Hot answers tagged

182 votes
Accepted

What are the differences between .pem, .csr, .key, .crt and other such file extensions?

File extensions can be (very) loosely seen as a type system. .pem stands for PEM, Privacy Enhanced Mail; it simply indicates a base64 encoding with header and ...
76 votes
Accepted

Why doesn't SSH use TLS?

SSH not using TLS is mostly historical; see for instance this answer (on security.SE). In practice, one could perfectly define a sort-of SSH that would use TLS for the data transport part; but, of ...
user avatar
68 votes

What's the difference between RSA and Diffie-Hellman?

Diffie-Hellman Key Exchange Problem: We have a symmetric encryption scheme and want to communicate. We don't want anybody else to have the key, so we can't say it out loud (or over a wire). Solution/...
user avatar
  • 781
67 votes

What's the appeal of using ChaCha20 instead of AES?

I believe there are three main reasons why ChaCha20 is sometimes preferred to AES. On a general-purpose 32-bit (or greater) CPU without dedicated instructions, ChaCha20 is generally faster than AES. ...
user avatar
  • 6,309
54 votes

Is Triple DES still considered safe to use?

Well, yes and no. Triple DES using 3 different keys is still considered secure because there are no known attack which completely break its security to a point where it is feasible nowadays to crack ...
user avatar
  • 7,163
48 votes
Accepted

Why was AES CBC removed in TLS 1.3?

Short: CBC mode in context of TLS protocol has had security issues, and would have had to be reworked. AES-CBC mode combined with decent HMAC can be as secure as AES-GCM. However, combining the ...
user avatar
  • 5,229
48 votes

Why doesn't SSH use TLS?

If by TLS, you mean specifically the series of protocols that is named "TLS", then the answer to why SSH wasn't designed to use them, is quite simple: they didn't exist when SSH was designed. TLS was ...
user avatar
38 votes
Accepted

What is the SSL private key file format?

Copy / paste that key into http://phpseclib.sourceforge.net/x509/asn1parse.php and you'll see that there are several different integers in there. $p$ is there, $q$ is there as is the exponent and ...
user avatar
  • 2,703
34 votes
Accepted

Differences between the terms "pre-master secret", "master secret", "private key", and "shared secret"?

Simplified SSLv3/TLS from this book Note, $R_{(Alice|Bob)}$ is a random nonce chosen by Alice or Bob respectively, and $\{S\}_{Bob}$ is encryption with Bob's public key. pre-master secret As stated ...
user avatar
  • 37.7k
28 votes
Accepted

What's the difference between RSA and Diffie-Hellman?

In practice, in situations like TLS, public key encryption will be used to encrypt a secret for encrypting the actual messages, as part of a hybrid cryptosystem. This is done because Asymmetric ...
user avatar
  • 19.2k
27 votes

What is the SSL private key file format?

It is correct that the given private key does not encode a single integer, and that it includes two primes $p$ and $q$. More precisely, that Base64 data encodes a string of bytes, which is an ...
user avatar
  • 122k
25 votes
Accepted

Why did TLS 1.3 prohibit PGP authentication?

It seems that PGP certificates have the problem that they can be changed by the user. Furthermore, there were extensions for 1.2 that are incompatible for 1.3 (if they were secure in the first place): ...
user avatar
  • 84.5k
24 votes

Is there a standard for OpenSSL-interoperable AES encryption?

Since this is still open and the issue keeps coming up: TLDR: There are lots of things in OpenSSL that implement standards including AES, but the key derivation part of ...
user avatar
23 votes

What is the advantage of AEAD ciphers?

AEAD cipher implementations are generally encrypt-then-authenticate internally (while the CBC ciphers in OpenSSL were not). TLS really was in need to get rid of the authenticate-then-encrypt which ...
user avatar
  • 84.5k
23 votes

Why is SSL on top of TCP?

why the SSL is not under the TCP ( Transport layer ) ? Because SSL can use TCP [1] to transport SSL records, and so SSL relies on TCP as a service. That is, SSL takes the user data stream, and ...
user avatar
  • 131k
23 votes
Accepted

Is encrypted e-mail sent over TLS 1.3 a form of "forward secrecy" (similar to something like Signal)?

