Questions tagged [tls]

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.

Filter by
Sorted by
Tagged with
0 votes
1 answer
15 views

TLS 1.3 digital certificates and ephemeral Diffie Hellman

There is a lot of confusing information out there regarding the role of digital certificates and the use of Ephimeral Diffie Hellman in how TLS 1.3 operates. Would it be correct to state that the the ...
termcap's user avatar
0 votes
0 answers
29 views

The parameters in TLS1.2 server signature with ECDSA

I'm trying to write a webserver. I'm using TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (secp256r1). I generated a CA certificate using OpenSSL (using prime256v1). I generated the hash using server_random +...
polipo09's user avatar
0 votes
1 answer
76 views

Why does TLS 1.3 (Client/Server) Hello require a random number?

Why does TLS 1.3 (Client/Server) Hello require a random number? Wouldn't a sequence number also work? I do understand that a sequence number is predictable but I don't see why this would be a problem ...
Pochi's user avatar
  • 1
0 votes
0 answers
30 views

Authenticating a device for remote motor control [migrated]

I'm looking for a standard solution to the following problem. I've been unable to find how something like this is normally accomplished. Even a key word that points me in the right direction would be ...
safety_motorhead_19's user avatar
0 votes
0 answers
40 views

Secure key exchange for custom USB device

I'm learning various cryptography protocols and use cases and since I'm developing a USB device and PC application, it would be nice to use encrypted communication. I studied TLS 1.2 key exchange but ...
unalignedmemoryaccess's user avatar
1 vote
1 answer
23 views

Use of CertificateVerify in TLS_DH_RSA with client authentication?

Does anyone know if CertificateVerify is sent in TLS_DH_RSA with client authentication? Does anyone know the RFC or could explain the meaning of it? With TLS_RSA, a ...
user946822's user avatar
2 votes
0 answers
65 views

Tor Key Exchange Client - Middle Node

I am currently exploring the workings of the Tor network, specifically how the Diffie-Hellman (DH) key exchange protocol is employed to establish shared secret keys between the client and each relay ...
Elian's user avatar
  • 21
2 votes
0 answers
90 views

Questions about TLS 1.3 inspection with commercial middleboxes

i'm trying to learn how commercial (for example PaloAlto or Fortigate) middleboxes intercept and decrypt TLS 1.3 traffic. To do that I started observing the TLS traffic between the client, middlebox ...
nkovana's user avatar
  • 21
0 votes
1 answer
154 views

Hybrid key exchange in TLS 1.3

In Hybrid key exchange in TLS 1.3, they mention that with a hybrid approach, we concatenate the shared secret from each method (say KEM like Kyber768 + classical ECDH X25519 = X22519Kyer768). ...
Moo's user avatar
  • 147
0 votes
0 answers
53 views

Framework for manipulating digital signatures

for a research project, i am currently looking for a way to manipulate the digital signature of a HTTPS TLS message flow. More specifically, i am trying to create a working example for a malicious ...
ndrscodes's user avatar
1 vote
1 answer
56 views

TLS 1.2, encrypt_then_mac. No sequence number in packet?

TLS 1.2, if encrypt_then_mac extension is enabled. Sequence number is used during MAC calculation. But it's not used during the 'body' encryption. Here, seq_num is used only when calling MAC() ...
Clem Fandango's user avatar
1 vote
1 answer
144 views

TLS 1.3: How is Finished message useful when authenticating via certificates?

I cannot quite understand, if Finished message serves any particular purpose when the server is being authenticated via certificates, or if it there just for "consistency" or "extra ...
Alex Chashin's user avatar
10 votes
1 answer
2k views

is TLS compression used in modern browsers?

In 2012 CRIME attack effectively killed TLS compression. Has anything changed since 2012 regarding compression in TLS or have modern browsers sacrificed security over performance? If browsers now use ...
pacman's user avatar
  • 429
1 vote
1 answer
71 views

Regarding the Digital Signature Algorithm During Client Authentication in TLS 1.2

In TLS 1.2, when client authentication is carried out, digital signatures are utilized. However, at what point is the specific signature algorithm communicated to the server? It seems to me that the ...
dusk's user avatar
  • 11
1 vote
0 answers
60 views

Is the SNI extension signed in TLS 1.3?

In TLS 1.3, and since the server signs the entire handshake messages including the server hello message, in this case, is the SNI extension of the client hello message, is it included in the content ...
warren's user avatar
  • 33
0 votes
0 answers
35 views

How by changing ciphertext can the attacker know the length of the padding in POODLE attack

I try to understand the POODLE attack. I read that the attacker try to change one byte of the last block of the ciphertext. Becasue the last block is only have padding and the last byte is the padding ...
eitan's user avatar
  • 31
0 votes
0 answers
50 views

Public key encryption with a large number of users

I'm building an app that will primarily be iOS or Android based. My plan is for every user to have their own key pair. The public key will be stored on the server along with a 128 bit UUID which is ...
Cromulent's user avatar
  • 101
0 votes
0 answers
555 views

Using curl with TLS1.3

I need to test my server with curl 8.2.1 utility. My server works only with TLS1.3 and cipher 0x1302 - TLS_AES_256_GCM_SHA384. ...
LUN's user avatar
  • 95
0 votes
1 answer
71 views

Does TLS1.3 support DHE_EXPORT cipher suite? [duplicate]

I just wanted to know for sure that TLS 1.3 does not support DHE_EXPORT cipher suits.
warren's user avatar
  • 33
3 votes
1 answer
62 views

how 0/n split prevent BEAST attack against TLS?

