block cipher mode of operation does TLS 1.3 use? I assume it is a block cipher mode that provides authentication (like GCM).
3
votes
1answer
79 views

Concatenation of password and TOTP - possible issues

I have come across a two factor login mechanism using Time based OTP (TOTP). TOTP (6 digits) is shown to the user in an app. There are two ways of logging in. Method 1: User inputs the username and ...
0
votes
0answers
37 views

Is it possible to extract a signature from a HTTPS webpage?

Let's say I want to prove to someone that a webpage claims X. I could take a screenshot, but it could easily be doctored. However, the webpage's contents are encrypted by the domain using its private ...
0
votes
0answers
16 views

HPKP on OS or library level

Among the major operating systems (Windows, MacOS, Linux) or common TLS libraries (Schannel, openssl, boringssl) is their any way to pin certificates on a global level? So not just per application but ...
1
vote
1answer
64 views

Read ECDHE traffic with Wireshark or the like

There is some https traffic from a specific server (which I have the certificate and private key) that I need legitimately be able to read. This traffic doesn’t come via browser so besides the ...
2
votes
0answers
20 views

SSL/TLS Forward secrecy with 2 KEM public keys

As we know, NIST PQC project is at its 3rd round, with draft standard expected to arrive in the next (few) year(s). An unfortunate fact is that, we're not seeing many signature schemes general-purpose ...
2
votes
1answer
100 views

In TLS, does the client know the server's public key before starting the data exchange?

I am reading about the logjam attack. I was asked if the attack could be prevented by checking the integrity of the Server Hello message. My answer would be no because the man-in-the-middle can still ...
0
votes
0answers
24 views

Authentication between two servers using PKA

I've run into an small issue regarding authentication between 2 services (One way communication) using public and private key authentication (Elliptic Curve, secp256k1). The services will communicate ...
1
vote
0answers
30 views

Security proof for TLS 1.x

In JKSS12, a proof for the handshake in TLS-DHE 1.2 is given, assuming (among other things) the PRF-ODH hypothesis on the PRF used to derive keys. It is also stated that, if TLS 1.2 was to be modified ...
2
votes
1answer
64 views

In TLS 1.3, is the Binder Key in a non-PSK derived key schedule always a consistent value?

The Key Schedule in the TLS 1.3 RFC starts like this: ...
1
vote
1answer
67 views

In TLS 1.3, what is the rational for using different handshake transcripts for Resumption Master Secret vs Application Traffic Secrets?

The TLS 1.3 RFC, section 7.1 lists this as the last part of the key schedule: https://datatracker.ietf.org/doc/html/rfc8446#section-7.1 ...
1
vote
0answers
58 views

TLS 1.3 Handshake - Usage of MAC and Digital Signature for CertificateVerify and Finished Message

I was wondering, why the TLS 1.3 handshake employs two different 'messages' that compute an authentication code over the whole handshake. As far as I understand, the CertificateVerify "message&...
1
vote
0answers
56 views

How to decrypt raw TLS bytes?

Is there any tool / way to decrypt raw bytes of a TLS 1.2 session, when the master key is known, even if forward secrecy is used? The closest I found is this. I know its possible using Wireshark, but ...
2
votes
1answer
121 views

What does the running transcript hash in RFC-8446: TLS 1.3 do?

From RFC8446: In general, implementations can implement the transcript by keeping a running transcript hash value based on the negotiated hash. Note, however, that subsequent post-handshake ...
1
vote
1answer
40 views

What salt should be used when generating TLS 1.3 CertificateVerify message?

When signing handshake messages digest, the MGF1 function takes some salt value with same length as the digest has. But what content must be in salt's buffer? I explored the source code of libnettle, ...
0
votes
2answers
91 views

What does TLS 1.2 mean by SHA functions?

I'm looking at the technical docs for TLS 1.2 and it says it uses SHA (so hashing algorithms): 7.4.1.4.1. Signature Algorithms But hashing just digests an input, to do things like user authentication....
-1
votes
1answer
81 views

How much security does using TLS provide?

If someone tells me their service uses TLS 1.2 or higher, how much 'guaranteed' security does this provide? Is it possible to correctly claim to be using TLS 1.2 or 1.3 and still be insecure? For ...
3
votes
0answers
71 views

Openssl speed vs TLS speed with postquantum KEM

I'm studying the performance of postquantum KEM in TLS with the OQS (OQS is a project that integrate liboqs to openssl). I don't know why, but the KEM algorithms performance in TLS is 10 times slower ...
1
vote
1answer
52 views

Server authentication in TLS 1.2 with static DH

For (EC)DHE cipher suites, server authenticates itself by proving the possession of the private key matching its certificate by signing ServerKeyExchange message (...
-1
votes
1answer
50 views

Can X3DH algorithm implementation be avoided to thwart Man-in-the-Middle Attack during End-to-End Encryption with Diffie-Hellman Algo, When using SSL

For End-to-End Encryption in chats using Diffie-Hellman Algo the concept of Extended Triple Diffie-Hellman (X3DH) is used to prevent Man-in-the-middle attack (MITM) (courtesy: https://www.qed42.com/...
1
vote
0answers
43 views

How does TLS 1.3 sign key exchange?

From this site: https://tls13.ulfheim.net/ and from https://www.rfc-editor.org/rfc/rfc8446#section-2 I can't find the part in which the exchange of keys is signed, isn't one of the parties "...
0
votes
0answers
21 views

Why does AES_GCM sometimes has a SHA for integrity? [duplicate]

For example the following suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 From what I understand the SHA384 at the end is used to authenticate the message, which is exactly what MAC does, and the mode ...
1
vote
1answer
110 views

What hash is concatenating with the data to be signed in TLS 1.3 CertificateVerify message?

According to specification, to create data that will be signed with server private key for CertificateVerify message, we need to concatenate 64 space characters, the string "TLS 1.3, server ...
1
vote
1answer
85 views

How does TLS 1.3 work with PQC signatures?

I know that the first step in TLS 1.3 with modern signatures is hash the message with SHA256/SHA384/SHA512. Do PQC signatures work the same as modern algorithms in TLS 1.3?
1
vote
2answers
85 views

What symmetric algo does TLS use?

So my understanding of TLS is that it uses asymmetric cryptography such as DH to perform a key exchange, once this has occurred it then used an symmetric algorithm for the data exchange. (Obviously I ...
2
votes
2answers
164 views

How does TLS with PQC use key encapsulation?

As there don't seem to be any PQC alternatives for Diffie-Hellman (DH / ECDH), DH must have been replaced by key encapsulation using an ephemeral key pair. However, since TLS 1.3 always performs ...
1
vote
2answers
130 views

Who provides prime numbers for cryptographic protocols?

I am currently writing a thesis about different cryptographic protocols like DH-Key exchange, TLS or IKE. Most of them rely on a prime number earlier or later, so for security reasons I wondered if ...
0
votes
1answer
51 views

Symmetric key as proof of ownership of a session?

I have a question, or rather multiple questions that all relate to the same topic. I am building an application with both a frontend (FE) and a backend (BE). All communication between FE and BE is ...
1
vote
1answer
56 views

Is it safe to send a hashed password over HTTPS or what is the most secure method of authentication?

My rudimentary understanding of HTTPS and the Diffie-Hellman key exchange is that the client and server can establish a secured connection by generating the same key based on their private secrets and ...
4
votes
2answers
155 views

Have any PAKE extensions been added to TLS 1.3?

In TLS 1.2, there was TLS-SRP (RFC 5054,) which provided a password-authenticated key exchange (PAKE) protocol for use with TLS. However, it apparently relied on handshake messages that have been ...
1
vote
1answer
67 views

Different encryption standards and how they relate to auth and algorithms

The main confusion I have is around the different PKCS and relation with SSL (TLS). I have done a lot of research and have found bits and pieces but not necessarily how these relate, so let me explain ...
3
votes
0answers
20 views

SSL handshake - what is the purpose of the finishedClient message?

