Questions tagged [ciphers]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
41 views

Disable vulnerable cipher suites

Pardon this question because I'm fairly new as a security analyst. As a part of my learning I installed OpenVAS into one of our Ubuntu test server and scan the said server. I have the results and I ...
2
votes
1answer
87 views

Why does the NodeJS Crypto docs use CBC instead of GCM for RSA key-pair?

I have read that GCM is almost always more secure than CBC when implemented correctly. However, in the documentation of NodeJS, CBC is being used as an example instead. The key-pair will be stored ...
0
votes
1answer
57 views

What if the attacker tamper the IV used in the block cipher CBC mode?

I am a newbie to block cipher and when learning the CBC mode, I start to understand that an IV is being used in this mode and also will be transferred to the message receiver. So here is my question,...
1
vote
1answer
65 views

TLS key exchange and certificate subject public key clarification

This question is similar to this one, so let me elaborate what I'm struggling with. I want to get the length/strength of the key used by the server during the key exchange and authentication, i.e. ...
1
vote
0answers
62 views

Openssl using the cipher parameter result in handhsake failure

When i use Openssl to connect to facebook.com I see 'ECDHE-ECDSA-AES128-GCM-SHA256' ciphersuite used. openssl s_client -connect www.facebook.com:443 SSL handshake has read 3280 bytes and written 373 ...
0
votes
0answers
20 views

Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication? [duplicate]

Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication?
2
votes
1answer
118 views

3DES supported in application although disabled in Windows

Can users actually use the 3DES cipher to connect to a Tomcat web server, if the 3DES cipher has been disabled via registry keys in Windows: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\...
0
votes
0answers
33 views

Help me to identify what type of string it is? [duplicate]

70373f65f945e5184dcb42793cbe2cddb34248ef172b7ddb5e27467fd8d76314ea8bdeb19226687ac0ca01e646dbe8fdb4dfb2d6816f54b9b500639ac6c3bf056fbd4c45a246bbe66e6fd0ce3730801716b12fff942207933e1bb6386806d476ade6f5b1 ...
0
votes
1answer
187 views

How do I get the list of cipher suites supported in a specific TLS version?

Is there any cipher suites supported in one TLS version and not supported in the other? If yes, then is there any documentation that talks about the cipher suites supported in each TLS or SSL versions?...
0
votes
1answer
185 views

Deciphering ciphertext with an unknown key and algorithm [closed]

How can I get started on understanding how to decipher this ciphertext when I don't know the algorithm or key used? TDcbY xqCa NeAA OsWMirK FNFOm bYRUYAkxl,  tqwl  axZU  XTaLrBSFv OI G vWjBZyqhz.  ...
1
vote
2answers
258 views

Is there any CBC based ciphersuite which are secure for known attacks like LUCKY13?

If you select the modern profile in https://mozilla.github.io/server-side-tls/ssl-config-generator/ , you can see it recommends to enable following four cipher suites also. ECDHE-ECDSA-AES256-SHA384 ...
-2
votes
1answer
59 views

aes-128 refers to the block size, key or both

What does the number used in cipher suites next to the symmetric encryption algorithm reefers to? Does it mean each block is divided into 128 bit blocks, the key size or both ?
17
votes
1answer
4k views

How do I know which cipher suites can be disabled?

I have just performed a test on my personal webiste via SSLlabs.com and I'm apparently supporting some weaker ciphers. I've managed to improve several settings (like CAA), but I'm getting stuck at the ...
3
votes
1answer
107 views

How to filter ciphers based on ssl certificate?

I have many ssl certificates. On one of the certificates I run the command openssl x509 -in cert.pem -text -noout it shows: Signature Algorithm: ecdsa-with-SHA256 Public Key Algorithm: id-...
1
vote
3answers
370 views

Losing the Initialization Vector in Cipher Block Chaining

I have written a message and encrypted it using cipher block chaining. What will happen if the receiver loses the Initialization Vector, or doesn't receive at all?
5
votes
1answer
149 views

Do ciphers and encoding schemes make passwords more secure?

I recently came across a tech professional advising a user to take some plaintext of their choice, run it through one of these ciphers, convert it to Base64, and then use the result as their master ...
0
votes
1answer
107 views

What's the difference between `aes-128-cbf` and `aes-128-gcm`?

We often hear of AES-128-CBF and AES-128-GCM, but what's the difference between them?
-1
votes
1answer
79 views

What's the meaning of cipher's `IV Length`?

What's the meaning of IV length? there provide several stream ciphers, what's the meaning of IV Length? Name Key Size IV Length aes-128-ctr 16 16 aes-192-ctr 24 ...
0
votes
1answer
90 views

For a cipher school challenge I need help breaking this cipher [closed]

[CIPHERTEXTSTARTS]HI wsndtonInehbihs if at t iyoncniegtrf .e noionbpni y,iu.w ahoui hs hroyh!euecsy m.ot ew hrc hb;ntsresnmdma ipMsat ln ts , ryiceg ensh c n byr t k t oe de uhw stiytoer s ...
0
votes
0answers
27 views

Whether cipher suites is related to public key certificate? [duplicate]

I want to use TLS version 1.2 and Authenticated Encryption with Associated Data (AEAD). Can a public key certificate obtained from a certification authority specify which of the ciphers I can use? ...
1
vote
1answer
80 views

OpenSSL Padding Oracle. Specific Ciphers on apache2 seems a little limited

I've seen a lot of articles giving the official explanation on how to prevent OpenSSL Padding Oracles, Usually all of them state that its CBC cipher suites that leave you vulnerable. The following ...
2
votes
1answer
965 views

What is a “non-stitched” ciphersuite?

