Questions tagged [tls]
SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.
674 questions
1 vote
0 answers
71 views
Why does TLS 1.3 derive MS from dHS instead of using dHS directly? Also, why is dHS used as salt instead of as an input key?
I am trying to understand the rationale behind the design choices in TLS 1.3, and am stuck on a couple points regarding the derivation of the master secret ($\mathsf{MS}$) from the derived handshake ...
- 11
0 votes
1 answer
67 views
Questions about TLS 1.3 Server Hello in Matrix Protocol Traffic (Wireshark Capture)
I’m analyzing a Matrix protocol connection and captured its traffic in Wireshark. In the TLS handshake, I looked at the Server Hello message and came across a few confusing things: -The "Change ...
- 181
2 votes
1 answer
92 views
Is ECDSA_SHA1 signature scheme supported in TLS 1.3?
I am writing a TLS client which advertises all IANA registry parameters. One such TLS parameter in the registry is ECDSA_SHA1 which is a signature scheme supported for TLS 1.3 communication. Now, my ...
- 23
3 votes
0 answers
86 views
What are the backward compatibility issues with increasing the TLS 1.3 record size for post-quantum cryptography?
This is a bit of a follow-up question to What are the design-level constraints in TLS 1.3 for post-quantum adoption? The IETF draft to increase the TLS 1.3 record size to accommodate larger post-...
- 18.2k
1 vote
1 answer
173 views
What are the design-level constraints in TLS 1.3 for post-quantum adoption?
To be more specific: How do the structural design choices in TLS 1.3 (such as message flow, handshake compression, and record layer framing) interfere with or limit the integration of large post-...
- 18.2k
1 vote
1 answer
132 views
Is SPHINCS+ viable for authenticating websites?
After seeing the number of entrants in the NIST PQCS that were broken and after considering that hash-based signature schemes are more studied, I've concluded that SPHINCS+ is a safer bet for digital ...
- 4,328
2 votes
1 answer
217 views
Cost of TLS (1.3) Handshake using RSA compared to cost of using ECC?
In the TLS 1.3 handshake, the server has to sign stuff in its Hello, and the client has to verify the server's certificate and the signature which uses the certified key. I'm guessing that's a ...
- 121
6 votes
1 answer
142 views
How has WhatsApp addressed group member authenticity and forged acknowledgements since the 2018 "More is Less" paper?
I’ve been reading the 2018 paper “More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema”, which outlines several interesting vulnerabilities in the group messaging ...
- 181
0 votes
0 answers
49 views
Is TLS1.2/3 + PSK recommended for future products?
I have build multiple embedded devices with TLS1.2/3 + PSK using mbedtls and wolfssl libraries. My products have been with microcontrollers(ESP32, Silicon labs, etc.) and OpenWRT based Linux products. ...
- 101
1 vote
0 answers
72 views
TLS 1.2 Server finish message packet error
Working on TLS1.2 on cipher suite ECDHE_RSA_AES_256_GCM_SHA384. On the server side, currently at the stage of server finish message. Always getting alert message.(Encrypted). And client closes. What I ...
- 21
1 vote
1 answer
151 views
Clarification in TLS 1.2 key derivation process
Using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 in tls 1.2 handshake. Reference to TLS 1.2 standard documentation regarding the key generation. And the question 50815 (Clarification needed in TLS 1.2 key ...
- 21
0 votes
2 answers
162 views
Hash calculation for TLS 1.2 Finished message
I'm trying to understand the data that go into a TLS "Finished" handshake message. At present I'm focused on TLS 1.2 -- if I can't get that right then there's no point in looking at other ...
- 1
2 votes
1 answer
149 views
why there is a need to send iv with cipher text?
From what I understand by reading TLS 1.2 RFC (key calculation), PRF is used for this with the master key to derive the IV, so both side can generate the same IV because of the nature of PRF. ...
- 123
1 vote
1 answer
215 views
Preventing BEAST by using authorisation header instead of cookies
Historical question as BEAST is mitigated in TLS 1.1 and earlier TLS is deprecated. BEAST is a chosen plaintext attack, possible in web browsers because cross-origin requests have cookies ...
- 125
1 vote
1 answer
240 views
When was EDH key exchange introduced to SSL/TLS?
I'm putting together a talk on the history of SSL/TLS and one detail I can't find info on is when DHE key exchange was introduced. If someone was able to point to an RFC or OpenSSL version that would ...
- 125