I read that to mitigrate BEAST attack openSSL tried to inject empty TLS record before each real TLS record. and by doing that there is no opportunity to execute an attack but i dont understand way? ...
eitan's user avatar
  • 31
0 votes
0 answers
43 views

Encrypted Alert21- Error code 214

I am working on TLS 1.2 Cipher TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, After send the application data server throws an error message ...
Ahamed Fayaz.'s user avatar
1 vote
0 answers
107 views

TLS 1.3 key_share capture without certificate exchange

I am working on an investigation on TLS 1.3. I've came across an article of qacafe where they shared a TLS 1.3 handshake sequence. Wireshark capture. In this capture you see that in the Client Hello a ...
Arthur Timmermans's user avatar
1 vote
1 answer
188 views

For TLS-PSK (pre-shared key), should non-ephemeral key exchange be preferred over ephemeral one?

TLS 1.3 specify two pre-shared key exchange modes, which are psk_ke and psk_dhe_ke. The former is a non-ephemeral key exchange ...
Du Huynh's user avatar
0 votes
0 answers
40 views

How to know details of generating keying material in openssl library?

I am testing my TLS 1.3 server (it does not use openssl library) using openssl s_client utility. I have found out that ...
LUN's user avatar
  • 95
0 votes
0 answers
14 views

A reason of "SSL_ERROR_RX_MALFORMED_HELLO_RETRY_REQUEST" error in FF when connecting wirh Firefox (TLS 1.3)

I am trying to test my server program which implements TLS 1.3 connection - it should establish TLS 1.3 connection. My server uses a self-signed certificate, created in ...
LUN's user avatar
  • 95
0 votes
1 answer
198 views

How to define RSA padding for RSA encryption in openssl 3.0?

I am studying openssl 3.0 (Windows, C++) in order to encrypt data using RSA. More specifically, I need to sign a CertificateVerify server message in TLS 1.3. The ...
LUN's user avatar
  • 95
0 votes
0 answers
56 views

How I can force the openssl "s_client" utility to generate predefined random bytes in it's ClientHello?

I'm testing my server application (TLS 1.3) using s_client program from the openssl library and I need to force the ...
LUN's user avatar
  • 95
0 votes
1 answer
240 views

How to force openssl/s_client to send a keyshare for the specific elliptic curve (secp256r1)?

I want to test my server application (TLS 1.3) using s_client program from the openssl library and I need to get from the ...
LUN's user avatar
  • 95
3 votes
1 answer
492 views

How does TLS 1.3 restrict the Diffie-Hellman parameters to ones that are known to be secure?

In previous versions of TLS, the choice of the Diffie-Hellman parameters was up to the participants. This resulted in some implementations choosing incorrectly, resulting in vulnerable implementations ...
user10433098's user avatar
3 votes
1 answer
297 views

Is there open-source test tool that operate TLS server/client with unexpected behaviors

I'm working in an embedded system that uses TLS v1.2 protocol for network security and it acts as a client. Now I want to test some TLS security functions that require connecting with a TLS server and ...
songoku711's user avatar
1 vote
1 answer
183 views

Using of the Transcript-Hash in TLS 1.3

The section 4.4.1 of the RFC 8446 tells about Transcript-Hash. My questions about the transcript-hash are: Must a server hash (a) all own sent messages, enumerate in the section 4.4.1, or (b) own ...
LUN's user avatar
  • 95
1 vote
1 answer
223 views

Forming ECC key (TLS) in X9.63 format

I am studying TLS handshaking by example a program tlse, which uses libtomcrypt library.I see that in line 5236 (link above) the program call libtomcrypt procedure ...
LUN's user avatar
  • 95
1 vote
1 answer
153 views

Where in the TLS 1.3 record is the sequence number located?

The sequence number should be a 64 bit number in every TLS record, but the record header layer is only 5 bytes long and I am looking at a Wireshark pcap, where the TLS record only includes the header ...
miran80's user avatar
  • 113
2 votes
1 answer
65 views

Should a certificate message of a server be encypted in TLS 1.3?

