213
votes
Accepted
What are the differences between .pem, .csr, .key, .crt and other such file extensions?
File extensions can be (very) loosely seen as a type system.
.pem stands for PEM, Privacy Enhanced Mail; it simply indicates a base64 encoding with header and ...
82
votes
Accepted
Why doesn't SSH use TLS?
SSH not using TLS is mostly historical; see for instance this answer (on security.SE). In practice, one could perfectly define a sort-of SSH that would use TLS for the data transport part; but, of ...
- 87.7k
76
votes
What's the difference between RSA and Diffie-Hellman?
Diffie-Hellman Key Exchange
Problem: We have a symmetric encryption scheme and want to communicate. We don't want anybody else to have the key, so we can't say it out loud (or over a wire).
Solution/...
- 861
58
votes
Is Triple DES still considered safe to use?
Well, yes and no.
Triple DES using 3 different keys is still considered secure because there are no known attack which completely break its security to a point where it is feasible nowadays to crack ...
- 7,759
54
votes
Why doesn't SSH use TLS?
If by TLS, you mean specifically the series of protocols that is named "TLS", then the answer to why SSH wasn't designed to use them, is quite simple: they didn't exist when SSH was designed. TLS was ...
- 663
49
votes
Accepted
Why was AES CBC removed in TLS 1.3?
Short: CBC mode in context of TLS protocol has had security issues, and would have had to be reworked.
AES-CBC mode combined with decent HMAC can be as secure as AES-GCM. However, combining the ...
- 5,349
35
votes
Accepted
What's the difference between RSA and Diffie-Hellman?
In practice, in situations like TLS, public key encryption will be used to encrypt a secret for encrypting the actual messages, as part of a hybrid cryptosystem. This is done because Asymmetric ...
- 19.8k
27
votes
Accepted
Will IBM's Condor quantum processor run Shor's Algorithm to crack a 256-bit Elliptic Curve key?
No. The issue here is the distinction between physical qubits and logical qubits. The back of the envelope estimate for Shor's algorithm for a 256-bit elliptic curve is 512 logical qubits, but a more ...
- 25.4k
25
votes
Why is SSL on top of TCP?
why the SSL is not under the TCP ( Transport layer ) ?
Because SSL can use TCP [1] to transport SSL records, and so SSL relies on TCP as a service.
That is, SSL takes the user data stream, and ...
- 150k
25
votes
Accepted
Why did TLS 1.3 prohibit PGP authentication?
It seems that PGP certificates have the problem that they can be changed by the user. Furthermore, there were extensions for 1.2 that are incompatible for 1.3 (if they were secure in the first place):
...
- 93.9k
23
votes
Accepted
Is encrypted e-mail sent over TLS 1.3 a form of "forward secrecy" (similar to something like Signal)?
Forward secrecy is a confusing term that should be abandoned, especially the meaningless but value-loaded variant ‘perfect forward secrecy’. It is especially confusing because it is often associated ...
- 49.1k
20
votes
Accepted
Why does TLS 1.3 support two CCM variants?
The rationale goes this way:
On a "big" system like a PC or a smartphone, ChaCha20+Poly1305 or AES/GCM are very efficient; the latter is fast because the hardware provides dedicated opcodes that ...
- 87.7k
18
votes
Accepted
is TLS compression used in modern browsers?
TLS compression is removed in TLS 1.3. And even for lower TLS versions it is no longer available in the browsers and disabled by default in OpenSSL. Note though that compression at the TLS level is ...
- 1,613
17
votes
Why was AES CBC removed in TLS 1.3?
TLS 1.3 is a reboot of the TLS protocol which focused on up to date cryptography rather than backwards compatibility.
Now CBC is not as secure as you make it to be, and the way that it was used in TLS ...
- 93.9k
17
votes
Accepted
Which block cipher mode of operation does TLS 1.3 use?
TLS 1.3 has huge clean up after failures. We have only 5 cipher suites in TLS 1.3, with their IDs:
{0x13,0x01} - TLS_AES_256_GCM_SHA384
...
- 49.3k
16
votes
Accepted
Why is PerfectForwardSecrecy considered OK, when it has same defects as salt-less password hashing?