Forward secrecy is a confusing term that should be abandoned, especially the meaningless but value-loaded variant ‘perfect forward secrecy’. It is especially confusing because it is often associated ...
user avatar
21 votes
Accepted

What's the GCM-SHA 256 of a TLS protocol?

I'll quickly decompose this cipher suite. TLS - standard starting point ECDHE - elliptic curve version of the Diffie-Hellman ...
user avatar
  • 44.6k
19 votes

What's the appeal of using ChaCha20 instead of AES?

Unless we find information from Google - such as white papers & mailinglist posts - we can only speculate why ChaCha20 is chosen. I think that efficient software implementation is still the most ...
user avatar
  • 84.5k
18 votes
Accepted

Why does TLS 1.3 support two CCM variants?

The rationale goes this way: On a "big" system like a PC or a smartphone, ChaCha20+Poly1305 or AES/GCM are very efficient; the latter is fast because the hardware provides dedicated opcodes that ...
user avatar
17 votes

Why was AES CBC removed in TLS 1.3?

TLS 1.3 is a reboot of the TLS protocol which focused on up to date cryptography rather than backwards compatibility. Now CBC is not as secure as you make it to be, and the way that it was used in TLS ...
user avatar
  • 84.5k
16 votes
Accepted

How does TLS_FALLBACK_SCSV help?

In a better world, TLS_FALLBACK_SCSV would not be necessary: SSL has been supporting downgrade-proof version negotiation since at least SSL 3.0, so a man in the middle should never be able to limit a ...
user avatar
  • 1,758
16 votes
Accepted

Why is PerfectForwardSecrecy considered OK, when it has same defects as salt-less password hashing?

Salt-less password hashing is only a problem since the amount of passwords actually used in practice is comparably small and also not evenly distributed. Thus it is both in terms of time and memory ...
user avatar
15 votes
Accepted

What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?

Short answer: There would be nothing (that isn't already wrong with TLS) necessarily wrong with a CTR + HMAC cipher suite, but the technical merits are only one factor in a technical feature getting ...
user avatar
  • 1,928
15 votes
Accepted

What is the purpose of pre master secret in SSL/TLS?

The point of a premaster secret is to provide greater consistency between TLS cipher suites. While RSA cipher suites involve the client sending a random 48-byte premaster secret directly to the server,...
14 votes

What is the advantage of AEAD ciphers?

What is the advantage of AEAD ciphers? That depends one the scheme, but often it means you: Trust only one algorithm, not two. Perform only one pass (an ideal in the world of AEAD, not a consequence ...
user avatar
13 votes
Accepted

Why does AES-GCM need a hash/MAC in TLS?

From RFC 5246, section 6.2.3.3: AEAD Ciphers: AEAD ciphers take as input a single key, a nonce, a plaintext, and "additional data" to be included in the authentication check, as described ...
user avatar
  • 84.5k
13 votes

What's the appeal of using ChaCha20 instead of AES?

Quoting RFC 8439 (emphasis mine): The Advanced Encryption Standard (AES — [FIPS-197]) has become the gold standard in encryption. Its efficient design, widespread implementation, and hardware ...
user avatar
  • 231
13 votes
Accepted

The difference between MACs vs. HMACs vs. PRFs

A PRF or pseudorandom function family is a family of functions $F_k\colon \{0,1\}^n \to \{0,1\}^m$ such that if $k$ is uniformly distributed, then $F_k$ appears to be uniformly distributed among all ...
user avatar
13 votes
Accepted

What is different below two Ciphersuites?

The difference is that tls_aes_128_gcm_sha256 is TLS 1.3 and tls_ecdhe_rsa_with_aes_128_gcm_sha256 is used for the older TLS 1.2....
user avatar
  • 84.5k
13 votes
Accepted

Which Diffie-Hellman Groups does TLS 1.3 support? And should we use TLS 1.3 as a guide?

(1) I'm curious whether the following 10 different DH Groups are the only groups that TLS 1.3 supports, Yes, in the sense that TLS 1.3 only allows groups that are explicitly declared as supported in ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible