# Tag Info

Accepted

### What are the differences between .pem, .csr, .key, .crt and other such file extensions?

File extensions can be (very) loosely seen as a type system. .pem stands for PEM, Privacy Enhanced Mail; it simply indicates a base64 encoding with header and ...
Accepted

### Why doesn't SSH use TLS?

SSH not using TLS is mostly historical; see for instance this answer (on security.SE). In practice, one could perfectly define a sort-of SSH that would use TLS for the data transport part; but, of ...
• 84.5k

### What's the difference between RSA and Diffie-Hellman?

Diffie-Hellman Key Exchange Problem: We have a symmetric encryption scheme and want to communicate. We don't want anybody else to have the key, so we can't say it out loud (or over a wire). Solution/...
• 781

### What's the appeal of using ChaCha20 instead of AES?

I believe there are three main reasons why ChaCha20 is sometimes preferred to AES. On a general-purpose 32-bit (or greater) CPU without dedicated instructions, ChaCha20 is generally faster than AES. ...
• 6,309

### Is Triple DES still considered safe to use?

Well, yes and no. Triple DES using 3 different keys is still considered secure because there are no known attack which completely break its security to a point where it is feasible nowadays to crack ...
• 7,163
Accepted

### Why was AES CBC removed in TLS 1.3?

Short: CBC mode in context of TLS protocol has had security issues, and would have had to be reworked. AES-CBC mode combined with decent HMAC can be as secure as AES-GCM. However, combining the ...
• 5,229

### Why doesn't SSH use TLS?

If by TLS, you mean specifically the series of protocols that is named "TLS", then the answer to why SSH wasn't designed to use them, is quite simple: they didn't exist when SSH was designed. TLS was ...
Accepted

### What is the SSL private key file format?

Copy / paste that key into http://phpseclib.sourceforge.net/x509/asn1parse.php and you'll see that there are several different integers in there. $p$ is there, $q$ is there as is the exponent and ...
• 2,703
Accepted

### Differences between the terms "pre-master secret", "master secret", "private key", and "shared secret"?

Simplified SSLv3/TLS from this book Note, $R_{(Alice|Bob)}$ is a random nonce chosen by Alice or Bob respectively, and $\{S\}_{Bob}$ is encryption with Bob's public key. pre-master secret As stated ...
• 37.7k
Accepted

### What's the difference between RSA and Diffie-Hellman?

In practice, in situations like TLS, public key encryption will be used to encrypt a secret for encrypting the actual messages, as part of a hybrid cryptosystem. This is done because Asymmetric ...
• 19.2k

### What is the SSL private key file format?

It is correct that the given private key does not encode a single integer, and that it includes two primes $p$ and $q$. More precisely, that Base64 data encodes a string of bytes, which is an ...
• 122k
Accepted

### Why did TLS 1.3 prohibit PGP authentication?

It seems that PGP certificates have the problem that they can be changed by the user. Furthermore, there were extensions for 1.2 that are incompatible for 1.3 (if they were secure in the first place): ...
• 84.5k

### Is there a standard for OpenSSL-interoperable AES encryption?

Since this is still open and the issue keeps coming up: TLDR: There are lots of things in OpenSSL that implement standards including AES, but the key derivation part of ...
• 5,391

AEAD cipher implementations are generally encrypt-then-authenticate internally (while the CBC ciphers in OpenSSL were not). TLS really was in need to get rid of the authenticate-then-encrypt which ...
• 84.5k

### Why is SSL on top of TCP?

why the SSL is not under the TCP ( Transport layer ) ? Because SSL can use TCP [1] to transport SSL records, and so SSL relies on TCP as a service. That is, SSL takes the user data stream, and ...
• 131k
Accepted

### Is encrypted e-mail sent over TLS 1.3 a form of "forward secrecy" (similar to something like Signal)?

Forward secrecy is a confusing term that should be abandoned, especially the meaningless but value-loaded variant ‘perfect forward secrecy’. It is especially confusing because it is often associated ...
• 45.6k
Accepted

### What's the GCM-SHA 256 of a TLS protocol?

I'll quickly decompose this cipher suite. TLS - standard starting point ECDHE - elliptic curve version of the Diffie-Hellman ...
• 44.6k

### What's the appeal of using ChaCha20 instead of AES?

Unless we find information from Google - such as white papers & mailinglist posts - we can only speculate why ChaCha20 is chosen. I think that efficient software implementation is still the most ...
• 84.5k
Accepted

### Why does TLS 1.3 support two CCM variants?

The rationale goes this way: On a "big" system like a PC or a smartphone, ChaCha20+Poly1305 or AES/GCM are very efficient; the latter is fast because the hardware provides dedicated opcodes that ...
• 84.5k

### Why was AES CBC removed in TLS 1.3?

TLS 1.3 is a reboot of the TLS protocol which focused on up to date cryptography rather than backwards compatibility. Now CBC is not as secure as you make it to be, and the way that it was used in TLS ...
• 84.5k
Accepted

### How does TLS_FALLBACK_SCSV help?

In a better world, TLS_FALLBACK_SCSV would not be necessary: SSL has been supporting downgrade-proof version negotiation since at least SSL 3.0, so a man in the middle should never be able to limit a ...
• 1,758
Accepted

### Why is PerfectForwardSecrecy considered OK, when it has same defects as salt-less password hashing?

Salt-less password hashing is only a problem since the amount of passwords actually used in practice is comparably small and also not evenly distributed. Thus it is both in terms of time and memory ...
• 1,298
Accepted

### What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?

Short answer: There would be nothing (that isn't already wrong with TLS) necessarily wrong with a CTR + HMAC cipher suite, but the technical merits are only one factor in a technical feature getting ...
• 1,928
Accepted

### What is the purpose of pre master secret in SSL/TLS?

The point of a premaster secret is to provide greater consistency between TLS cipher suites. While RSA cipher suites involve the client sending a random 48-byte premaster secret directly to the server,...

What is the advantage of AEAD ciphers? That depends one the scheme, but often it means you: Trust only one algorithm, not two. Perform only one pass (an ideal in the world of AEAD, not a consequence ...
• 1,824
Accepted

### Why does AES-GCM need a hash/MAC in TLS?

From RFC 5246, section 6.2.3.3: AEAD Ciphers: AEAD ciphers take as input a single key, a nonce, a plaintext, and "additional data" to be included in the authentication check, as described ...
• 84.5k

### What's the appeal of using ChaCha20 instead of AES?

Quoting RFC 8439 (emphasis mine): The Advanced Encryption Standard (AES — [FIPS-197]) has become the gold standard in encryption. Its efficient design, widespread implementation, and hardware ...
• 231
Accepted

### The difference between MACs vs. HMACs vs. PRFs

A PRF or pseudorandom function family is a family of functions $F_k\colon \{0,1\}^n \to \{0,1\}^m$ such that if $k$ is uniformly distributed, then $F_k$ appears to be uniformly distributed among all ...
• 45.6k
Accepted

### What is different below two Ciphersuites?

The difference is that tls_aes_128_gcm_sha256 is TLS 1.3 and tls_ecdhe_rsa_with_aes_128_gcm_sha256 is used for the older TLS 1.2....
• 84.5k