211 votes
Accepted

What are the differences between .pem, .csr, .key, .crt and other such file extensions?

File extensions can be (very) loosely seen as a type system. .pem stands for PEM, Privacy Enhanced Mail; it simply indicates a base64 encoding with header and ...
81 votes
Accepted

Why doesn't SSH use TLS?

SSH not using TLS is mostly historical; see for instance this answer (on security.SE). In practice, one could perfectly define a sort-of SSH that would use TLS for the data transport part; but, of ...
Thomas Pornin's user avatar
75 votes

What's the difference between RSA and Diffie-Hellman?

Diffie-Hellman Key Exchange Problem: We have a symmetric encryption scheme and want to communicate. We don't want anybody else to have the key, so we can't say it out loud (or over a wire). Solution/...
Wazoople's user avatar
  • 851
72 votes

What's the appeal of using ChaCha20 instead of AES?

I believe there are three main reasons why ChaCha20 is sometimes preferred to AES. On a general-purpose 32-bit (or greater) CPU without dedicated instructions, ChaCha20 is generally faster than AES. ...
Ruggero's user avatar
  • 7,084
57 votes

Is Triple DES still considered safe to use?

Well, yes and no. Triple DES using 3 different keys is still considered secure because there are no known attack which completely break its security to a point where it is feasible nowadays to crack ...
Lery's user avatar
  • 7,679
53 votes

Why doesn't SSH use TLS?

If by TLS, you mean specifically the series of protocols that is named "TLS", then the answer to why SSH wasn't designed to use them, is quite simple: they didn't exist when SSH was designed. TLS was ...
Jörg W Mittag's user avatar
49 votes
Accepted

Why was AES CBC removed in TLS 1.3?

Short: CBC mode in context of TLS protocol has had security issues, and would have had to be reworked. AES-CBC mode combined with decent HMAC can be as secure as AES-GCM. However, combining the ...
user4982's user avatar
  • 5,329
34 votes
Accepted

What's the difference between RSA and Diffie-Hellman?

In practice, in situations like TLS, public key encryption will be used to encrypt a secret for encrypting the actual messages, as part of a hybrid cryptosystem. This is done because Asymmetric ...
Ella Rose's user avatar
  • 19.6k
26 votes

Is there a standard for OpenSSL-interoperable AES encryption?

Since this is still open and the issue keeps coming up: TLDR: There are lots of things in OpenSSL that implement standards including AES, but the key derivation part of ...
dave_thompson_085's user avatar
26 votes
Accepted

Will IBM's Condor quantum processor run Shor's Algorithm to crack a 256-bit Elliptic Curve key?

No. The issue here is the distinction between physical qubits and logical qubits. The back of the envelope estimate for Shor's algorithm for a 256-bit elliptic curve is 512 logical qubits, but a more ...
Daniel S's user avatar
  • 23.8k
25 votes

Why is SSL on top of TCP?

why the SSL is not under the TCP ( Transport layer ) ? Because SSL can use TCP [1] to transport SSL records, and so SSL relies on TCP as a service. That is, SSL takes the user data stream, and ...
poncho's user avatar
  • 147k
25 votes
Accepted

Why did TLS 1.3 prohibit PGP authentication?

It seems that PGP certificates have the problem that they can be changed by the user. Furthermore, there were extensions for 1.2 that are incompatible for 1.3 (if they were secure in the first place): ...
Maarten Bodewes's user avatar
  • 92.6k
23 votes
Accepted

Is encrypted e-mail sent over TLS 1.3 a form of "forward secrecy" (similar to something like Signal)?

Forward secrecy is a confusing term that should be abandoned, especially the meaningless but value-loaded variant ‘perfect forward secrecy’. It is especially confusing because it is often associated ...
Squeamish Ossifrage's user avatar
20 votes
Accepted

Why does TLS 1.3 support two CCM variants?

The rationale goes this way: On a "big" system like a PC or a smartphone, ChaCha20+Poly1305 or AES/GCM are very efficient; the latter is fast because the hardware provides dedicated opcodes that ...
Thomas Pornin's user avatar
19 votes

What's the appeal of using ChaCha20 instead of AES?

Unless we find information from Google - such as white papers & mailinglist posts - we can only speculate why ChaCha20 is chosen. I think that efficient software implementation is still the most ...
Maarten Bodewes's user avatar
  • 92.6k
18 votes
Accepted

is TLS compression used in modern browsers?

