Tagged Questions

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

13
votes
1answer
9k views

What is the actual value of a certificate fingerprint?

In a x509 digital certificate there is a "certificate fingerprint" section. It contains md5, sha1 and sha256. How are these obtained, and during the SSL connection, how are these values checked for?
22
votes
3answers
24k views

How to fix SSL 2.0 and BEAST on IIS

As you can see on this post TeamMentor.net vulnerable to BEAST and SSL 2.0, now what? the app I'm currently development got flagged for SSL 2.0 and BEAST by SSL Labs. I'm using IIS 7.0 with the ...
2
votes
4answers
746 views

HTTPS Everywhere vs. NoScript

What does HTTPEverywhere gives compared to NoScript with Firefox (Options|Advanced|HTTPS|Behavior)? Why use HTTPEverywhere, when NoScript also can strict websites to use only HTTPS?
3
votes
2answers
127 views

Does site need SSL to resend info to a site that does use SSL?

Let's say I have a website isellchicken.com, this site needs to be able to collect sensitive user information like credit card details. This site will not process the information, but will send it to ...
3
votes
4answers
2k views

Can a session be hijacked if the user is redirected from HTTPS to HTTP after login?

I am developing a web app, which makes HTTP calls as long as the user is not logged in. Once the user clicks the login button, he is sent to a "login page" that is HTTPS. The login makes an Ajax call ...
6
votes
4answers
1k views

Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)

I am making a CA that I hope to be able to sign RSA and Elliptic Curve-capable (EC) keys with. I was wondering if the best approach was: CA with RSA keys capable of signing RSA and EC CSRs CA with ...
1
vote
3answers
418 views

Monitoring and filtering of arbitrary outgoing data

I would like to be able to not just centrally monitor but also filter any organizational data moving out our edge routers, regardless of the sender application and regardless of the protocol/port used ...
5
votes
3answers
765 views

TLS Renegotiation Indication Extension vulnerability

I am trying to understand the TLS Renegotiation Indication Extension from the RFC. I can understand that it is related to the fact that the renegotiation is sent under the encrypted stream, but I ...
3
votes
2answers
979 views

Do you require a special type of certificate for using Diffie Hellman as the key exchange protocol in SSL?

In Diffie Hellman key exchange technique both the parties aggree on a common parameter g then they generate their private parameters a and b . Then they exchange g^a and g^b. now they can calculate ...
0
votes
3answers
213 views

Is HTTPS necessary for password change if user has already logged in with HTTPS?

I notice many websites implementing HTTPS for changes in account information even though the user has already logged in through HTTPS and tracked by SESSION. Is this really necessary?
2
votes
3answers
793 views

Downside of allowing uncertified Certificates

I've seen Firefox poping up the message "Untrusted Connection" where self signed certificates are involved. However, I could not understand what the following means (in bold) : XXXX.XXXX.XXXX:8443 ...
3
votes
1answer
2k views

how do extended validation X.509 certs work?

https://www.forumatic.com/ uses an extended validation cert. wikipedia.org's entry on extended validation certs says that a cert is known to be an extended validation cert if the OID in the ...
2
votes
3answers
10k views

What does these warnings mean on an SSL connection by firefox (only)

I am connecting to a secure site and firefox mentions about identity: Owner: This website does not supply ownership information Verified by: Not specified Technical Details: Connection ...
2
votes
1answer
585 views

Is SSL session based only? Is there a (formal) definition of an SSL connection?

In various docs on SSL there is a mention of connection. But from the context I am not sure if this means the underlying TCP connection or the SSL connection. I am thinking that there is no SSL ...
2
votes
1answer
335 views

secret key compromise in SSL vs in Kerberos

Consider the consequences of compromise of a secret key in the Kerberos system vs. in SSL. For example, suppose your individual shared secret key (for your user account) becomes compromised (i.e. it ...
0
votes
1answer
718 views

URIs in the subjAltName X.509 extension

The subjAltTag extension for X.509 certificates can take in domain names, email addresses, URIs, etc. I was playing around with an X.509 whose subjAltTag had just a URI in it doesn't seem to work. ...
2
votes
3answers
2k views

Why different key exhange techniques for ssl key exchange?

