7
votes
3answers
191 views

According to RFC 5246, are nonces in TLS useless (in terms of security) and if yes, why aren't they only random data?

I know the common usage of nonces in security (which is well described in this topic). However, when checking the SSL/TLS protocol, we can notice, according to the RFC, that nonces as ...
9
votes
1answer
3k views

SSL replay attack when client/server random is missing

Hey studying the SSL protocol, I'm wondering how can someone be able to do a replay attack if the server nonce is missing? All the material I find says that nonces prevent it, but theres no examples ...
9
votes
1answer
2k views

TLS replay attack - requirements of the serverHello nonce

As you all know, the SSL/TLS protocol requires both client and server to exchange (in clear text) a random number or nonce. This is presumably used to prevent replay attacks. It is not clear to me ...