I am having some difficulties in understanding why is the finishedClient needed. In case an attacker attempts an attack like a replay attack, it will show ...
0
votes
1answer
25 views

Do you need both client and server side support for TLS 1.3 record padding?

When you enable record padding for a client, does a server need a specific option to support this? Or does the other end only need to support TLS 1.3 as well and can handle the padding automatically?
2
votes
2answers
462 views

Why does the TLS spec for TLS-PSK say not to derive the shared secret from a password?

According to a note at the end of section 2.2 of the TLS 1.3 spec (RFC 8446), When using an out-of-band provisioned pre-shared secret, a critical consideration is using sufficient entropy during the ...
1
vote
0answers
22 views

TLS 1.3 clarification needed on hello_hash and subsequent hashes

I am exploring TLS, mainly from the server side at the moment. I am creating a server that will authenticate a client using TLS 1.3 and eventually I will be creating a client authenticating to a ...
2
votes
1answer
218 views

What is the overhead of GCM? And how are GCM tags signed by RSA/PKI?

I'm mainly trying to wrap my head around the pipeline of encryption, hashing and signing. I've read over this question, describing the overhead of GCM, which I understand to be configurable for space-...
7
votes
3answers
860 views

Which Diffie-Hellman Groups does TLS 1.3 support? And should we use TLS 1.3 as a guide?

This is a two part question - and I'm asking as someone moving into a security role, who'll need to standardize practices going forward. (1) I'm curious whether the following 10 different DH Groups ...
1
vote
1answer
133 views

How does the TLS Client Hello message choose the TLS version? [closed]

Im looking at a Client Hello message in wireshark, the client supports 1.2 and 1.3, but Wireshark says the client used TLSv1.3 record layer when the server hasn't replied yet the choosen version. How ...
1
vote
1answer
56 views

OpenSSL TLSv1.3 record padding

OpenSSL supports TLSv1.3 record padding: https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html but I'm not sure if it works like I think it does. If I would choose a factor of 2 it would make ...
5
votes
2answers
473 views

Clarification on the TLS verification process

I am reading this article in my attempt to understand how the TLS verification and chain of trust works. In the piece I come across a section that I am not sure I understand. In the simplified ...
1
vote
2answers
293 views

Stream cipher and block cipher usage in network data encryption

Stream ciphers are usually used for streaming data encryption, such as voice, and also for low layers data encryption. For example, MACSec uses AES-GCM encryption. In L3 ad L4 security protocols (...
2
votes
1answer
66 views

Is client certificate mandatory for two-way TLS?

In One-way Transport Layer Security (TLS), client who initiates the connection verifies the identity of the server or entity it is connecting to, but server not necessarily validates client identity. ...
0
votes
0answers
32 views

Key and Message generated on Client, and validated by Server

(Sorry in advance for my blurry thinking on this: I'm a programmer, not a cryptography expert.) I have a Client/Server web application. The Client needs to be able to alter the local state in ways ...
0
votes
1answer
120 views

TLS 1.2 Server Key Exchange problem

Below the Wireshark snapshot of the handshake compliant to the TLS 1.2. The position 1 displays the enum ServerECDHParams where I can use any curve having the own ID RFC8422. I'm free for example to ...
0
votes
0answers
20 views

Is my password database encryption flow secure?

I'm not an expert and I would be very glad if someone could take a look at it and tell if there are any problems with it Things I know/think are problematic using base64 digest + getting the first 32 ...
1
vote
3answers
184 views

Where is Challenge/Response and Certifcate Verification in TLS-DHE

We have been give a task to identify the following three components in TLS-DHE: Diffie Hellman Key Exchange I am fairly certain that this Part can be found in the Exchange of SKE and CKE, since they ...

1
2 3 4 5
12