During ssl key exchange, I have read that sending the symmetric key to the server encrypted with the server's public key is an old technique. Now for key echange Diffie hellman and other techniques ...
0
votes
2answers
642 views

SSL/TLS Protocol Description

It may seem crazy to you, but I wasn't able to find any detailed description of these security protocols on the web (except wikipedia). Can you point me out some documentation of the protocols ...
2
votes
1answer
180 views

Browsers and export regs. Is SGC still valid?

I was reading a rather "dated" book on SSL/TLS, which mentions about International Step Up certificates and Microsoft's Server Gated Certificates which were the way arround the US export rules for ...
1
vote
1answer
437 views

How to use sslstrip with Internet Connection Sharing?

I'm trying to make sslstrip work with Internet Connection Sharing.ve shared internet connection to router and another pc connected to that router, all are Linux, so Internet <-> pc1 <-> ...
4
votes
8answers
2k views

how can you view an HTTP request in transit?

In Google Chrome, sometimes you will see the https: protocol in the URL bar with a red strike through it. Clicking on the info button says that not all elements on the page are encrypted, and may be ...
17
votes
1answer
9k views

My understanding of how HTTPS works (gmail for example)

I want to ask if my below understanding is correct or not regarding the HTTPS used for the webpage we are visiting. I will use Gmail as an example: My laptop tries to connect to the Gmail server ...
6
votes
7answers
4k views

What is the danger of hosting your SSL certificate yourself?

I have Active Directory Certificate Services on my server, which makes it possible for me to deliver an SSL certificate for the websites hosted on the same server. I know that normally, I need to ...
4
votes
2answers
3k views

Is it possible to connect to a proxy with an ssl (or otherwise encrypted) connection?

What i want to know is whether it is possible to connect to a proxy with an ssl (or otherwise encrypted) connection? (I'm suspecting this is possible because TOR encrypts user connections to it's ...
3
votes
1answer
552 views

exponent value in certificates

I have seen that in gmail, there are 3 certificates in hierarchy. I noticed that all the certificates have the same exponent(65537 with 24bits). Why is the exponent value same for all certificates and ...
3
votes
4answers
21k views

how safe is the 256 bit encryption used in bank transactions

Most of the banks use a 128 bit or 256 bit encryption. What does this mean? Does it mean that the keys used in ssl are 128 bit long or what? If they are the ssl key lengths then 128 bit rsa keys are ...
2
votes
1answer
304 views

Is there a way to identify the client using SSL Handshake Messages?

I have an SSL Server and it can be connected by two types of Clients, one for which Client Authentication is needed and the other for which Client Authentication is not needed. Is there any mechanism ...
1
vote
2answers
317 views

Really secure webmail

If I'm feeling paranoid about the CCDP (UK) - requiring ISPs to intercept communications across the internet - then what would be the most secure approach to a webmail system? Obviously, there's some ...
48
votes
4answers
13k views

Are all SSL Certificates equal?

After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against. Are all SSL ...
3
votes
3answers
1k views

How safe is RSA generated public-private key pair?

If one has been using the same set of public-private key pair for quite sometime now, given his public key(which is public), can't an attacker find the corresponding private key for that public key by ...
2
votes
4answers
7k views

How commonly are SSL/TLS or S/MIME used by e-mail providers?

I was reading through different posts here about email security. After reading these I still have some questions. I understand that S/MIME can be used to transfer email securely between servers. ...
4
votes
2answers
949 views

Is DIGEST-MD5 secure if done over HTTPS?

If the DIGEST-MD5 negotiation is done over an HTTPS connection instead of HTTP, does that prevent this list of disadvantages from Wikipedia?: Digest access authentication is intended as a security ...
11
votes
3answers
2k views

Difference between Certificate Authorities

I've been wondering for a long time about is. There are many certificate authorities having different types of certificates. But even certificates of the same security level cost a lot more with one ...
19
votes
5answers
1k views

Is it alright to tell everyone your encryption information?

