197
votes
Accepted
What are the differences between .pem, .csr, .key, .crt and other such file extensions?
File extensions can be (very) loosely seen as a type system.
.pem stands for PEM, Privacy Enhanced Mail; it simply indicates a base64 encoding with header and ...
80
votes
Accepted
Why doesn't SSH use TLS?
SSH not using TLS is mostly historical; see for instance this answer (on security.SE). In practice, one could perfectly define a sort-of SSH that would use TLS for the data transport part; but, of ...
- 85.6k
70
votes
What's the difference between RSA and Diffie-Hellman?
Diffie-Hellman Key Exchange
Problem: We have a symmetric encryption scheme and want to communicate. We don't want anybody else to have the key, so we can't say it out loud (or over a wire).
Solution/...
- 801
69
votes
What's the appeal of using ChaCha20 instead of AES?
I believe there are three main reasons why ChaCha20 is sometimes preferred to AES.
On a general-purpose 32-bit (or greater) CPU without dedicated instructions, ChaCha20 is generally faster than AES. ...
- 6,714
55
votes
Is Triple DES still considered safe to use?
Well, yes and no.
Triple DES using 3 different keys is still considered secure because there are no known attack which completely break its security to a point where it is feasible nowadays to crack ...
- 7,419
49
votes
Why doesn't SSH use TLS?
If by TLS, you mean specifically the series of protocols that is named "TLS", then the answer to why SSH wasn't designed to use them, is quite simple: they didn't exist when SSH was designed. TLS was ...
- 613
48
votes
Accepted
Why was AES CBC removed in TLS 1.3?
Short: CBC mode in context of TLS protocol has had security issues, and would have had to be reworked.
AES-CBC mode combined with decent HMAC can be as secure as AES-GCM. However, combining the ...
- 5,259
38
votes
Accepted
What is the SSL private key file format?
Copy / paste that key into http://phpseclib.sourceforge.net/x509/asn1parse.php and you'll see that there are several different integers in there. $p$ is there, $q$ is there as is the exponent and ...
- 2,835
34
votes
Accepted
Differences between the terms "pre-master secret", "master secret", "private key", and "shared secret"?
Simplified SSLv3/TLS from this book Note, $R_{(Alice|Bob)}$ is a random nonce chosen by Alice or Bob respectively, and $\{S\}_{Bob}$ is encryption with Bob's public key.
pre-master secret
As stated ...
- 38.1k
31
votes
Accepted
What's the difference between RSA and Diffie-Hellman?
In practice, in situations like TLS, public key encryption will be used to encrypt a secret for encrypting the actual messages, as part of a hybrid cryptosystem. This is done because Asymmetric ...
- 19.4k
27
votes
What is the SSL private key file format?
It is correct that the given private key does not encode a single integer, and that it includes two primes $p$ and $q$. More precisely, that Base64 data encodes a string of bytes, which is an ...
- 130k
25
votes
Accepted
Why did TLS 1.3 prohibit PGP authentication?
It seems that PGP certificates have the problem that they can be changed by the user. Furthermore, there were extensions for 1.2 that are incompatible for 1.3 (if they were secure in the first place):
...
- 88.4k
25
votes
Accepted
Will IBM's Condor quantum processor run Shor's Algorithm to crack a 256-bit Elliptic Curve key?
No. The issue here is the distinction between physical qubits and logical qubits. The back of the envelope estimate for Shor's algorithm for a 256-bit elliptic curve is 512 logical qubits, but a more ...
- 17k
24
votes
Is there a standard for OpenSSL-interoperable AES encryption?
Since this is still open and the issue keeps coming up:
TLDR: There are lots of things in OpenSSL that implement standards including AES, but the key derivation part of ...
- 5,805
24
votes
What is the advantage of AEAD ciphers?
AEAD cipher implementations are generally encrypt-then-authenticate internally (while the CBC ciphers in OpenSSL were not). TLS really was in need to get rid of the authenticate-then-encrypt which ...
- 88.4k
23
votes
Accepted
What's the GCM-SHA 256 of a TLS protocol?
I'll quickly decompose this cipher suite.
