SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (3)

1
vote
1answer
9 views

VoIP call security: How does encrypting signalling protocol (SIP) protects RTP?

Checking the data packets from many VoIP applications shows that SIP packets are encrypted with TLS. So the captured session shows no SIP signals at all, just simple TCP and TLS/SSL packets. But ...
1
vote
2answers
35 views

SSL certificates and cipher suites correspondence

I have been learning about the SSL/TLS protocol (from https://tools.ietf.org/html/rfc5246) and have a few conceptual questions about the protocol. Q1) The client and server exchange "hello" messages ...
0
votes
2answers
19 views

Must a Diffie-Hellman group value persist?

I've been reading about the Logjam attack on Diffie-Hellman and about how to secure our TLC-based web servers based on the recent findings. The guide suggests that we create a Unique Diffie-Hellman ...
3
votes
2answers
59 views

Obsolete cryptography (SHA1) warning although certificate uses SHA256

I ordered a certificate with SHA256 from Comodo and was wondering why Chrome shows this message: Your connection is encrypted with obsolete cryptography. The connection is encrypted using ...
1
vote
0answers
39 views

Perform SSL MITM -> Decrypt packet -> Modify packet -> Encrypt packet -> Send it

I have a victim and a server. My goal is to intercept traffic, perform SSL MITM, decrypt packet, modify it, encrypt and send it further. Everything has to be on-the-fly and protocol agnostic. For now ...
0
votes
0answers
23 views

SHA-2 migration considerations

due to SHA-1 being in the path of deprecation, i will be migrating my SSL certs to SHA-2. Besides creating CSR using SHA-2 for signing, what other considerations should I take note of? I believe one ...
1
vote
2answers
56 views

Are there any security disadvantages of using production SSL certificate in non-prod environments?

My client has a wildcard certificate *.thierdomain.com that they are using for half a dozen of production web sites. For each of theses sites there are duplicates in several environments, dev, qa, ...
0
votes
1answer
62 views

What exactly does ipsec and ssl do?

Im trying to figure out how SSL and ipsec works. I know the process in both SSL and ipsec but why do I need SSL if I can use IPsec when it runs below the transport layer. Wont IPsec encrypt everything ...
-2
votes
1answer
33 views

IP hijacking during SSL

I was wondering, does SSL protect from IP hijacking (an active, authenticated connection between two hosts is disrupted and the attacker takes the place of one of the hosts) and how?
2
votes
2answers
38 views

Certificate chaining:Intermediate Certificate Authorities

Wikipedia says: For example, if a certificate issued to "example.com" and issued by "Intermediate CA1", and the visiting web browser trusts "Root CA", trust may be established in the following manner: ...
0
votes
4answers
250 views

Is end to end email encryption possible without unique domain/subdomain for each user?

Lets say Alice@gmail.com wants to send message to Bob@secureMail.com Alice <--> gmail.com <--> secureMail.com <--> Bob We know gmail.com can read the unencrypted message. Is it possible for ...
1
vote
1answer
96 views

Why does Google.com still support SSL v3?

The POODLE vulnerability was discovered by Google in October 2014, and unlike heartbleed, it had a simple solution: just disable SSL v3. Now, most of the websites have disabled SSL v3 but ironically ...
0
votes
2answers
50 views

Hijack attacked SSL/TLS-connections?

I think we all heard the news that China used unencrypted HTTP-connections to drive DDoS attacks on targeted websites. Now within the last few months we've learned about three new attacks ...
0
votes
1answer
24 views

How ECDHE is signed by RSA in ECDHE_RSA cipher

About ciphers that use ECDHE as Key Exchange and RSA as Authentication: How exactly this two algorithms work together, is ECDHE process encrypted by RSA public key? What are the DH parameters? ...
1
vote
2answers
42 views

Is SSL over HIP (Host Identity Protocol) possible?

In this relatively short Host Identity Protocol (HIP) overview Host Identity Protocol: Identifier/Locator Split for Host Mobility and Multihoming it is stated Most Internet applications can run ...
2
votes
1answer
62 views

Does SSL or HIP solve all TCP/IP security problem?

I recently read this paper "A Look Back at Security Problems in the TCP/IP Protocol Suite" (https://www.cs.columbia.edu/~smb/papers/acsac-ipext.pdf) explaining few attacks at the TCP/IP stack. One ...
1
vote
1answer
51 views

creating a TLS encrypted API

I have an HTTP API endpoint on my server that is encrypted (TLS). It is not a public API; users must sign-in and validate their account/identity to access the API. When I connect with my test client ...
1
vote
0answers
24 views

MySQL BACKRONYM (CVE-2015-3152) only affects MySQL client?

I read the CVE-2015-3152 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3152) named BACKRONYM (http://backronym.fail/), and what I understood (ELI5 style) was the following: Attacker ...
5
votes
4answers
501 views

What is the role of RSA in ECDHE-RSA? [duplicate]

I have read some textbooks and not found a convincing explanation. In the cipher suite ECDHE-RSA-AES128-GCM-SHA256, what is the role of RSA in the first part (ECDHE-RSA)? This part of the cipher ...
5
votes
1answer
398 views

Securing Chrome against Logjam on Windows

Is there a way to fix Chrome against the Logjam TLS exploit on Windows? I have updated my Chrome to the latest version yet the https://weakdh.org/ website warns me that "web browser is vulnerable to ...
0
votes
2answers
52 views

Is TLS v1 really secure for VOIP and video calling?

Many applications are still using TLS v1 for video conferencing and VOIP calls. Is TLS v1 really secure for video and voice & video calling? or can some one can easily snoop your sessions with ...
1
vote
1answer
35 views

Is Two-way SSL sufficient for Multiple web servers communicating to each other?

I have a fixed number of web servers. Each web server represents a company and the users of the company talk to their assigned web server. I have this setup to decentralise the databases. So if one ...
2
votes
1answer
43 views

Is it safe to enable SSLv2 ClientHello support?

In the wake of the POODLE attack, many web sites have dropped support for SSLv3. But some clients still in relatively common use as of May 2015 still initiate the handshake with an SSLv2 ClientHello ...
1
vote
1answer
50 views

How to filter secure (HTTPS) websites by URL with regular expression?

I need to block access to certain pages on a website using regular expression and/or wildcard. The site uses https and therefore cannot be blocked using regular parental control filters (this is ...
4
votes
3answers
66 views

Why does Windows have a place to store intermediate SSL certificates?

As I understand the process of verifying a remote computer's SSL certificate, the remote system sends its 'leaf' certificate and any intermediate certificates, but not the root certificate. Executing ...
0
votes
2answers
52 views

Preventing SSL strip attack

Is it possible to detect a ssl strip attack by checking whether the page deliverd is https or http using javascript?I am assuming that the response page is https page instead of http?
-1
votes
0answers
18 views

TLS 1.1 android 4 support [closed]

Before Android 4.1 we couldn't add TLS 1.1 or more precisely tls pinning. IS there anyway to make android use TLS 1.1 for version before android 4.1
5
votes
3answers
130 views

Does TLS_FALLBACK_SCSV provide blanket protection against downgrade attacks?

The TLS_FALLBACK_SCSV flag was touted as a way to prevent POODLE, which abused the potential to downgrade to SSLv3 from TLS. Does the implementation of this flag prevent similar downgrade attacks ...
4
votes
1answer
61 views

Different SSL cert behavior with Chrome on desktop vs. Chrome on iOS

We have a website, https://uk.care.com, that has a GeoTrust multi-SAN cert on it. The cert is up-to-date, using SHA-256, TLS 1.2, etc. When we view the site in Chrome on various desktop systems it ...
1
vote
1answer
27 views

HTTPS in captive portals and the Apple Captive Network Assistant

Suppose I connect to the Wi-Fi of a company I trust enough to give them my credit card number (say, my local airport). When I connect to their Wi-Fi network, my web browser gets redirected from any ...
10
votes
2answers
2k views

How to Check if a server is not vulnerable to logjam?

In response to Logjam I want to prove I hardend my services. I know that the DH param has to be 2048 bits atleast and self generated. but I am unable to find a way to actually check this for something ...
5
votes
3answers
535 views

Does the recommended course of action for preventing Logjam on Tomcat servers really eliminate all risks of weak DH keys?