I have an account in an online banking system and they have the FAQ with something like this: How secure is the <Online Banking System Name>? Each page you view and any information ...
0
votes
3answers
906 views

Reply to SSL Handshake Request with a 302 Response

Is it possible to respond to an SSL Handshake request by sending back a http 302 redirect without making the browser mad? I would like to immediately redirect to a different site upon receiving the ...
4
votes
1answer
591 views

SSL protocol issues on OS X and iOS

I have a PfSense box as a UTM, running snort among other things. I started noticing that when MacBooks and iPhones/iPods connect to my network, the snort log gets flooded with this message: ...
2
votes
2answers
822 views

What if a browser does not understand the secure flag of cookie

I have two questions related to the same: 1 - As 'Httponly' attribute is understood by a set of modern browsers (https://www.owasp.org/index.php/HttpOnly#Browsers_Supporting_HttpOnly), I was ...
4
votes
1answer
321 views

Facebook user data encryption

In my country, Austria, a telecommunications data retention law will be executed starting at April 1. Internet carriers are required to store connection data (from which computer to which server), but ...
6
votes
2answers
3k views

Google Analytics on a secured site

Just read this article on Google Analytics and the risk of forged certificates, where it said: Sooner or later it's going to happen; obtaining forged SSL certificates is just too easy to hope ...
1
vote
1answer
108 views

valid intermediate certs not in browser

Say an X.509 cert is signed by an intermediate cert that's not in your browser. Maybe the root certificate is but not the intermediate cert. At that point it seems like a valid certification path ...
2
votes
3answers
4k views

How does bidirectional authentication using SSL work?

Let's say Alice wants to use a webservice on Bob. Bob is on bob.in.wonderland.com Alice opens a connections to bob.in.wonderland.com:443. Taken by DNS magic rabbit, Alice arrives on port 443 at ...
3
votes
3answers
322 views

Dedicated Server in Cloud Environment - SSL Remote Login vs Dedicated VPN

Thanks for taking your time to look into this question. Background I have my website hosted in a dedicated server in the cloud. The server is a Windows 2008 R2 machine. To publish I FTP files to ...
9
votes
2answers
2k views

Is IP spoofing relevant to TCP? Is it relevant for TLS or SSH?

I have read the TCP Connection Establishment on Wikipedia In brief the packets to start are SYN, with a (hopefully) random sequence number A from the client. SYN-ACK, responding, with A+1 and ...
2
votes
2answers
111 views

Does TLS-OBC only improve security of Web Browsers? Does it improve the security of SSH?

I'm studying the TLS-OBC extension and would like to know if it improves security of non Web-based protocols? Specifically, would it be of any benefit to SSH clients? (version 1 or version 2.x/secsh) ...
5
votes
1answer
216 views

What issues might exist with TLS-OBC's emulation of Browser Certificates?

TLS-OBC is an RFC proposal that increases SSL/TLS security by using certificates on both ends of the TLS connection. What's special here is that the client is permitted to dynamically create a local, ...
1
vote
2answers
173 views

SSL/TLS Certificate Authority supply policy

I would like to ask for recommendations regarding the following issue: As a company with a number of customers worldwide we supply our product to many different sites. We need to shape our policy ...
3
votes
2answers
206 views

self-signed certs that aren't the final certificates in the path

The X.509 spec makes frequent statements like this: (b) If certificate i is self-issued and it is not the final certificate in the path, skip this step for certificate i. How can you have ...
8
votes
2answers
618 views

X.509 certificate policies question

I asked another question about certificate policy mappings. This is a different issue. This is about Certificate Policies. To quote from the X.509 RFC: In an end entity certificate, these ...
2
votes
1answer
530 views

X.509 certificate policy mapping question

So I'm a little confused how X.509 certificate policy mappings work. So let's say the following depicts my cert chain: root CA ---> intermediary CA ---> client cert Would the root CA have a ...
8
votes
3answers
842 views

Is a mobile app more secure for mobile use than the “normal” website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...