Tagged Questions
4
votes
1answer
115 views
Decrypting TLS in Wireshark when using DHE_RSA ciphersuites
How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
1
vote
1answer
69 views
SSL Communication and Proxy
Let us say that I have a client and a server communicating using SSL.
If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?
4
votes
3answers
99 views
What SSL options should not be used?
What SSL options should be avoided, due to recently discovered weaknesses? This might include symmetric algorithms, or MAC functions.
2
votes
2answers
90 views
Looking for general guidance on securing web API application for client applications and users
I have a web service built with WebAPI that accepts JSON requests and responds accordingly. The core architecture is built but there isn't any authentication/authorization.
After a lot of googling ...
0
votes
3answers
45 views
Is connection to keyserver encrypted?
When you retrieve someone's information from a keyserver to add him to your pgp keyring, that is made through unencrypted keyservers, unless the user uploaded it to https://keyserver.pgp.com/. Even ...
3
votes
5answers
299 views
Does the padlock on my browser really indicate a reasonable assurance against eavesdropping?
I know that there have been broken or weak SSL implementations. Do browsers actually have decent standards for what they'll accept and display "the padlock"?
Furthermore, are there any practical ...
0
votes
1answer
102 views
Is this a secure method for authenticating clients?
I am working with several other people in writing software which requires authentication before it accesses resources. In order to authenticate, we devised the following strategy.
Client sends a ...
2
votes
1answer
150 views
ECDHE_RSA and gmail
I'm using Chrome on Ubuntu Linux to connect to Gmail. The connection info says that ECDHE_RSA is used for the https symmetric key exchange.
Based on my understanding of TLS and Gmail, my client ...
0
votes
2answers
57 views
How can I set up signed downloads?
Scenario
I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
3
votes
3answers
129 views
Is it safe to mix authentication methods?
Is it a good idea to "combine" authentication methods?
Example we can use username/password method to authenticate a user from a server.
What if we used this as a first authentication step to get ...
8
votes
3answers
269 views
How practical/important is the Lucky Thirteen TLS attack?
I was reading this article which talks about a new attack against TLS being called Lucky Thirteen. It claims to allow repeatable MitM attacks against HTTPS connections.
It's described as being fairly ...
2
votes
1answer
124 views
How to secure or (Ensuring Integrity) of Web Data in transit and in store?
Consider (usual scenario) You own a Shopping Cart Website and hosted on Internet, now, your hosting company provides you database to store your data.
If talking about security, we need it for:
...
3
votes
4answers
264 views
Can an attacker reuse stolen SSL private key to recreate that domain on his server
Say my domain (https://example.com) SSL private key has been stolen and was not protected by a passphrase then.
Can the attacker uses that key and certificate to host the same
domain on different ...
0
votes
2answers
144 views
“Premium SSL” vs “Stanard SSL” certificates - Any reason why I would want a “Premium SSL”? [duplicate]
Possible Duplicate:
What are the advantages of EV Certificate?
besides the green URL bar and free security scan and whatnot.
Our website does NOT accept any personal info other than email ...
0
votes
1answer
118 views
Is TLS secure when full eavesdropping on the network occurs? [duplicate]
Possible Duplicate:
How is it possible that people observing an HTTPS connection being established wouldn’t know how to decrypt it?
Alice connects to Bob's site via a TLS secured connection ...
2
votes
2answers
235 views
How does Chat monitor work,if we use encrypted service like gtalk
i have heard that there are software like this http://formessengers.com/mdetect.htm that monitor Chats and can see the chat logs,but how do these kind of software work if we are using services like ...
4
votes
1answer
281 views
What changed between TLS and DTLS
What did the DTLS (TLS over UDP) authors have to change so that it could run without TCP?
Bonus points:
Do any of the protocol difference affect the way it should be used, both in terms of interface ...
6
votes
4answers
186 views
Is it possible for a third party to sniff data off the line to an ISP and determine what the user is doing?
Can somebody hack the line between my router and service provider and monitor what I'm doing online and what sites I'm visiting?
