Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ciphers]

The tag has no usage guidance.

4
votes
2answers
59 views

Apache TLS with only ECDHE-RSA-AES128-GCM-SHA256 enabled

Is there anything against this TLS-configuration in Apache: SSLProtocol TLSv1.2 SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256 There are lots of examples that use a more complicated setup, but I believe ...
3
votes
2answers
100 views

Cipher Suite TLS 1.2 - Weak in OHS

I am trying to correct weak encryption in TLS, by doing a test in SSL Labs, it throws weak encryption in the following chpher suite: Current Configuration: SSLCipherSuite HIGH:!MEDIUM:!LOW:!aNULL:!...
3
votes
2answers
118 views

How are ciphers related to cryptographic algorithms like DES or AES?

It looks like I am having a terminology issue here. In cryptography, we have stream ciphers and block ciphers. I understand their difference. We also have cryptographic algorithms like AES (Rijndael). ...
1
vote
1answer
133 views

Why would TLSv1.0 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA still be used?

First, I may be asking a dumb question. I am trying to learn, so please, take it easy on me. Second, if this is not the right place for this question, or you can link me elsewhere, please tell me/ ...
1
vote
1answer
64 views

Could this list of ciphersuites be improved on?

During my self-teaching about trying to find mobile application vulnerabilities, I found a list of cipher suites that are/were considered insecure: md5 sha1 sha-1 md4 rc4 des tripledes 3des If I ...
0
votes
1answer
69 views

How do you find the key domain of the multiplication cipher efficiently?

If the plaintext is made of both letters (a to z) and digits (0 to 9), how do you find the key domain of the multiplication cipher?
0
votes
1answer
69 views

Understanding Cipher suite prefixes

I have been lately reading cipher suites and how it works. I figured how it works in the web servers and there is a doubt regarding the prefixes used in the order. How are RC4-SHA and RC4+SHA ...
0
votes
1answer
477 views

Understanding SSL Cipher suite in Apache

On reading the documentation Apache documentation. A cipher suite example has been given : RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5 I have understood the explanation given by them. My question is ...
2
votes
1answer
86 views

Are the cascading ciphers in Veracrypt susceptible to the meet-in-the-middle attack? (MITM)

Veracrypt offers cascades of ciphers. Are these cascades (at least those comprised of two ciphers) susceptible to the meet-in-the-middle attack? Why not? For example: AES-Twofish Two ciphers ...
0
votes
0answers
155 views

SSLLabs reporting weak ciphers despite specifying list in JBoss EAP 6.4.12

I have a JBoss EAP version 6.4.12 server. Out of curiosity I ran a test with the SSLLabs tool and received an F. It mentioned weak key exchanges like DH, no forward secrecy, vulnerable to DROWN etc. ...
3
votes
1answer
641 views

Clarifications regarding ciphers and Nmap scan

I'm running the below Nmap command to test the strength of the cipher suites I have used in my host nmap -sV --script ssl-enum-ciphers -p 443 <host> The Nmap doc says that Each ciphersuite is ...
0
votes
1answer
240 views

Are ciphers with a strength of 112 bits considered weak?

SSL/TLS Ciphers of strength 128 bit is considered strong while ciphers of strength 112 bits is considered weak. Ciphers of 56 bit is understandably weak as they can be easily brute-forced. If it is ...
2
votes
1answer
271 views

SSL - Enabling Forward Secrecy with or without RC4

I'm running an Apache 2 server with Ubuntu 16. Here's my current configuration: SSLProtocol All -SSLv2 -SSLv3 SSLHonorCipherOrder on SSLCipherSuite I'm a bit confused as to what I should use for ...
-4
votes
2answers
213 views

does anyone know how this text is encrypted? [closed]

Im trying to solve a copher challange, but i have no idea on this question. does anyone have any ideas on the encryption method used here? Dvoo wlmv, blf'ev hloevw xrksvi xszoovmtv mfnyvi gdl. Gsrh ...
2
votes
2answers
84 views

How attackers extract data from cipher text using brute force?

Lets take an example. Plain text: HJOU UT Cipher text: IKPV VU Above one just a simple substitution technique. Data is random text. If attackers substitute -1 then they will get GINT TS. Otherwise if ...
3
votes
1answer
919 views

Google Chrome weird random Cipher Suite

This websites gives you information on the SSL cipher suites your browser supports for securing HTTPS connections. If you browse it with Google Chrome, you'll probably see some weird Cipher Suites in ...
1
vote
1answer
385 views

OpenVas remediation cipher suites

This is my first time running a vulnerability scan software like OpenVas. It is really a great tool to found out about vulnerabilities in the network. I have found difficult to troubleshoot the ...
0
votes
1answer
94 views

Is EV (Extended Validation) Certificate Green Bar Affected by Available Cipher Suites?

I am wondering whether Extended Validation (EV) Certificate 'green bar' on the web browser is affected by Cipher Suites. I can't find seem to find a reference that says that apart from this answer. ...
0
votes
1answer
270 views

Is TLS_ECDHE_RSA_WITH_RC4_128_SHA secure?

I was wondering whether TLS_ECDHE_RSA_WITH_RC4_128_SHA is secure. We have added it within the ciphers tag of the Tomcat configuration file.
1
vote
1answer
631 views

How to decrypt a text with substitution cipher? [closed]

I recently got a file which I had encrypted with substitution cipher a long time ago. I went to crack down the key and almost got it. But I encrypted it not just with alphabets but also with numbers ...
1
vote
1answer
356 views

What are the benefits and disadvantage of disabling <TLS1.2 client side (in browser)?

We are considering disabling TLS1.0 and TLS1.1 in the policies for a browser used organization-wide. We already have a primary browser, where >=TLS1.0 is enabled (i.e. SSLv3 is disabled). We do not ...
1
vote
0answers
897 views

SSL/TLS cipher suites order for Windows 2016 hosted https sites

We are SaaS & IaaS provider that predominantly use Windows 2012 (R2) for hosting. We have started evaluating Windows 2016 OS and noticed our sites are no longer accessible via Chrome / Firefox (...
0
votes
1answer
494 views

openssl PSK cipher support

openssl version on ubuntu machine is $ openssl version OpenSSL 1.0.2g 1 Mar 2016 Following is openssl PSK cipher list :- $ openssl ciphers -v 'PSK' PSK-AES256-CBC-SHA SSLv3 Kx=PSK Au=...
1
vote
1answer
1k views

selft signed certificate for AES128-GCM-SHA256 cipher

To generate self signed certificate for AES128-SHA256 cipher using openssl, following commands are used. AES128-SHA256 cipher commands :- openssl genrsa -aes128 -out 1.key 2048 openssl req -...
1
vote
2answers
239 views

What would be a better encryption algorithm then RSA_DES_EDE3_CBC?

First off, please let me explain why I'm asking this at all: The default implementation of EnvelopedCms is using AlgorithmIdentifier which by itself will use RSA_DES_EDE3_CBC or OID 1.2.840.113549.3....
3
votes
2answers
116 views

Using old ciphers in email security

My email provider still supports old SSL_RSA_WITH_RC4_128_SHA ciphers. What does that mean for me? If I use an updated system (Ubuntu 16.04) and an updated client (Thunderbird 52), shouldn't it use ...
4
votes
2answers
1k views

Role of the chosen ciphersuite in an SSL/TLS connection

When it comes to a secure TLS configuration (e.g. for HTTPS), the topic is prominently about the supported cipher suites. I want to fully understand which part of the cipher suite has which role in a ...
2
votes
1answer
380 views

How to disallow specific ssh ciphers and/or MACS (blacklist approach)

I have a report detailing weak ssh ciphers on a system. How can I dis-allow these specific weak ciphers. The common solution which I am aware of is adding the following lines in sshd_config (which is ...
0
votes
2answers
86 views

Given the following yaSSL ciphers, how do I know what's being used?

Scope: I am considerable new on cryptography and only know some basic fundamentals of it. Looking at yaSSL ciphers I am trying to, as an exercise, to figure out which ones are still safe to use by ...
1
vote
1answer
34 views

Secure communication between peers with ANON ciphers and password authentication

Using ANON ciphers (No certificates required/used) while establishing connection and later using the username/password for authentication considered secure communication? Are there any flaws in it, ...
0
votes
1answer
64 views

Changing cipher list of a ctx object after connection establishment

Does changing the cipher list for a CTX object (using SSL_CTX_set_cipher_list), have any effect on the already established connections (connections that had used that very CTX object)?
-1
votes
1answer
179 views

Cipher with mixed case, numbers, hyphen and period [closed]

Given the following cipher text: LE-eheadty.AC2lta oiwyGC24 What possible ciphers could it be?
1
vote
1answer
387 views

How to make TLS_RSA_WITH_3DES_EDE_CBC_SHA strong

First off I have NO idea what ciphers are and my knowledge is very basic in security! With that said, from this tutorial I have established a secure SSL site and I have a ran a test on my domain and ...
5
votes
2answers
2k views

What is the most robust available algo for GPG symmetric encryption? [closed]

What is the most robust available algo for GPG symmetric encryption (given as argument of --cipher-algo)? Possible ciphers: IDEA 3DES CAST5 BLOWFISH AES AES192 AES256 TWOFISH CAMELLIA128 ...
-1
votes
1answer
206 views

what is wrong with openssl ciphers?

I used openssl recently and noticed that in the cipher list there is AES (what else ) and then I saw many rarely used ciphers like camellia and seed, then I saw stuff like rc4, rc2 ... Why are ...
5
votes
1answer
2k views

Apache naming for TLS_RSA_WITH_3DES_EDE_CBC_SHA

According to NIST and HIPAA guidance, I miss one cipher on a new web server: TLS_RSA_WITH_3DES_EDE_CBC_SHA Despite I read this one is discouraged, I am curious as to how do I add it? I am on Linux ...
1
vote
1answer
63 views

Does Firefox implements SCSV?

I need to know if Mozilla Firfox implements the SCSV which adds a specific ciphersuite in case if the client initial hello message is resent (either due to MITM or due to network erro). I opened ...
1
vote
1answer
344 views

Server with support for both EC and RSA keys

I have a server that implements DTLS using OpenSSL 1.0.1 but supports only RSA keys as of today. I want to add support to this server to accept EC keys to be able to implement the newer ECDHE-ECDSA ...
8
votes
3answers
23k views

Chrome browser reports obsolete cipher (AES_256_CBC with HMAC-SHA1)

Jboss 6 server is configured to support these ciphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, ...
3
votes
3answers
611 views

When should a password cipher be used and when should a normal password be used? [duplicate]

I came across this article discussion how to make a password secure by adding your own "encryption" scheme to a selected word and create you password. For example, if my cipher was to add four zeros, ...
0
votes
1answer
439 views

What Cipher suites does Hashicorp Vault use?

I've been looking into Hashicorp Vault to use in my linux environment. Ive installed a certificate/private key pair on the Vault Server and told Vault to use TLS. It seems to be working correctly. I ...
0
votes
2answers
495 views

Improved Caesar cipher – secured? [closed]

First let me emphasize that I know nothing about encryption and maybe my question is completely wrong from encryption point of view. Since I must use a simple substitution for a technical reason and ...
2
votes
0answers
69 views

How to decrypt Vigenère ciphered text?

The method I am using: For example: we have to decrpyt one message VVHQWVVRMHUSGJG Step 1 Find the length VVHQWVVRMHUSGJG --------- 1 VVHQWVVRMHUSGJG ...
0
votes
2answers
657 views

Why are larger block sizes more desirable?

I've read three different exceperts from three different information security books, to summarize, this is what they say: "Block size impacts security, complexity, and performance. A larger block ...
-2
votes
1answer
99 views

How to break my toy? [duplicate]

When I was a kid I loved to play with Lego blocks, it was magical. I can't say that I've changed completely. Today I was playing with hash functions and decided to build my own ToyCipher, I hope no ...
1
vote
2answers
646 views

Why would a client, connecting to a sever with SSL, use the cipher with the least bits?

I was testing two different Apache2 setup. In the first case, I used the list offered by http://letsencrypt.org/ which offers free certificate. The list looks like this: SSLHonorCipherOrder on ...
6
votes
1answer
8k views

Disable RC4 ciphers best practice

To be compliant with security best practices, we have a requirement to disable RC4 ciphers. I have investigated a way to achieve this and, found that I can disable it by editing the registry keys. [...
8
votes
2answers
14k views

TLS 1.2 and enable only AEAD ciphers suite list

A company have made a vulnerability scan and give us a report that, recommends to use TLS 1.2 and enable only AEAD ciphers suite, but they aren't giving more information about what I need to achieve ...
2
votes
3answers
132 views

Why are encryption methods chosen by what is not broken instead of what is possible?

I've noticed there's an absurd amount of time, effort and arguments about whether or not we should use certain crypto ciphers or encryption methods. In this link some people go into how certain ...
2
votes
1answer
606 views

Restrict cipher suites within specific protocol versions

I need to disable the weak ciphers within a weak protocol version, namely TLS1.0, on a windows server 2012 R2 running IIS. I understand that cipher suites are tied to protocol, i.e. ...