TLS compression is removed in TLS 1.3. And even for lower TLS versions it is no longer available in the browsers and disabled by default in OpenSSL. Note though that compression at the TLS level is ...
Steffen Ullrich's user avatar
17 votes

Why was AES CBC removed in TLS 1.3?

TLS 1.3 is a reboot of the TLS protocol which focused on up to date cryptography rather than backwards compatibility. Now CBC is not as secure as you make it to be, and the way that it was used in TLS ...
Maarten Bodewes's user avatar
  • 92.6k
16 votes
Accepted

Why is PerfectForwardSecrecy considered OK, when it has same defects as salt-less password hashing?

Salt-less password hashing is only a problem since the amount of passwords actually used in practice is comparably small and also not evenly distributed. Thus it is both in terms of time and memory ...
Steffen Ullrich's user avatar
15 votes

What's the appeal of using ChaCha20 instead of AES?

Quoting RFC 8439 (emphasis mine): The Advanced Encryption Standard (AES — [FIPS-197]) has become the gold standard in encryption. Its efficient design, widespread implementation, and hardware ...
Wtrmute's user avatar
  • 251
15 votes
Accepted

What is different below two Ciphersuites?

The difference is that tls_aes_128_gcm_sha256 is TLS 1.3 and tls_ecdhe_rsa_with_aes_128_gcm_sha256 is used for the older TLS 1.2....
Maarten Bodewes's user avatar
  • 92.6k
15 votes
Accepted

Which block cipher mode of operation does TLS 1.3 use?

TLS 1.3 has huge clean up after failures. We have only 5 cipher suites in TLS 1.3, with their IDs: {0x13,0x01} - TLS_AES_256_GCM_SHA384 ...
kelalaka's user avatar
  • 48.5k
14 votes
Accepted

What's the difference between rsa_pss_pss_* and rsa_pss_rsae_* schemes?

Summary: they aren't different signature schemes. Both specify the use of RSA-PSS. The difference is in how to parse the certificate to find the public key. RSA-PSS (also spelled RSASSA-PSS and other ...
Gilles 'SO- stop being evil''s user avatar
13 votes
Accepted

The difference between MACs vs. HMACs vs. PRFs

A PRF or pseudorandom function family is a family of functions $F_k\colon \{0,1\}^n \to \{0,1\}^m$ such that if $k$ is uniformly distributed, then $F_k$ appears to be uniformly distributed among all ...
Squeamish Ossifrage's user avatar
13 votes
Accepted

The 9 lives of Bleichenbacher's CAT, it puts another scratch again

How does the new attack work at top level? In short They used BEAST-like Man in the Browser attack by using Cache-like attacks to perform a downgrade attack against any TLS connection to a ...
kelalaka's user avatar
  • 48.5k
13 votes
Accepted

Which Diffie-Hellman Groups does TLS 1.3 support? And should we use TLS 1.3 as a guide?

(1) I'm curious whether the following 10 different DH Groups are the only groups that TLS 1.3 supports, Yes, in the sense that TLS 1.3 only allows groups that are explicitly declared as supported in ...
Gilles 'SO- stop being evil''s user avatar
12 votes
Accepted

Best choice out of these six TLS cipher suites

Ideally, you should not use any of them. At all. Here's why. RC4, MD5 and DES should not be used anymore. Old crypto. Toss it. CBC mode in AES sometimes suffers from implementation problems (cf. ...
Bytemare's user avatar
  • 138
12 votes
Accepted

Why would one choose DTLS-SRTP versus just RTP over DTLS?

It's all about encryption overhead; how much the extra data the encryption method extends the packet by. DTLS has a noticeable amount of overhead; the DTLS header alone is 13 bytes, and then you have ...
poncho's user avatar
  • 147k
12 votes

Is Triple DES still considered safe to use?

NIST just recently (11/27/2017) put out a bulletin that Triple-DES will be deprecated in the future, and will be disallowed in protocols like TLS and IPsec, with a future deprecation timeline to be ...
untra's user avatar
  • 121
12 votes

Why is SSL on top of TCP?

The Secure Socket Layer is as the name suggests build on sockets, which provide error free, ordered stream of data. TLS is the differently named successor to SSL; TLS 1.0 succeeds SSL 3. TLS likewise ...
Maarten Bodewes's user avatar
  • 92.6k
12 votes
Accepted

Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3?

TLS 1.3 has a huge clean up as having 5 cipher suites. As stated in the RFC document RFC 8446 section 1.2 : Static RSA and Diffie-Hellman cipher suites have been removed; all public-key based key ...
kelalaka's user avatar
  • 48.5k

Only top scored, non community-wiki answers of a minimum length are eligible