1
vote
0answers
242 views
How can Nokia decrypt HTTPS data? [duplicate]
Possible Duplicate:
Can real end-to-end SSL encryption be made?
Regarding this piece of news, I wonder how can Nokia so easily decrypt HTTPS data?
As I understand the data is encrypted by ...
3
votes
4answers
202 views
User-to-user encryption in addition to SSL for mobile phones?
I have learned that SSL is a protocol to implement machine-to-machine encryption and that there are protocols, like PGP, which implement user-to-user encryption (end-to-end encryption).
There are ...
1
vote
4answers
143 views
Secure login feature with low CPU power
I'm developing a program that contains a login function in C++. The problem is that I don't know how to develop it in my situation. I want to run the software on a raspberry pi, it only has a CPU ...
4
votes
2answers
101 views
If two endpoints establish a mutual authenticated connection (TLSv1.0) is the medium between the endpoints a concern?
What are the vulnerable areas when two endpoint connect via TLS? Does the physical layer or data link layer a factor of security concern between the two endpoints? Does it matter in terms of security, ...
1
vote
2answers
456 views
KDC(Key Distribution Center) vs Asymmetric Key Exchange
Today I was reading notes about cryptography and I came across a problem that exists in Symmetric Key encryption, which is how to share the secret key across the network.
1st Method :
Make use of ...
3
votes
3answers
176 views
Public key in SSL protocol
I have gone through many of the posts including My understanding of how HTTPS works (gmail for example). Everywhere it's mentioning that before creating a https connection, the browser verifies the ...
12
votes
3answers
456 views
How secure is aSSL (javascript)? Does it effectively mimic SSL?
Some of you may be familiar with the aSSL project, which uses AJAX/PHP to mimic the SSL protocol. It uses RSA 512 or 1024 for the keys, and AES for the actual data. It looks impressive to me in ...
5
votes
1answer
182 views
Most efficient key algorithm for a TLS server key?
Let's assume I want to setup a HTTPS service on a modern-but-no-so-speedy x86 server without any form of hardware cryptographic accelerator.
Which key algorithm should I choose for the server key in ...
1
vote
0answers
81 views
Why not buy cheap SSL certificates? [duplicate]
Possible Duplicate:
Is there any technical security reason not to buy the cheapest SSL certificate you can find?
The comparison in Godaddy's website, makes it clear: they're just cheaper ...
3
votes
1answer
150 views
What are the Netscape Cert Type attributes? Why/when are they needed?
What are the Netscape Cert Type attributes in a X.509 Certificate and how are they different with the X509v3 extensions?
Example:
There is the Client/Server Extended Key Usage (X.509) but there is ...
0
votes
2answers
117 views
Analyzing SSL encryption
I have to analyze SSL encryption in my test network and want to prove the transported data is encrypted. What methods can I use to prove encryption is in place?
6
votes
3answers
173 views
What risks would exist in transmitting an encrypted PKCS12 via Https
I have a scenario in which I would like to automate the deployment of client certificates generated by an issuer I control. The approach I am considering is given below, and I would appreciate ...
3
votes
1answer
60 views
CMC (RFC 5272) compatible CA server
I need a CA server or any tool that supports Certificate Management over CMS (CMC) format, described in RFC 5272 (RFC 2797). I need a possibility to generate different Full PKI requests and responses ...
2
votes
3answers
186 views
Without SSL, what vantage point does one need to MITM non-SSL'd HTTP?
OK, so there are two things here: being able to read the content of the requests and responses, and then being able to modify them. The former may depend on the latter, I'm not sure.
But basically, ...
3
votes
2answers
128 views
Unecrypted connection to server - safe?
I am using heroku and cloudflare. I am going to release my website but I don't want do it without SSL.
Now I always need an heroku addon to add my SSL certificates which costs $20/month.
Cloudflare ...
7
votes
4answers
1k views
Where does SSL encryption take place?
I checked the data transmission of an HTTPS website (gmail.com) using Firebug. But I can't see any encryption to my submitted data (username and password). Where does SSL encryption take place?