Section 2 of RFC 8446 says about the phase "Key Exchange": … Everything after this phase is encrypted. The "Certificate" message is sent after &...
LUN's user avatar
  • 95
3 votes
2 answers
203 views

"Supported groups" in RFC 8446 (TLS 1.3)

What is meant by "supported groups" in the section 4.2.7. "Supported Groups" of RFC 8446: /* Finite Field Groups (DHE) */ ffdhe2048(0x0100), ffdhe3072(0x0101), etc: Is the digits - ...
LUN's user avatar
  • 95
0 votes
1 answer
52 views

Why is IV in RFC8448 examples only 12 octets instead of 16?

I am working on manual decryption of application data in TLS 1.3 by going through example in RFC8448. I successfully derived and expanded key and IV, but the IV in examples is only 12 bytes long ...
miran80's user avatar
  • 113
0 votes
1 answer
106 views

Its Tls 1.2 Padding required when message ist multiple of block length?

When I want to encrypt a 16 byte long message with AES-128-CBC using int TLS 1.2 do I need to add a 16 byte block of padding or can I just encrypt the message without padding ?
atcheckmate's user avatar
1 vote
1 answer
255 views

Difference between "key_share" extension and "server_key_exchange" message in TLS 1.3

Could anyone explain me the difference between "key_share" extension and "server_key_exchange" message in TLS (1.3) ? If I understood right, these "packets" of data are ...
LUN's user avatar
  • 95
0 votes
1 answer
54 views

Prove a response was received from the particular Tor hidden service

Consider a Tor hidden service. I want to retrieve the main page of such website in such a way that I can later prove to a skeptical third party that the website with this certificate (identified by ...
chargerbottle's user avatar
2 votes
1 answer
172 views

How to create TLS 1.3 Key Derivation test cases

I'm trying to create some test cases for a TLS library for the Key Derivation outlined in RFC 8446 7.1. I tried to get this information from openssl using the ...
JBaczuk's user avatar
  • 191
1 vote
3 answers
165 views

How do certificates add data to public key and how is this implemented into TLS?

I want to create a self signed PKI for a couple servers I am running. I am finding tutorials with copy paste commands from openssl, and hand waving explanations that describe the general purpose of ...
Damian Games's user avatar
1 vote
2 answers
205 views

Entropy for TLS 1.2: how much is needed for linux servers?

I am trying to fix issues with a server where the server keeps freezing up and needs to be restarted. I recently started hearing about entropy and it importance to secure tls keys in linux. The one ...
Brandon Sifuentez's user avatar
6 votes
2 answers
2k views

Is RSA longer supported in TLS 1.3 and are RSA and DH fundamentally different?

I'm watching "SSL, TLS, HTTPS Explained" by ByteByteGo on YouTube and at the end, starting around 5:15, there are two points that are interesting: in TLS 1.3 RSA is no longer supported as ...
c_idle's user avatar
  • 171
2 votes
1 answer
69 views

Are there any significant ways in which TLS could still be improved?

With TLS 1.3 supporting only secure, forward-secret cipher suites, are there any significant technological improvements that could still be made to the protocol?
Collin's user avatar
  • 21
1 vote
0 answers
1k views

BAD Record MAC error from the server [closed]

I am working on ssl client because of some server update I was enabling the cipher TLS_DHE_RSA_WITH_AES_128_GCM_SHA256. While handshake with server I was facing Bad Record MAC Alert message from the ...
Ahamed Fayaz.'s user avatar
3 votes
2 answers
421 views

Are the following ciphersuites vulnerable? if so, what are the vulnerabilities?

Following ciphersuites found to be weak in Qualys(https://www.ssllabs.com/ssltest/analyze.html) tool: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) ECDH x25519 (eq. 3072 bits RSA) ...
user105523's user avatar
2 votes
0 answers
74 views

How are the `binder hash` and `finished` values calculated in the Resumed 0-RTT Handshake example in TLS 1.3?

I'm trying to understand the implication of the Binder Keys in in a TLS 1.3 resumed handshake. The TLS 1.3 RFC provides an additional RFC with example traces to validate all the math in a TLS 1.3 ...
Eddie's user avatar
  • 983
19 votes
1 answer
5k views

Will IBM's Condor quantum processor run Shor's Algorithm to crack a 256-bit Elliptic Curve key?

Yesterday IBM announced that they have a 433 bit quantum computer, called Osprey. There is nothing in the press releases I can find that says whether it can or cannot run Shor's Algorithm. They also ...
Simon G.'s user avatar
  • 343
0 votes
1 answer
44 views

Mapping DH / DHE p & g params to a group

I'm doing a small code that performs a simple SSL/TLS analysis and I'm stuck on determining the size of the key exchange in the case of DH / DHE. If I take the following example (wireshark capture) : <...
Akerces's user avatar
1 vote
2 answers
2k views

How does TLS 1.3 provide authentication without using the public key to verify that the server has a private key?

In the TLS 1.2 handshake, after checking the certificate, the public key from the certificate was used to encrypt the data to create a symmetric encryption key, hence the authentication took place on ...
Nikita Khodakovsky's user avatar

1
2 3 4 5
14