The tag has no usage guidance.

learn more… | top users | synonyms

-1
votes
0answers
14 views

Is 3DES is a weak cipher? [duplicate]

Our application runs on JBoss 6 + jdk 1.7. We use the jdk provided SSL provider. The server.xml file contains SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA in the cipher lists. Is it a weak cipher? Should we ...
0
votes
2answers
61 views

Meaning of mod_ssl cipher suite put together and order of preference

I read cipher suite description of mod_ssl, and understood the meaning of alias and keywords like ! + etc. But I am unable to understand how to read ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW ...
0
votes
2answers
72 views

Encryption in case of distributed architecture

I have application infrastructure as follows - web client -> load balancer -> Apache (web server) -> Weblogic (application server). I could understand that in case of HTTPS request, SSL handshake ...
2
votes
1answer
43 views

Setting node.js TLS ciphers vs observed behavior

I have a node.js server that I'm configuring for TLS 1.2. I set the following options in the config of my https server: ciphers: ...
0
votes
0answers
3 views

Default cipher suite selected by server [migrated]

We have Weblogic application server. Whenever a web browser sent a request, as part of tunnel creation process, it will send a list of preferred cipher suites. Questions: How do I know which is the ...
-3
votes
0answers
21 views

How to disable some ciphers in nsSSL3ciphers command? [migrated]

Referring to Sun Directory Server Man Page Reference, can anybody tell whether - or + is really needed for scenario? I need to: enable only TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, and disable ...
3
votes
3answers
74 views

Cipher used for request data encryption used by browser

Please note that this is not about how SSL communication happens between browser (I researched and understood it) and client but other aspects. Using Digicert's SSL mechanism explanation I have ...
3
votes
3answers
139 views

How do browsers negotiate SSL/TLS connection parameters?

For the purpose of this question, let assume that an SSL/TLS connection has 4 parameters: protocol, symmetric encryption method, asymmetric encryption method, MAC. During the negotiation of SSL ...
1
vote
0answers
51 views

Are there any “best practice” encryption tools for these classifications? [closed]

I appreciate there are different requirements when it comes to protecting data – however to try and get a better feel of the security landscape.... ...when considering the CIA triad: ...
2
votes
2answers
67 views

Secure communication in SHTF

I am a prepper. I am preparing for a situation where there will be no rule of law and where I can't rely on the government for all my needs. This naturally involves storing food, water, and items for ...
1
vote
0answers
63 views

Are there any tools out there that can 'trick' keyloggers?

Are there any tools out there that can 'trick' keyloggers? I was wondering if there's any 'enigma-style' tools available along the lines of providing time-randomised keyboard mappings. For example: ...
3
votes
3answers
180 views

How to pass cipher list to OpenSSL s_client

How we can pass a cipher list to the OpenSSL s_client program? We can pass single cipher by this: openssl s_client -cipher 'ECDHE-RSA-AES256-SHA' -connect www.google.com:443 But how to pass a list ...
1
vote
1answer
70 views

What's RSA and ECC's role in TLS 1.2? [duplicate]

I'm trying to figure out what is RSA and ECC used for in TLS 1.2 cipher suites. Let's take TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 for example, communication between server and client would look ...
2
votes
2answers
111 views

Openssl ciphers: what does Au=ECDH mean?

I am trying to get a grasp on different stages of SSL. I have referred to some fantastic answers about how SSL/TLS works and specifically about authentication mechanisms, and numerous other sources. ...
2
votes
1answer
190 views

Is CVE-2013-2566 a practical attack against RC4 or still conceptual?

Is CVE-2013-2566 a practical attack against RC4 or still conceptual and does it only apply to WPA/TKIP?
1
vote
1answer
68 views

How to change personal cipher/digest preferences of existing OpenPGP key in GnuPG?