2
votes
2answers
102 views
What number of bits does a browser use to generate a key?
The question comes from the accepted answer in this thread:
My understanding of how HTTPS works (gmail for example)
The Gmail server sends your client a certificate.
The certificate includes the ...
10
votes
3answers
6k views
Understanding 2048 bit SSL and 256 bit encryption
On DigiCert's page, they advertise a 2048 bit SSL with a 256 bit encryption: http://www.digicert.com/256-bit-ssl-certificates.htm
What exactly is the difference here and why are two encryption bits ...
1
vote
3answers
270 views
Is SSL Tamper Detectable?
I know how SSL provides security against people reading your messages - by encryting the message with a SYMMETRIC KEY, which was exchanged during SSL Handshake with the help of ASYMMETRIC KEYS. But I ...
1
vote
2answers
1k views
Avast says I don't need to use encrypted connections for my e-mail accounts
I am using Outlook 2010 and Avast anti-virus 7. Whenever I add an account to Outlook if I choose to use SSL for incoming or outgoing connections Avast alerts me I shouldn't use it because Avast can't ...
6
votes
3answers
307 views
How secure is HTTPS with weak ciphersuites?
Today I came across the website https://mtgox.com/, which claimed to be secure because of the Verisign certificate. I checked the certificate out of curiosity (it's the first thing they claim, let's ...
4
votes
1answer
137 views
How does my antivirus determine which CTL is used?
I have imported a trusted root certificate into the Windows local machine list. This works fine with my signed certificates, unless my AV (Bitdefender Antivirus Plus 2012) is set to "scan SSL", in ...
23
votes
9answers
1k views
Is there any technical security reason not to buy the cheapest SSL certificate you can find?
While shopping for a basic SSL cert for my blog, I found that many of the more well known Certificat Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
3
votes
1answer
150 views
Are SSL Certificates (Private and Public key) generated by OpenSSL and makecert compatible?
Are RSA SSL Certificates (Private and Public key) generated by makecert compatible with OpenSSL decryption ie. can I decrypt them with the openssl_* methods? I am working on two-way SSL authentication ...
5
votes
1answer
152 views
SSL CipherSuite Choices
In SSL/TLS, is the CipherSuite chosen by the server or the client? Also, can the certificate in any way dictate or modify the CipherSuite?
9
votes
2answers
696 views
How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption?
http://www.channel4.com/news/black-boxes-to-monitor-all-internet-and-phone-data
http://rt.com/news/uk-privacy-internet-freedom-186/
'Black boxes' will be installed by internet services providers ...
0
votes
2answers
219 views
How to safely collect bank account from website?
I want to collect bank account information from my customers on my website.
I'd like to do that through a form, then I will download it to a PC, print it, and then delete it from the website. Or ...
2
votes
1answer
46 views
Does SGC Support reduce HTTPS security?
Server Gated Cryptography is a legacy technology (implemented by obsolete laws) that allows older browsers to establish a SSL session at a higher encryption.
This article says SGC should never be ...
4
votes
3answers
307 views
What does it mean for a digital certificate to be “signed”?
When someone says that a particular digital certificate (like an SSL cert) has been "signed with a key", what does that imply? Does that mean the certificate simply includes a key that should be used ...
6
votes
3answers
378 views
Is TLS flawless enough to prevent eavesdropping carried out by an ISP?
I would like to "secure" my email, http servers and desktop client by connecting exclusively over TLS, be it email, in/out:80 or just regular "web surfing" traffic.
Will that prevent ISP and ...
4
votes
3answers
148 views
Is using encryption the only viable option to thwart password sniffing?
I'm using HTTPS Everywhere on my browser to chose SSL versions of websites when available, but many sites don't offer a secure version. Is SSL the only viable option to thwart password/clear text ...
0
votes
1answer
204 views
GoogleMail encryption
Gmail provides an SSL connection and also encrypts the entire session by default. But if you send a mail, once it leaves gmails servers, it can be read at any point on the internet. But what about ...
