Tag Info

Hot answers tagged transport-security

Are there any practical ways to transfer random data securely?

Is it possible to securely transfer random values in such a way that they are still viable for use in cryptography? Yes and this is done all the time. If you use a TLS_RSA cipher suite, the client ...
• 31.4k
Accepted

Best choice out of these six TLS cipher suites

Ideally, you should not use any of them. At all. Here's why. RC4, MD5 and DES should not be used anymore. Old crypto. Toss it. CBC mode in AES sometimes suffers from implementation problems (cf. ...
• 136
Accepted

What is the most secure ECC Curve?

There is no such thing as the most secure curve. For one you can always come up with a larger curve if you need one. For another there are many measures of security and not all curves are directly ...
• 31.4k

Best choice out of these six TLS cipher suites

RC4 sucks. 3DES sucks too, but a bit less than RC4. AES does not suck. The "CBC" part is kinda sucky, but less than 3DES (which has CBC too anyway) and it can be fixed with proper ...

Best choice out of these six TLS cipher suites

None of them are optimal, but only the RC4 ones are clearly broken. RC4 has been deprecated and should be disabled (see RFC 7465). Both 3DES and AES are fine, though the latter is preferable in ...
• 31.4k

Insecure third party connection

There are two facets in the use of TLS-1.0 with TLS_RSA_WITH_RC4_128_MD5. From a cryptographic point of view: TLS-1.0, as a protocol, is not broken. It does a ...

X3DH protocol - What are One-time prekeys for?

The short answer is ‘for forward secrecy’, but that glib term obscures the meaning of the property we hope for. Suppose Alice sends a message to Bob. If Alice and Bob both erase the message, what is ...
• 46.1k
Accepted

X3DH protocol - What are One-time prekeys for?

If no one-time keys are used, the passive side of the key agreement just uses two keys: The identity key $IK_B$ and the signed prekey $SPK_B$. The identity key is a long time key, the signed prekey ...
• 2,458

why do we asume that in the registration process communication is over the secure channel?

Registration phase/process it is always assumed that communication is over the secure/private channel, whereas, all of the phases communication is happening over the public/open channel. What is ...
• 44.8k

What is the most secure ECC Curve?

You might want to look at Ed448-Goldilocks, a new 448-bit Edwards curve that has been approved for use in standards like TLS by the CFRG, designed "as an alternative to both secp384r1 and secp521r1": ...

What is the most secure ECC Curve?

Beyond weaknesses in specific curves, it is hard to give a scientific answer to this. Personally, I am quite conservative. I always prefer prime curves over binary field curves. I also think that the ...

TLS: Risks of using a NULL cipher with encryption implemented in application?

The problem is that the session keys within TLS are bound to the TLS session. If you just generate your own keys then that particular binding is lost. You might be able to hack or retrieve information ...
• 86.5k
Accepted

TLS Finished message: is it MAC or HMAC

Is it correct to use MAC instead of HMAC for short? In general, no. MAC is a much more general concept than HMAC and thus such an equivalence in saying is clearly inacceptable. However, if you are ...
• 44.8k
Accepted

Secure communication channel recommendations

For this I attach a CRC-32 checksum of the message with the message counter, which is increased after every message sent. Bad Idea. This still allows anyone to arbitrarily flip bits in the plaintext ...
• 134k
Accepted

What is Perfect forward secrecy?

As indicated in Forward Secrecy Article of Wikipedia; In cryptography, forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives ...
• 44.2k
Accepted

Understanding hybrid cryptography's concepts: signing and CA

You're confusing a lot of things: Alice and Bob agrees on a shared private key that is to be used to encrypt You cannot have a "shared private" key; sharing and keeping things private are opposite ...
• 86.5k

Nonce-misuse-resistance scheme applied after the fact to AES-GCM for defense in depth?

What you are doing sounds like piling on complexity of dubious value without a clear understanding of what security the components actually provide, in the hope that enough complexity will render the ...
• 46.1k
Accepted

Does using Noise asynchronously weaken its security properties?

Online $\neq$ Synchronous Yes, Noise can be used in a somewhat asynchronous setting. Noise is initially meant to be an "online" protocol to establish secure channels, however "online&...
• 7,286

TLS Finished message: is it MAC or HMAC

As far as I know, if PRF are used, then it is HMAC not a MAC. Well, first off, HMAC is a type of MAC. A MAC is a cryptographical primitive with certain security properties (approximately, if you don'...
• 134k
Accepted

What's dh-composite test on badssl.com?

TL;DR: It allows the parameters to be backdoored and the solution is a simple primality test. What exactly is a composite group [and why does it matter]? First, we need to get a quick ...
• 44.8k
Accepted

X3DH Protocol - How can the receiver calculate the Shared Key?

Alice uses Alice's private keys and Bob's public keys. Bob uses Bob's private keys and Alice's public keys. The notation DH(A, B) means that you combine whichever ...
• 46.1k

What is the most secure ECC Curve?

The curve sect571k1 is not listed in the SafeCurves (http://safecurves.cr.yp.to/rho.html), but in theory it should be the most secure from the "SEC 2 ver2" curves (...
Accepted

Any case that can require to encrypt a certificate revocation list before distribution

No. A CRL is as public as the certificate it revokes; it has to be signed to guarantee authenticity, but not encrypted. There are no optional confidentiality requirements for CRL distribution in RFC ...
• 10.2k

DIY message level security?

Your idea lacks forward secrecy, which protocols like TLS often (in newer versions anyway) offer. Otherwise it is close to how such things are usually done. To get forward secrecy you would instead ...
• 31.4k
Accepted

Establishing a shared secret over a unsecure channel

No if strictly they have no prior knowledge and no secondary secure channel to exchange information. Man in the middle attack will always be possible in this case because the two parties cannot ...
• 4,068
Accepted

Key transport vs key encapsulation?

Key encapsulation or key wrapping is the encryption of a key with another key. There may be a symmetric key or asymmetric key pair that encapsulates the key destined for transportation; this key can ...
• 86.5k
Accepted

Nonce-misuse-resistance scheme applied after the fact to AES-GCM for defense in depth?

The AES-GCM forgery probability bounded by $qL/2^\tau$ where $q$ is the number of messages, $L$ is the maximum message length in 128-bit blocks, and $\tau$ is the length of the tag. Here you've ...
• 46.1k