The OpenPGP key contains a list of personal algorithm preferences (the meaning of the numbers can be decoded in RFC 4880): # gpg -a --export "foo@example.com" | gpg --list-packets | fgrep 'pref-' ...
0
votes
1answer
205 views

Google Chrome obsolete cryptography

I have a apache server running and following configuration for ssl: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" SSLProtocol -all +TLSv1.2 SSLCompression Off ...
2
votes
0answers
133 views

OpenSSL: Allow CBC ciphers for TLS but prevent for SSL3

In my server application using OpenSSL, to prevent the poodle attack, I added an option to fully allow/prevent SSL3 protocol. SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2); //Prevent SSLv2 ...
1
vote
1answer
93 views

Choosing a cipher and MAC for an SSH connection

The cipher and mac selection according to this are in some sort of order in a config file. How do the client and server know that they are using the same ones though? Is this information exchanged in ...
3
votes
1answer
379 views

DHE_DSS vs. DHE_RSA

I have been studying to learn about various cipher suites and their performance; I'm wondering about the difference between DHE_DSS_AES256_CBC ciphersuites and DHE_RSA_AES256_CBC ciphersuites. I ...
2
votes
1answer
1k views

Creating a private key with OpenSSL and encrypting it with AES GCM

My goal was to create a private key and to encrypt it with a strong cipher. That key would be used as a root certificate for an internal Certification Authority. However, eventhough openssl supports ...
2
votes
1answer
293 views

Does OpenSSH use export ciphers?

With all of this talk of 'FREAK', no one has mentioned OpenSSH. It implements libraries from OpenSSL (until recently, anyway). Why aren't people talking about this? is there even a way to configure ...
14
votes
3answers
970 views

Should I worry if my credit card payment processor's server allows only weak SSL cipher suites?

I tested their server using https://www.ssllabs.com/ssltest/ and, apart from the disappointing "B" rating (it handles financial transactions, after all), the server only allows the following two RC4 ...
0
votes
2answers
153 views

Why use anything other than RSA for transmission encryption?

Being fairly new to the cryptography and data security space, I have sampled a few "Introduction to cryptography" sites/textbooks and they all seem to start in the same general way: This is a Caesar ...
3
votes
1answer
123 views

Does TLS fallback only keep from downgrades to SSLv3?

I have read the RFC on this and can't seem to find what I am wanting to know. When implemented, if a client and a server support TLS fallback protection, does it only keep them from downgrading to ...
0
votes
2answers
189 views

RC4 support in SSL configuration

GitHub recently improved its SSL setup by removing RC4 support: To keep GitHub as secure as possible for every user, we will remove RC4 support in our SSL configuration on github.com and in the ...
2
votes
1answer
131 views

Can TLSv1.0 ciphers be used with SSLv3?

Can TLS cipher, such as TLS_RSA_WITH_AES_256_CBC_SHA, suites be used within an SSLv3 connection? For example, say the client and server both support TLS but the connection is downgraded to an SSLv3 ...
1
vote
2answers
1k views

nginx recommended ssl_ciphers

I am looking for some advice on setting the ciphers for nginx with SSL. What would you recommend for a good compromise between security and compatiblity at the moment? I have made some research but ...
3
votes
1answer
919 views

Which forward secrecy cipher suites are supported for TLS1.0 protocols?

May I know which are all forward secrecy ciphers supported in TLSv1.0 protocols?
2
votes
1answer
116 views

Can TLS fallback work with server side support only?

I have patched my server with OpenSSL 1.0.1j for the Poodle vulnerability. Been reading the spec on TLS_FALLBACK_SCSV. From what I can tell in order for TLS fallback prevention to work properly it ...
5
votes
1answer
860 views

Why does my openssl connection fail with elliptic curve cipher ECDH-RSA-AES128-SHA?

I am using openssl example server and client with specific cipher in ubuntu 14.10 pc. The openssl version is 1.0.1. When I use the RC4-SHA cipher in both sides, the connection is established ...
3
votes
2answers
284 views

Choosing TLS / SSL cipher suites - What considerations are there?

Most of the advice on choosing cipher suites I find tends to be one of these forms: Here's a string to paste into your application, or Here's a list of 30,000-foot generic criteria to use ("favor ...
-1
votes
1answer
74 views

Calculating the breakability of a given encryption method

I will soon be doing a very important project for school. The main goal of my project is to find a mathematical way to calculate the breakability of a given encryption method of ciphertext. Is there ...
7
votes
2answers
2k views

Is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 a safe cipher suite to use?