TLS - standard starting point
ECDHE - elliptic curve version of the Diffie-Hellman ...
- 45.2k
23
votes
Why is SSL on top of TCP?
why the SSL is not under the TCP ( Transport layer ) ?
Because SSL can use TCP [1] to transport SSL records, and so SSL relies on TCP as a service.
That is, SSL takes the user data stream, and ...
- 137k
23
votes
Accepted
Is encrypted e-mail sent over TLS 1.3 a form of "forward secrecy" (similar to something like Signal)?
Forward secrecy is a confusing term that should be abandoned, especially the meaningless but value-loaded variant ‘perfect forward secrecy’. It is especially confusing because it is often associated ...
- 46.8k
20
votes
Accepted
Why does TLS 1.3 support two CCM variants?
The rationale goes this way:
On a "big" system like a PC or a smartphone, ChaCha20+Poly1305 or AES/GCM are very efficient; the latter is fast because the hardware provides dedicated opcodes that ...
- 85.6k
19
votes
What's the appeal of using ChaCha20 instead of AES?
Unless we find information from Google - such as white papers & mailinglist posts - we can only speculate why ChaCha20 is chosen. I think that efficient software implementation is still the most ...
- 88.4k
17
votes
Why was AES CBC removed in TLS 1.3?
TLS 1.3 is a reboot of the TLS protocol which focused on up to date cryptography rather than backwards compatibility.
Now CBC is not as secure as you make it to be, and the way that it was used in TLS ...
- 88.4k
16
votes
Accepted
Why is PerfectForwardSecrecy considered OK, when it has same defects as salt-less password hashing?
Salt-less password hashing is only a problem since the amount of passwords actually used in practice is comparably small and also not evenly distributed. Thus it is both in terms of time and memory ...
- 1,343
15
votes
Accepted
What is the purpose of pre master secret in SSL/TLS?
The point of a premaster secret is to provide greater consistency between TLS cipher suites. While RSA cipher suites involve the client sending a random 48-byte premaster secret directly to the server,...
14
votes
What is the advantage of AEAD ciphers?
What is the advantage of AEAD ciphers?
That depends one the scheme, but often it means you:
Trust only one algorithm, not two.
Perform only one pass (an ideal in the world of AEAD, not a consequence ...
- 1,864
14
votes
Accepted
The difference between MACs vs. HMACs vs. PRFs
A PRF or pseudorandom function family is a family of functions $F_k\colon \{0,1\}^n \to \{0,1\}^m$ such that if $k$ is uniformly distributed, then $F_k$ appears to be uniformly distributed among all ...
- 46.8k
14
votes
Accepted
What's the difference between rsa_pss_pss_* and rsa_pss_rsae_* schemes?
Summary: they aren't different signature schemes. Both specify the use of RSA-PSS. The difference is in how to parse the certificate to find the public key.
RSA-PSS (also spelled RSASSA-PSS and other ...
13
votes
What's the appeal of using ChaCha20 instead of AES?
Quoting RFC 8439 (emphasis mine):
The Advanced Encryption Standard (AES — [FIPS-197]) has become the
gold standard in encryption. Its efficient design, widespread
implementation, and hardware ...
- 231
13
votes
Accepted
What is different below two Ciphersuites?
The difference is that tls_aes_128_gcm_sha256 is TLS 1.3 and tls_ecdhe_rsa_with_aes_128_gcm_sha256 is used for the older TLS 1.2....
- 88.4k
13
votes
Accepted
The 9 lives of Bleichenbacher's CAT, it puts another scratch again
How does the new attack work at top level?
In short
They used BEAST-like Man in the Browser attack by using Cache-like attacks to perform a downgrade attack against any TLS connection to a ...
- 45.5k
13
votes
Accepted
Which Diffie-Hellman Groups does TLS 1.3 support? And should we use TLS 1.3 as a guide?
(1) I'm curious whether the following 10 different DH Groups are the only groups that TLS 1.3 supports,
Yes, in the sense that TLS 1.3 only allows groups that are explicitly declared as supported in ...
Only top scored, non community-wiki answers of a minimum length are eligible