17 votes

Are there any practical ways to transfer random data securely?

Is it possible to securely transfer random values in such a way that they are still viable for use in cryptography? Yes and this is done all the time. If you use a TLS_RSA cipher suite, the client ...
  • 31.4k
12 votes
Accepted

Best choice out of these six TLS cipher suites

Ideally, you should not use any of them. At all. Here's why. RC4, MD5 and DES should not be used anymore. Old crypto. Toss it. CBC mode in AES sometimes suffers from implementation problems (cf. ...
  • 136
11 votes
Accepted

What is the most secure ECC Curve?

There is no such thing as the most secure curve. For one you can always come up with a larger curve if you need one. For another there are many measures of security and not all curves are directly ...
  • 31.4k
11 votes

Best choice out of these six TLS cipher suites

RC4 sucks. 3DES sucks too, but a bit less than RC4. AES does not suck. The "CBC" part is kinda sucky, but less than 3DES (which has CBC too anyway) and it can be fixed with proper ...
10 votes

Best choice out of these six TLS cipher suites

None of them are optimal, but only the RC4 ones are clearly broken. RC4 has been deprecated and should be disabled (see RFC 7465). Both 3DES and AES are fine, though the latter is preferable in ...
  • 31.4k
8 votes

Insecure third party connection

There are two facets in the use of TLS-1.0 with TLS_RSA_WITH_RC4_128_MD5. From a cryptographic point of view: TLS-1.0, as a protocol, is not broken. It does a ...
8 votes

X3DH protocol - What are One-time prekeys for?

The short answer is ‘for forward secrecy’, but that glib term obscures the meaning of the property we hope for. Suppose Alice sends a message to Bob. If Alice and Bob both erase the message, what is ...
6 votes
Accepted

X3DH protocol - What are One-time prekeys for?

If no one-time keys are used, the passive side of the key agreement just uses two keys: The identity key $IK_B$ and the signed prekey $SPK_B$. The identity key is a long time key, the signed prekey ...
  • 2,458
5 votes

why do we asume that in the registration process communication is over the secure channel?

Registration phase/process it is always assumed that communication is over the secure/private channel, whereas, all of the phases communication is happening over the public/open channel. What is ...
  • 44.8k
4 votes

What is the most secure ECC Curve?

You might want to look at Ed448-Goldilocks, a new 448-bit Edwards curve that has been approved for use in standards like TLS by the CFRG, designed "as an alternative to both secp384r1 and secp521r1": ...
4 votes

What is the most secure ECC Curve?

Beyond weaknesses in specific curves, it is hard to give a scientific answer to this. Personally, I am quite conservative. I always prefer prime curves over binary field curves. I also think that the ...
4 votes

TLS: Risks of using a NULL cipher with encryption implemented in application?

The problem is that the session keys within TLS are bound to the TLS session. If you just generate your own keys then that particular binding is lost. You might be able to hack or retrieve information ...
  • 86.5k
4 votes
Accepted

TLS Finished message: is it MAC or HMAC

Is it correct to use MAC instead of HMAC for short? In general, no. MAC is a much more general concept than HMAC and thus such an equivalence in saying is clearly inacceptable. However, if you are ...
  • 44.8k
4 votes
Accepted

Secure communication channel recommendations

For this I attach a CRC-32 checksum of the message with the message counter, which is increased after every message sent. Bad Idea. This still allows anyone to arbitrarily flip bits in the plaintext ...
  • 134k
4 votes
Accepted

What is Perfect forward secrecy?

As indicated in Forward Secrecy Article of Wikipedia; In cryptography, forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives ...
  • 44.2k
4 votes
Accepted

Understanding hybrid cryptography's concepts: signing and CA

You're confusing a lot of things: Alice and Bob agrees on a shared private key that is to be used to encrypt You cannot have a "shared private" key; sharing and keeping things private are opposite ...
  • 86.5k
4 votes

Nonce-misuse-resistance scheme applied after the fact to AES-GCM for defense in depth?

What you are doing sounds like piling on complexity of dubious value without a clear understanding of what security the components actually provide, in the hope that enough complexity will render the ...
4 votes
Accepted

Does using Noise asynchronously weaken its security properties?

Online $\neq$ Synchronous Yes, Noise can be used in a somewhat asynchronous setting. Noise is initially meant to be an "online" protocol to establish secure channels, however "online&...
  • 7,286
3 votes

TLS Finished message: is it MAC or HMAC

As far as I know, if PRF are used, then it is HMAC not a MAC. Well, first off, HMAC is a type of MAC. A MAC is a cryptographical primitive with certain security properties (approximately, if you don'...
  • 134k
3 votes
Accepted

What's dh-composite test on badssl.com?

TL;DR: It allows the parameters to be backdoored and the solution is a simple primality test. What exactly is a composite group [and why does it matter]? First, we need to get a quick ...
  • 44.8k
3 votes
Accepted

X3DH Protocol - How can the receiver calculate the Shared Key?

Alice uses Alice's private keys and Bob's public keys. Bob uses Bob's private keys and Alice's public keys. The notation DH(A, B) means that you combine whichever ...
3 votes

What is the most secure ECC Curve?

The curve sect571k1 is not listed in the SafeCurves (http://safecurves.cr.yp.to/rho.html), but in theory it should be the most secure from the "SEC 2 ver2" curves (...
3 votes
Accepted

Any case that can require to encrypt a certificate revocation list before distribution

No. A CRL is as public as the certificate it revokes; it has to be signed to guarantee authenticity, but not encrypted. There are no optional confidentiality requirements for CRL distribution in RFC ...
3 votes

DIY message level security?

Your idea lacks forward secrecy, which protocols like TLS often (in newer versions anyway) offer. Otherwise it is close to how such things are usually done. To get forward secrecy you would instead ...
  • 31.4k
3 votes
Accepted

Establishing a shared secret over a unsecure channel

No if strictly they have no prior knowledge and no secondary secure channel to exchange information. Man in the middle attack will always be possible in this case because the two parties cannot ...
  • 4,068
3 votes
Accepted

Key transport vs key encapsulation?

Key encapsulation or key wrapping is the encryption of a key with another key. There may be a symmetric key or asymmetric key pair that encapsulates the key destined for transportation; this key can ...
  • 86.5k
3 votes
Accepted

Nonce-misuse-resistance scheme applied after the fact to AES-GCM for defense in depth?

The AES-GCM forgery probability bounded by $qL/2^\tau$ where $q$ is the number of messages, $L$ is the maximum message length in 128-bit blocks, and $\tau$ is the length of the tag. Here you've ...
3 votes

5bit ASCII armor with FEC?

Quick and dirty solution: split the ciphertext to be transmitted into blocks with par2 and encode each block using codegroup. Join the blocks together with some unambiguous and easily identifiable ...

Only top scored, non community-wiki answers of a minimum length are eligible