Is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 a safe cipher suite to use for a TLS 1.2 connection to a Tomcat server? What are potential weaknesses or better alternatives? I am looking for a cipher ...
5
votes
2answers
850 views

In a browser web server communication, who decides which encryption protocol to use [duplicate]

My IE browser has SSLv3.0, TLS 1.0,1.1 and 1.2 enabled in the advanced settings. And (I was informed by my server admin) my web server can encrypt data in SSLv3.0 and TLS 1.0 Now which system ...
3
votes
1answer
2k views

JSSE recommended cipher suites

In the wake of POODLE I am reviewing the configuration of a number of Tomcat servers running on the JSSE connector. In order to work out what ciphers JSSE supported I wrote a little snippet that ...
3
votes
2answers
808 views

Can Poodle be fixed in SSLv3 or will it go the way of TLS compression?

Is TLS_FALLBACK_SCSV going to be the fix for servers that wish to keep SSLv3 enabled? If not what actions are being taken, if any, that address the vulnerability besides disabling SSLv3?
1
vote
1answer
556 views

Poodle - possible to protocol downgrade if SSLv3 is disabled but still have SSLv3 ciphers enabled?

My title pretty much sums it up. If I have: A server with the SSLv3 protocol disabled BUT still have SSLv3 ciphers enabled. Would that mean that a protocol downgrade attack can still occur?
1
vote
1answer
576 views

Can Cipher Suites defined in TLSv1.2 be negotiated by clients that only support TLSv1.0?

If my server has only the cipher suites enabled which are defined by TLSv1.2 does that force a client to also use TLSv1.2 or else not be able to connect or can the connection fallback to TLSv1.1 or ...
1
vote
1answer
2k views

Add Cipher Suite support to Chrome/ Chromoium?

I would like to know how to add Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA support to the new versions of Chrome? Since Chrome v25/26 Google stopped the support of Cipher Suite: ...
7
votes
1answer
13k views

How to disable cipher RC4 in ubuntu 12.04

I have been doing Network Scan for our box and Ncircle reported SSL Server support RC4 ciphers for SSLv3. Based on that I did a search and I plan to add to /etc/apache/conf.d/security the following: ...
4
votes
1answer
2k views

openssl ECDHE-RSA… cipher suite selected while using RSA server cert and ECDSA client cert

The scene: s_server using RSA certificate. s_client using ECC-ECDSA certificate. Client authentication is required (option -Verify set on s_server) Cipher-suite selected after handshake is ...
0
votes
1answer
1k views

How are TLSv1.0 ciphers negotiated as TLSv1.2?

I'm a little confused about something I am reading in Bulletproof SSL. "TLS 1.2 is the only protocol that allows suites to define their PRFs. This means that for the suites defined before TLS 1.2 ...
2
votes
1answer
265 views

ECDSA/RSA certifcates and cipher selection

In this image can someone tell me if a standard RSA certificate can support the EC*_RSA ciphers listed? If so do you create the typical RSA keys when you are creating the CSR? Also I am fairly ...
2
votes
1answer
234 views

Drawbacks to only using TLS 1.2 ciphers in OpenSSL

I understand you would not want to do this as it would limit compatibility for older devices and platforms. However if someone were in an all TLS1.2 environment, say a very well managed internal ...
1
vote
2answers
863 views

Display browser requested cipher suites from OpenSSL

I installed OpenSSL locally and used s_server command to start a server by using self signed certificate created by OpenSSL as well. The command I used to start a https server is OpenSSL> s_server ...
1
vote
1answer
1k views

Using AES as a Stream Cipher

I need to send a lot of small messages that are usually between 128 bits and 256 bits long, and each message is encrypted with a separate 128 bit AES key. Therefore, to send each message with the key ...
5
votes
1answer
727 views

How did SSLv3 get AES?

IANA maintains a registry of TLS cipher suites at TLS Parameters. TLS provides TLS_RSA_WITH_AES_128_CBC_SHA, its value is {0x00, 0x2f}, and its available in TLS 1.0 and above. The AES cipher suites ...
0
votes
2answers
116 views

How secure would this method be considered for password storage

Ok I am currently storing the passwords in most secure way I could think of. With use of Encryption and Hash. The passwords are first generated by user as plain-text with minimum length of 6 ...
0
votes
1answer
945 views

Openssl ciphers SHA384 and AEAD

When running the command: openssl ciphers -v I get a long list of cipher combinations. I'm having issues interpreting some of them. An example is: DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA ...