SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
5
votes
1answer
186 views
How should I store SSL keys on the server?
I have a Node.JS HTTPS webserver instantiated as follows:
var privateKey = fs.readFileSync('./../ssl/localhost.key').toString();
var certificate = ...
10
votes
1answer
487 views
Is Nokia's “institutional MITM” of SSL traffic vulnerable to CRIME attack?
It's recently been in the news that some Nokia phones proxy all traffic, including SSL connections, through a Nokia proxy. This is effectively an "institutional MITM" attack on users those phones.
...
4
votes
2answers
169 views
How to verify certificate with very little information
Lets assume there is a server and a client and you want to connect those two.
Server has a self-signed certificate, and prior to establishing the connection for the first time (enrollment) the server ...
8
votes
4answers
387 views
Can real end-to-end SSL encryption be made?
I've read the various questions tagged [ssl] and [mitm] and [proxy] and I couldn't find a duplicate.
I've got a very precise question but first I need to give some background.
Basically I'm very ...
20
votes
7answers
1k views
Should I change the private key when renewing a certificate?
My security department insists that I (the system administrator) make a new private key when I want a SSL certificate renewed for our web servers. They claim it's best practice, but my googling ...
7
votes
2answers
85 views
Can other customers on shared hosting see requests from/to my site?
I installed a wiki on my shared webhosting (using Apache) account. This wiki is set to private (no read/edit/create rights for unauthorized users) and I'm the only one with an account.
The wiki ...
1
vote
2answers
102 views
BrowserID and HTTPS conflict?
My flask-webapp was utilizing BrowserId. When I tried to extend my app further by redirecting all incoming requests to HTTPS. The HTTPS redirect worked fine but now the login feature results in a:
...
4
votes
2answers
209 views
Extensions for SSL server certificate
I have some question about the X.509 v3 extensions. What extensions should appear in a proper certificate for a SSL server ?
4
votes
4answers
503 views
Why would someone want to encrypt RSS feeds?
I heard the idea of encrypting the RSS feeds using public key encryption system from someone and since then I am intrigued by the idea. But then I started to wonder what would be the basic need for ...
1
vote
1answer
220 views
IE on Windows 2012 doesn't show certificate or lock icon despite using HTTPS
Can anyone explain why IE on Windows 2012 doesn't show the lock icon despite using HTTPS when visiting the following site?
https://www.microsoft.com/en-us/default.aspx
I am able to see the lock ...
0
votes
1answer
137 views
In SSL/TLS, how is the authenticity of a server's certificate verified?
Quote from an article on computerworld.com:
"The private key is used to sign the server's TLS public key, which
is currently used by browsers to validate SSL certificates."
My understanding ...
3
votes
4answers
202 views
User-to-user encryption in addition to SSL for mobile phones?
I have learned that SSL is a protocol to implement machine-to-machine encryption and that there are protocols, like PGP, which implement user-to-user encryption (end-to-end encryption).
There are ...
2
votes
2answers
124 views
SSL Bit Length History
Sometimes I see web pages advertising a site's support for SSL with a given bit length (commonly 128), and saying that visitors need certain browsers that support this. Is 128-bit SSL common now, or ...
1
vote
1answer
190 views
Is one CSRF token per session is adequate with HTTPS?
Ours is a Ajax heavy application with concurrent Ajax requests. Generating unique tokens with each request or expire and creation of new tokens after a certain interval could get tricky with multiple ...
1
vote
1answer
113 views
Implementing Secure Remote Password with Remote Desktop Application
I had read the Secure Remote Password Protocol paper written by Tom Wu. This protocol is resistant to dictionary attacks. I have also go through some papers regarding to VNC attacks due to weak ...
2
votes
2answers
131 views
Attacks in SSL and SSH
I have a question
Assume that we have two end-host A and B connected by two routers R1 and R2. A wants to send a large file to B.
1) A decides to establish ssh connection with host B using public ...
0
votes
1answer
110 views
Anonymous access over SSL
I am using a paid VPN service and I just realized IP privacy does not exist at all when the connection is made over SSL.
If I Google "what is my ip" using the HTTP version of Google, it will give me ...
0
votes
1answer
51 views
Can IE be made to imitate the behavior of Chrome's KeyGen element?
Is there any way I can repurpose existing ActiveX controls or functionality to get IE to work with the KeyGen element?
Assistance getting Safari to work with this optional HTML5 spec would be ...
1
vote
3answers
317 views
Do client certificates provide protection against MITM?
I'm looking for a way to protect clients from a MITM attack without using a VPN, and ToR. My thought is that client certificates might do the job, but I'm not entirely sure since not too much server ...
1
vote
2answers
120 views
SSL/TLS: Version Change during Renegotiation or Resumption?
Can the version proposed by Client be changed during SSL Resumption or Renegotiation?
Resumption Case:
In case of Resumption, as I understand, Client will send a Client Hello with the Session ID of ...
3
votes
2answers
2k views
Chrome SSL Warning: “You cannot proceed because the website operator has requested heightened security for this domain. ”
I'm trying to go to the URL below, and Chrome warns me that the wildcard certificate is not valid for this domain.
...
2
votes
3answers
196 views
Making a Windows cert say it's purpose is “Ensures the identity of a remote computer”
Maybe this is a superuser.com question, I don't know.
Anyway, I want my cert to show up like this when I double click on it in Windows:
If I just double click on a random cert I get this:
The ...
1
vote
5answers
698 views
how to import a private key in windows
Say I have an X.509 cert and a private key that corresponds to it. I can import X.509 certs easily enough into Windows but what about private keys?
Is the only way I can do that by converting both ...
2
votes
2answers
170 views
Forged SSL without installation of root CA, possible?
Consider visiting a secure website like Gmail. Is it possible to forge the website certificate only by having full control over the internet provider?
I mean is it practically possible for a provider ...
1
vote
4answers
144 views
Secure login feature with low CPU power
I'm developing a program that contains a login function in C++. The problem is that I don't know how to develop it in my situation. I want to run the software on a raspberry pi, it only has a CPU ...
4
votes
2answers
101 views
If two endpoints establish a mutual authenticated connection (TLSv1.0) is the medium between the endpoints a concern?
What are the vulnerable areas when two endpoint connect via TLS? Does the physical layer or data link layer a factor of security concern between the two endpoints? Does it matter in terms of security, ...
2
votes
3answers
546 views
Capturing and decrypting my own SSL traffic
When I use browser or wget to access another site, some sites will only use HTTPS / SSL automatically. When a site doesn't provide content without encryption, how do I capture what my computer sends ...
0
votes
2answers
161 views
How valid is this statement “SSL sit between application layer and network layer”
taken from http://searchsecurity.techtarget.com/answer/How-does-SSL-sit-between-the-network-layer-and-application-layer
The SSL protocol is quite unusual, as it doesn't just operate at one layer. ...
0
votes
3answers
261 views
help understanding client certificate verification
I am creating an API that only certain computers should have access to. Communication will be via SSL between the server and the clients. In order to verify that a client has access, I would like to ...
2
votes
1answer
76 views
how does OpenSSL create X.509 certs from SPKACs?
The SPKAC ASN.1 description:
PublicKeyAndChallenge ::= SEQUENCE {
spki SubjectPublicKeyInfo,
challenge IA5STRING
}
SignedPublicKeyAndChallenge ::= SEQUENCE {
publicKeyAndChallenge ...
1
vote
1answer
67 views
spkac: what is the purpose of the challenge string?
The SPKAC ASN.1 description:
PublicKeyAndChallenge ::= SEQUENCE {
spki SubjectPublicKeyInfo,
challenge IA5STRING
}
SignedPublicKeyAndChallenge ::= SEQUENCE {
publicKeyAndChallenge ...
1
vote
2answers
460 views
KDC(Key Distribution Center) vs Asymmetric Key Exchange
Today I was reading notes about cryptography and I came across a problem that exists in Symmetric Key encryption, which is how to share the secret key across the network.
1st Method :
Make use of ...
3
votes
2answers
162 views
What did the certificate authority do with my CSR?
I needed to reach a web service which is not mine.
The IT department of that web service has asked me to send them a CSR (certificate signing request).
Then, he will send me back a signed certificate ...
3
votes
1answer
52 views
Signing CertificateRequest with special privileges
Well, I am not sure if I specified the question correctly.
While I was browsing web, I checked several SSL certificates and noticed that even Root Certificate doesn't have set all attributes of ...
4
votes
3answers
271 views
What issues arise from sharing a SSL certificate's private key?
Scenario: I am hosting a website for a my client, who we'll call S. S owns the domain s.com and I own the servers that actually host the website. S now wants to enable SSL on their website.
I have ...
3
votes
3answers
2k views
BEAST: IIS6: Failing PCI scan - are these ciphers OK?
Our PCI compliance scanner, TrustWave, have failed our Win 2003/IIS6 site on BEAST because of the following cyphers:
Cipher Suite: SSLv3 : DES-CBC3-SHA
Cipher Suite: SSLv3 : RC4-SHA
Cipher Suite: ...
0
votes
2answers
439 views
openssl, create RC4-SHA certificate
gmail.com Google, fb,... use RC4-SHA.
How does one create RC4-SHA self signed cert ?
Or even with aes128 key ?
I tried using using "genrsa -aes128", resulting cert was DHE-RSA-AES256-SHA
openssl ...
1
vote
2answers
113 views
Configuring IIS SSL for PCI
Is there a clear, concise list of of SSL settings available for IIS which will pass my PCI audit scanning?
Preferably something for both IIS 6 and IIS 7
I'm currently running into BEAST issues but ...
5
votes
1answer
460 views
IIS 6.0 - mitigating BEAST
Recently, my PCI assessor informed me that my servers are vulnerable to BEAST and failed me. I did my homework and I want to change our webservers to prefer RC4 ciphers over CBC. I followed every ...
5
votes
3answers
152 views
How can an outsider tap into communications between two physical sites?
When referring to 'Sites' - I am not talking about a website, but of a physical place where a company resides. Today, to secure communications between two sites - Let's say between an office in ...
1
vote
1answer
168 views
Will RSA parameters be sent in a Server Key Exchange Message in TLS 1.1?
The TLS 1.1 (RFC 4346), the section for Server Key Exchange Message (7.4.3) says
It is not legal to send the server key exchange message for the
following key exchange methods:
RSA
...
1
vote
3answers
208 views
Server Certificates, certificate authority, and servers
I currently have a valid wildcard certificate installed on OS X 10.8.2 server. To make sure we know what I'm talking about the cert is *.domain.com (example only) I'd love to use this to secure as ...
3
votes
3answers
176 views
Public key in SSL protocol
I have gone through many of the posts including My understanding of how HTTPS works (gmail for example). Everywhere it's mentioning that before creating a https connection, the browser verifies the ...
3
votes
3answers
380 views
cookies “secure” flag
How does cookies "secure" attr work to determines whether cookie itself should be included?
e.g.
[HTTP(unencrypted) connection]
1. user has no cookie yet and tries to log in;
2. user logs in ...
15
votes
4answers
773 views
ESET warns: Skype attempting to communicate with unknown remote computer
I am frequently getting warnings from my ESET firewall, like that pictured below, that Skype is attempting to communicate over SSL with a remote computer that has an untrusted certificate:
The ...
1
vote
3answers
443 views
Self sign SSL certificate for my mobile app?
My mobile (iOS and Android) connects to my server via a REST API over HTTP. I would like that HTTP to be secure, so HTTPS seems to be the obvious choice. All of the questions about self signing SSL ...
0
votes
0answers
32 views
Source(s) for getting listed vulnerabilities? [closed]
As I know cve.mitre.org, is one major source from which we can get to know all the listed vulnerabilities (new and old).
Are there any other such sites or databases available?
Also, if I want ...
0
votes
1answer
112 views
Can TLS Compression be enabled on 3rd party CDN sites that have no authentication?
In this answer, @Thomas Pornin talks about remediating the CRIME attack and says:
(It is a shame to have to remove SSL compression, because it is very
useful to lower bandwidth requirements, ...
5
votes
2answers
4k views
Configure SSL to prefer RC4 ciphers over block-based ciphers - BEAST
Our PCI scanners just informed us that we have BEAST (Browser Exploit Against SSL/TLS) Vulnerability
Apparently, the remediation is as follows:
Affected users should disable all block-based ...
1
vote
1answer
85 views
signatureAlgorithm vs. tbsCertificate -> signature
From the X.509 RFC:
Certificate ::= SEQUENCE {
tbsCertificate TBSCertificate,
signatureAlgorithm AlgorithmIdentifier,
signature BIT STRING }
TBSCertificate ::= ...
