Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ciphers]

The tag has no usage guidance.

-6
votes
1answer
179 views

How to disable obsolete/insecure TLS_RSA ciphers to harden Chrome? [closed]

Multiple vulnerabilities have basically obsoleted TLS_RSA, CBC and QUIC implementations. February 9, 2019: "Seven researchers from all over the world found --yet again-- another way to break RSA ...
0
votes
0answers
20 views

choosing a cipher suite for sending a simple email on embedded systems

Anybody have any input/feedback on this. I've been given the task of researching how to send a 'secure' email using SSL on an embedded system with very limited RAM and Flash ROM. The email is very ...
5
votes
3answers
153 views

What are the 'P' values in some cipher string?

Most of the cipher strings I see are in the format: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ...
0
votes
1answer
13 views

Why are ciphers using DSS being offered when using DH+AES:!DSS?

When I run the following command on Windows 10 with OpenSSL 1.0.2p installed I receive a curious result back (Formatted for readability): openssl ciphers "DH+AES:!DSS:!aDSS:!aNULL" DH-DSS-AES256-GCM-...
4
votes
2answers
156 views

Apache TLS with only ECDHE-RSA-AES128-GCM-SHA256 enabled

Is there anything against this TLS-configuration in Apache: SSLProtocol TLSv1.2 SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256 There are lots of examples that use a more complicated setup, but I believe ...
3
votes
2answers
231 views

Cipher Suite TLS 1.2 - Weak in OHS

I am trying to correct weak encryption in TLS, by doing a test in SSL Labs, it throws weak encryption in the following chpher suite: Current Configuration: SSLCipherSuite HIGH:!MEDIUM:!LOW:!aNULL:!...
4
votes
2answers
151 views

How are ciphers related to cryptographic algorithms like DES or AES?

It looks like I am having a terminology issue here. In cryptography, we have stream ciphers and block ciphers. I understand their difference. We also have cryptographic algorithms like AES (Rijndael). ...
1
vote
1answer
305 views

Why would TLSv1.0 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA still be used?

First, I may be asking a dumb question. I am trying to learn, so please, take it easy on me. Second, if this is not the right place for this question, or you can link me elsewhere, please tell me/ ...
1
vote
1answer
68 views

Could this list of ciphersuites be improved on?

During my self-teaching about trying to find mobile application vulnerabilities, I found a list of cipher suites that are/were considered insecure: md5 sha1 sha-1 md4 rc4 des tripledes 3des If I ...
0
votes
1answer
137 views

How do you find the key domain of the multiplication cipher efficiently?

If the plaintext is made of both letters (a to z) and digits (0 to 9), how do you find the key domain of the multiplication cipher?
0
votes
1answer
91 views

Understanding Cipher suite prefixes

I have been lately reading cipher suites and how it works. I figured how it works in the web servers and there is a doubt regarding the prefixes used in the order. How are RC4-SHA and RC4+SHA ...
0
votes
1answer
659 views

Understanding SSL Cipher suite in Apache

On reading the documentation Apache documentation. A cipher suite example has been given : RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5 I have understood the explanation given by them. My question is ...
2
votes
1answer
97 views

Are the cascading ciphers in Veracrypt susceptible to the meet-in-the-middle attack? (MITM)

Veracrypt offers cascades of ciphers. Are these cascades (at least those comprised of two ciphers) susceptible to the meet-in-the-middle attack? Why not? For example: AES-Twofish Two ciphers ...
0
votes
0answers
185 views

SSLLabs reporting weak ciphers despite specifying list in JBoss EAP 6.4.12

I have a JBoss EAP version 6.4.12 server. Out of curiosity I ran a test with the SSLLabs tool and received an F. It mentioned weak key exchanges like DH, no forward secrecy, vulnerable to DROWN etc. ...
3
votes
1answer
849 views

Clarifications regarding ciphers and Nmap scan

I'm running the below Nmap command to test the strength of the cipher suites I have used in my host nmap -sV --script ssl-enum-ciphers -p 443 <host> The Nmap doc says that Each ciphersuite is ...
0
votes
1answer
284 views

Are ciphers with a strength of 112 bits considered weak?

SSL/TLS Ciphers of strength 128 bit is considered strong while ciphers of strength 112 bits is considered weak. Ciphers of 56 bit is understandably weak as they can be easily brute-forced. If it is ...
2
votes
1answer
310 views

SSL - Enabling Forward Secrecy with or without RC4

I'm running an Apache 2 server with Ubuntu 16. Here's my current configuration: SSLProtocol All -SSLv2 -SSLv3 SSLHonorCipherOrder on SSLCipherSuite I'm a bit confused as to what I should use for ...
-4
votes
2answers
262 views

does anyone know how this text is encrypted? [closed]

Im trying to solve a copher challange, but i have no idea on this question. does anyone have any ideas on the encryption method used here? Dvoo wlmv, blf'ev hloevw xrksvi xszoovmtv mfnyvi gdl. Gsrh ...
2
votes
2answers
101 views

How attackers extract data from cipher text using brute force?

Lets take an example. Plain text: HJOU UT Cipher text: IKPV VU Above one just a simple substitution technique. Data is random text. If attackers substitute -1 then they will get GINT TS. Otherwise if ...
4
votes
1answer
1k views

Google Chrome weird random Cipher Suite

This websites gives you information on the SSL cipher suites your browser supports for securing HTTPS connections. If you browse it with Google Chrome, you'll probably see some weird Cipher Suites in ...
1
vote
1answer
430 views

OpenVas remediation cipher suites

This is my first time running a vulnerability scan software like OpenVas. It is really a great tool to found out about vulnerabilities in the network. I have found difficult to troubleshoot the ...
0
votes
1answer
102 views

Is EV (Extended Validation) Certificate Green Bar Affected by Available Cipher Suites?

I am wondering whether Extended Validation (EV) Certificate 'green bar' on the web browser is affected by Cipher Suites. I can't find seem to find a reference that says that apart from this answer. ...
0
votes
1answer
308 views

Is TLS_ECDHE_RSA_WITH_RC4_128_SHA secure?

I was wondering whether TLS_ECDHE_RSA_WITH_RC4_128_SHA is secure. We have added it within the ciphers tag of the Tomcat configuration file.
1
vote
1answer
690 views

How to decrypt a text with substitution cipher? [closed]

I recently got a file which I had encrypted with substitution cipher a long time ago. I went to crack down the key and almost got it. But I encrypted it not just with alphabets but also with numbers ...
1
vote
1answer
415 views

What are the benefits and disadvantage of disabling <TLS1.2 client side (in browser)?

We are considering disabling TLS1.0 and TLS1.1 in the policies for a browser used organization-wide. We already have a primary browser, where >=TLS1.0 is enabled (i.e. SSLv3 is disabled). We do not ...
1
vote
0answers
1k views

SSL/TLS cipher suites order for Windows 2016 hosted https sites

We are SaaS & IaaS provider that predominantly use Windows 2012 (R2) for hosting. We have started evaluating Windows 2016 OS and noticed our sites are no longer accessible via Chrome / Firefox (...
0
votes
1answer
586 views

openssl PSK cipher support

openssl version on ubuntu machine is $ openssl version OpenSSL 1.0.2g 1 Mar 2016 Following is openssl PSK cipher list :- $ openssl ciphers -v 'PSK' PSK-AES256-CBC-SHA SSLv3 Kx=PSK Au=...
1
vote
1answer
1k views

selft signed certificate for AES128-GCM-SHA256 cipher

To generate self signed certificate for AES128-SHA256 cipher using openssl, following commands are used. AES128-SHA256 cipher commands :- openssl genrsa -aes128 -out 1.key 2048 openssl req -...
1
vote
2answers
258 views

What would be a better encryption algorithm then RSA_DES_EDE3_CBC?

First off, please let me explain why I'm asking this at all: The default implementation of EnvelopedCms is using AlgorithmIdentifier which by itself will use RSA_DES_EDE3_CBC or OID 1.2.840.113549.3....
3
votes
2answers
117 views

Using old ciphers in email security

My email provider still supports old SSL_RSA_WITH_RC4_128_SHA ciphers. What does that mean for me? If I use an updated system (Ubuntu 16.04) and an updated client (Thunderbird 52), shouldn't it use ...
4
votes
2answers
2k views

Role of the chosen ciphersuite in an SSL/TLS connection

When it comes to a secure TLS configuration (e.g. for HTTPS), the topic is prominently about the supported cipher suites. I want to fully understand which part of the cipher suite has which role in a ...
2
votes
1answer
419 views

How to disallow specific ssh ciphers and/or MACS (blacklist approach)

I have a report detailing weak ssh ciphers on a system. How can I dis-allow these specific weak ciphers. The common solution which I am aware of is adding the following lines in sshd_config (which is ...
0
votes
2answers
87 views

Given the following yaSSL ciphers, how do I know what's being used?