Can anyone verify this fix secures against the Logjam vulnerability for Apache Tomcat? I'm sceptical about it's effectiveness, since it doesn't mention how to implement the user defined 2048 bit DH ...
0
votes
2answers
81 views

Website using http and https

Is there any method to know whether a website is https only or uses http webpages as well?Can it be done without using browsers cache?
1
vote
2answers
49 views

SSL/TLS client authentication - practical client cert validation

How do real HTTPS servers validate client certificates? My context is business-to-business rather than regular human clients. I understand basic chain validation to a trusted root CA cert. But do ...
14
votes
1answer
2k views

PayPal encrypted with obsolete cryptography

My Chrome just complained from PayPal's security, similarly to this issue: Google Chrome "Your connection to website is encrypted with obsolete cryptography" The identity is verified, but ...
61
votes
4answers
8k views

What is Logjam and how do I prevent it?

I heard there is a "new" TLS vulnerability named Logjam, what does it do and how do I prevent it?
1
vote
0answers
46 views

PCI DSS Vulnerability Scan failed [closed]

I'm having some problems fixing two Vulnerability's that keep failing the PCI scan. The scan is failing on BEAST attack ports 443 and 25. I've followed a few articles and over the past week got the ...
3
votes
3answers
103 views

How do I deal with browsers complaining that my MediaWiki website has unsecure resources? [closed]

I recently bought a subscription to a NameCheap shared hosting plan, and I plan to primarily run MediaWiki on it. I've managed to setup everything fine except for the SSL encryption. When I visit my ...
2
votes
2answers
61 views

Is there a Cipher Suite which is only “good” when used with HTTPS, but not “good” with other protocols?

Some attacks (e.g. BEAST, CRIME) are only effective against HTTPS. Are there any cipher suites which are only "good" when in use over HTTPS? Is there any "good" HTTPS cipher suites (i.e. ...
1
vote
2answers
72 views

two factor authentication without TLS/SSL

It seems silly to ask about using two-factor authentication without TLS/SSL but, I have a vendor that is using public IP without TLS and asking for login creds. Would the login be more secure if ...
0
votes
3answers
100 views

Disadvantages of disabling RC4 in SSL/TLS [closed]

Other than requiring more server resources, are there any disadvantages of disabling RC4 from being using by an Apache webserver? My primary concern is preventing access from older browsers.
2
votes
1answer
39 views

Why does SSL/TLS MAC the Master Secret?

At the end of the SSL handshake both the client and server send a MAC over all previous messages and the master secret. However, why do we need to MAC the master secret? The master secret is computed ...
1
vote
1answer
21 views

SSL connection between MySQL, Apache and the User's device

I set up SSL connection on my apache web server and I just would like to find out is it enough to secure my connection between the MySQL server, the apache web server and the user's device. Because I ...
1
vote
0answers
42 views

What web browsers support ECC vs DSA vs RSA for SSL/TLS?

We are updating our wildcard certificate and see that we have the option to use both RSA or DSA with Symantec (for free), while Digicert offers 3 options for wildcards ECC, DSA and RSA. Is there a ...
6
votes
3answers
199 views

Why does the SSL/TLS handshake have a client and server random?

In the SSL handshake both the client and server generate their respective randoms. The client then generates a pre master secret and encrypts it with the server's public key. However, why can't the ...
13
votes
5answers
675 views

Creating my own CA for an intranet

I need to create my own CA for an intranet and unfortunately it seems there's no good answer about this on Security.SE. There are many resources online about this, but all of them are different and ...
1
vote
1answer
39 views

Using a minimal set of certificate authoraties

It been known for quite a while now that SSL is more of a security-illusion than a real one. As it's not completely useless, and there's no real alternative at moment (though convergence looks ...
1
vote
1answer
62 views

Intercept https traffic [duplicate]

Is it possible for a packet sniffer such as wireshark to be able to decrypt the traffic generated by a https connection from a browser ? I do not have control of the server, but I have control of the ...
1
vote
1answer
38 views

Does a TLS-connection to a proxy-server encrypt the destination url's?

If I use a browser through a proxy-server over a secure connection (i.e. the proxy is HTTPS) - does that mean that everything is encrypted, or just the page returned from the site? And who does the ...
2
votes
1answer
60 views

SSL Decryption why is the root CA certificate required on clients?

Maybe a quick question. We have Palo Alto's that perform SSL Decryption using a sub CA certificate issued by our internal Root CA. This is working for our internal windows domain computers as the root ...