New answers tagged

1

To begin with - I won't go into too much detail for this answer. Read more about HTTPS and the certificate system if you're curious ;-) HTTPS needs certificates to work. These certificates are meant to be a guarantee that you're talking to the right server (and not to the server of an intruder). Encryption only (without this authentication) would be ...


1

Thanks to the responses I was able to get it working. Here is some Python pseudo-code which explains the algorithm actually used by TLS 1.2: # Come up with a random premaster_secret # It needs to start with the TLS version (0x0303) premaster_secret = '\x03\x03' + os.urandom(46) # Retrieve the RSA parameters from the certificate public key RSA_n = ... RSA_e ...


2

IF (that's a big "if") the generator g and the public element from the peer can be assumed to be part of a subgroup of prime order, THEN it suffices for exponents to have size 2t bits, for a "security level" of t bits. In other words, 256 bits are fine. Now if p is a so-called "strong prime" (i.e. p is prime and (p-1)/2 is also prime), then any integer ...


1

Fundamentally, to trust a computer, you need to verify that it knows something that only the computer you're expecting knows. This is how all certificates work: you assume that because they signed something with a key that only they could possibly know then it's actually the person you wanted to talk to. The same applies for computers: the computer has to ...


0

You use tools to generate safe DH groups for you, so you don't generate them entirely randomly. These tools put them through strict tests which ensure they do not have properties which make them unsafe. The tests are so accurate that the probability that one of the chosen parameters will be insecure is exceptionally low. There are two types of generators, ...



Top 50 recent answers are included