Scope: I am considerable new on cryptography and only know some basic fundamentals of it. Looking at yaSSL ciphers I am trying to, as an exercise, to figure out which ones are still safe to use by ...
1
vote
1answer
35 views

Secure communication between peers with ANON ciphers and password authentication

Using ANON ciphers (No certificates required/used) while establishing connection and later using the username/password for authentication considered secure communication? Are there any flaws in it, ...
0
votes
1answer
66 views

Changing cipher list of a ctx object after connection establishment

Does changing the cipher list for a CTX object (using SSL_CTX_set_cipher_list), have any effect on the already established connections (connections that had used that very CTX object)?
-1
votes
1answer
189 views

Cipher with mixed case, numbers, hyphen and period [closed]

Given the following cipher text: LE-eheadty.AC2lta oiwyGC24 What possible ciphers could it be?
1
vote
1answer
415 views

How to make TLS_RSA_WITH_3DES_EDE_CBC_SHA strong

First off I have NO idea what ciphers are and my knowledge is very basic in security! With that said, from this tutorial I have established a secure SSL site and I have a ran a test on my domain and ...
5
votes
2answers
2k views

What is the most robust available algo for GPG symmetric encryption? [closed]

What is the most robust available algo for GPG symmetric encryption (given as argument of --cipher-algo)? Possible ciphers: IDEA 3DES CAST5 BLOWFISH AES AES192 AES256 TWOFISH CAMELLIA128 ...
-1
votes
1answer
213 views

what is wrong with openssl ciphers?

I used openssl recently and noticed that in the cipher list there is AES (what else ) and then I saw many rarely used ciphers like camellia and seed, then I saw stuff like rc4, rc2 ... Why are ...
5
votes
1answer
2k views

Apache naming for TLS_RSA_WITH_3DES_EDE_CBC_SHA

According to NIST and HIPAA guidance, I miss one cipher on a new web server: TLS_RSA_WITH_3DES_EDE_CBC_SHA Despite I read this one is discouraged, I am curious as to how do I add it? I am on Linux ...
1
vote
1answer
63 views

Does Firefox implements SCSV?

I need to know if Mozilla Firfox implements the SCSV which adds a specific ciphersuite in case if the client initial hello message is resent (either due to MITM or due to network erro). I opened ...
1
vote
1answer
371 views

Server with support for both EC and RSA keys

I have a server that implements DTLS using OpenSSL 1.0.1 but supports only RSA keys as of today. I want to add support to this server to accept EC keys to be able to implement the newer ECDHE-ECDSA ...
8
votes
3answers
24k views

Chrome browser reports obsolete cipher (AES_256_CBC with HMAC-SHA1)

Jboss 6 server is configured to support these ciphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, ...
3
votes
3answers
632 views

When should a password cipher be used and when should a normal password be used? [duplicate]

I came across this article discussion how to make a password secure by adding your own "encryption" scheme to a selected word and create you password. For example, if my cipher was to add four zeros, ...
0
votes
1answer
484 views

What Cipher suites does Hashicorp Vault use?

I've been looking into Hashicorp Vault to use in my linux environment. Ive installed a certificate/private key pair on the Vault Server and told Vault to use TLS. It seems to be working correctly. I ...
0
votes
2answers
544 views

Improved Caesar cipher – secured? [closed]

First let me emphasize that I know nothing about encryption and maybe my question is completely wrong from encryption point of view. Since I must use a simple substitution for a technical reason and ...
2
votes
0answers
69 views

How to decrypt Vigenère ciphered text?

The method I am using: For example: we have to decrpyt one message VVHQWVVRMHUSGJG Step 1 Find the length VVHQWVVRMHUSGJG --------- 1 VVHQWVVRMHUSGJG ...
0
votes
2answers
711 views

Why are larger block sizes more desirable?

I've read three different exceperts from three different information security books, to summarize, this is what they say: "Block size impacts security, complexity, and performance. A larger block ...
-2
votes
1answer
99 views

How to break my toy? [duplicate]

When I was a kid I loved to play with Lego blocks, it was magical. I can't say that I've changed completely. Today I was playing with hash functions and decided to build my own ToyCipher, I hope no ...
1
vote
2answers
655 views

Why would a client, connecting to a sever with SSL, use the cipher with the least bits?

I was testing two different Apache2 setup. In the first case, I used the list offered by http://letsencrypt.org/ which offers free certificate. The list looks like this: SSLHonorCipherOrder on ...