Salt-less password hashing is only a problem since the amount of passwords actually used in practice is comparably small and also not evenly distributed. Thus it is both in terms of time and memory ...
- 1,613
15
votes
What's the appeal of using ChaCha20 instead of AES?
Quoting RFC 8439 (emphasis mine):
The Advanced Encryption Standard (AES — [FIPS-197]) has become the
gold standard in encryption. Its efficient design, widespread
implementation, and hardware ...
- 251
15
votes
Accepted
What is different below two Ciphersuites?
The difference is that tls_aes_128_gcm_sha256 is TLS 1.3 and tls_ecdhe_rsa_with_aes_128_gcm_sha256 is used for the older TLS 1.2....
- 93.9k
14
votes
Accepted
What's the difference between rsa_pss_pss_* and rsa_pss_rsae_* schemes?
Summary: they aren't different signature schemes. Both specify the use of RSA-PSS. The difference is in how to parse the certificate to find the public key.
RSA-PSS (also spelled RSASSA-PSS and other ...
14
votes
Accepted
The 9 lives of Bleichenbacher's CAT, it puts another scratch again
How does the new attack work at top level?
In short
They used BEAST-like Man in the Browser attack by using Cache-like attacks to perform a downgrade attack against any TLS connection to a ...
- 49.3k
13
votes
Accepted
The difference between MACs vs. HMACs vs. PRFs
A PRF or pseudorandom function family is a family of functions $F_k\colon \{0,1\}^n \to \{0,1\}^m$ such that if $k$ is uniformly distributed, then $F_k$ appears to be uniformly distributed among all ...
- 49.1k
13
votes
Accepted
Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3?
TLS 1.3 has a huge clean up as having 5 cipher suites. As stated in the RFC document RFC 8446 section 1.2 :
Static RSA and Diffie-Hellman cipher suites have been removed; all public-key based key ...
- 49.3k
13
votes
Which hash is used when providing signature algorithm ED25519 or ED448?
Hash algorithms:
Ed25519 uses SHA-512 (As referenced on wikipedia or on bearssl.org)
Ed448 uses SHAKE-256$^1$ (As referenced on bearssl.org)
$^1$ SHAKE-256 is a SHA-3 algorithm, a subgroup of the "...
- 6,502
13
votes
Accepted
Which Diffie-Hellman Groups does TLS 1.3 support? And should we use TLS 1.3 as a guide?
(1) I'm curious whether the following 10 different DH Groups are the only groups that TLS 1.3 supports,
Yes, in the sense that TLS 1.3 only allows groups that are explicitly declared as supported in ...
12
votes
Accepted
Best choice out of these six TLS cipher suites
Ideally, you should not use any of them. At all.
Here's why.
RC4, MD5 and DES should not be used anymore. Old crypto. Toss it.
CBC mode in AES sometimes suffers from implementation problems (cf. ...
- 138
12
votes
Accepted
Why would one choose DTLS-SRTP versus just RTP over DTLS?
It's all about encryption overhead; how much the extra data the encryption method extends the packet by.
DTLS has a noticeable amount of overhead; the DTLS header alone is 13 bytes, and then you have ...
- 150k
12
votes
Is Triple DES still considered safe to use?
NIST just recently (11/27/2017) put out a bulletin that Triple-DES will be deprecated in the future, and will be disallowed in protocols like TLS and IPsec, with a future deprecation timeline to be ...
- 121
12
votes
Why is SSL on top of TCP?
The Secure Socket Layer is as the name suggests build on sockets, which provide error free, ordered stream of data. TLS is the differently named successor to SSL; TLS 1.0 succeeds SSL 3. TLS likewise ...
- 93.9k
12
votes
Accepted
Clarification on the TLS verification process
The article is wrong, but not there. It's the previous sentence that's incorrect. "The first process is to take the signature on the bottom of the certificate and decrypt it with the CA's public ...
- 5,854
11
votes
Best choice out of these six TLS cipher suites
RC4 sucks.
3DES sucks too, but a bit less than RC4.
AES does not suck. The "CBC" part is kinda sucky, but less than 3DES (which has CBC too anyway) and it can be fixed with proper ...
- 87.7k
Only top scored, non community-wiki answers of a minimum length are eligible