From the OpenSSL Security Advisory - 0-byte record padding oracle (CVE-2019-1559) In order for this to be exploitable "non-stitched" ciphersuites must be in use. What is a 'non-stitched' ...
0
votes
1answer
102 views

Cipher that does not give confirmation whether decryption is successful

I was reading this question where the author wanted to know whether layered encryption would be better than a long password. The answers to this question all said the same thing: It would be easier ...
-6
votes
1answer
1k views

How to disable obsolete/insecure TLS_RSA ciphers to harden Chrome? [closed]

Multiple vulnerabilities have basically obsoleted TLS_RSA, CBC and QUIC implementations. February 9, 2019: "Seven researchers from all over the world found --yet again-- another way to break RSA ...
0
votes
0answers
22 views

choosing a cipher suite for sending a simple email on embedded systems

Anybody have any input/feedback on this. I've been given the task of researching how to send a 'secure' email using SSL on an embedded system with very limited RAM and Flash ROM. The email is very ...
6
votes
3answers
433 views

What are the 'P' values in some cipher string?

Most of the cipher strings I see are in the format: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ...
0
votes
1answer
286 views

Why are ciphers using DSS being offered when using DH+AES:!DSS?

When I run the following command on Windows 10 with OpenSSL 1.0.2p installed I receive a curious result back (Formatted for readability): openssl ciphers "DH+AES:!DSS:!aDSS:!aNULL" DH-DSS-AES256-GCM-...
4
votes
2answers
772 views

Apache TLS with only ECDHE-RSA-AES128-GCM-SHA256 enabled

Is there anything against this TLS-configuration in Apache: SSLProtocol TLSv1.2 SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256 There are lots of examples that use a more complicated setup, but I believe ...
3
votes
2answers
2k views

Cipher Suite TLS 1.2 - Weak in OHS

I am trying to correct weak encryption in TLS, by doing a test in SSL Labs, it throws weak encryption in the following chpher suite: Current Configuration: SSLCipherSuite HIGH:!MEDIUM:!LOW:!aNULL:!...
4
votes
2answers
172 views

How are ciphers related to cryptographic algorithms like DES or AES?

It looks like I am having a terminology issue here. In cryptography, we have stream ciphers and block ciphers. I understand their difference. We also have cryptographic algorithms like AES (Rijndael). ...
1
vote
1answer
2k views

Why would TLSv1.0 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA still be used?

First, I may be asking a dumb question. I am trying to learn, so please, take it easy on me. Second, if this is not the right place for this question, or you can link me elsewhere, please tell me/ ...
1
vote
1answer
71 views

Could this list of ciphersuites be improved on?

During my self-teaching about trying to find mobile application vulnerabilities, I found a list of cipher suites that are/were considered insecure: md5 sha1 sha-1 md4 rc4 des tripledes 3des If I ...
0
votes
1answer
692 views

How do you find the key domain of the multiplication cipher efficiently?

If the plaintext is made of both letters (a to z) and digits (0 to 9), how do you find the key domain of the multiplication cipher?
0
votes
1answer
181 views

Understanding Cipher suite prefixes

I have been lately reading cipher suites and how it works. I figured how it works in the web servers and there is a doubt regarding the prefixes used in the order. How are RC4-SHA and RC4+SHA ...
0
votes
1answer
2k views

Understanding SSL Cipher suite in Apache

On reading the documentation Apache documentation. A cipher suite example has been given : RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5 I have understood the explanation given by them. My question is ...
2
votes
1answer
161 views

Are the cascading ciphers in Veracrypt susceptible to the meet-in-the-middle attack? (MITM)

Veracrypt offers cascades of ciphers. Are these cascades (at least those comprised of two ciphers) susceptible to the meet-in-the-middle attack? Why not? For example: AES-Twofish Two ciphers ...
3
votes
1answer
2k views

Clarifications regarding ciphers and Nmap scan

I'm running the below Nmap command to test the strength of the cipher suites I have used in my host nmap -sV --script ssl-enum-ciphers -p 443 <host> The Nmap doc says that Each ciphersuite is ...
0
votes
1answer
464 views

Are ciphers with a strength of 112 bits considered weak?

SSL/TLS Ciphers of strength 128 bit is considered strong while ciphers of strength 112 bits is considered weak. Ciphers of 56 bit is understandably weak as they can be easily brute-forced. If it is ...
2
votes
1answer
390 views

SSL - Enabling Forward Secrecy with or without RC4

I'm running an Apache 2 server with Ubuntu 16. Here's my current configuration: SSLProtocol All -SSLv2 -SSLv3 SSLHonorCipherOrder on SSLCipherSuite I'm a bit confused as to what I should use for ...
-4
votes
2answers
680 views

does anyone know how this text is encrypted? [closed]

Im trying to solve a copher challange, but i have no idea on this question. does anyone have any ideas on the encryption method used here? Dvoo wlmv, blf'ev hloevw xrksvi xszoovmtv mfnyvi gdl. Gsrh ...
2
votes
2answers
275 views

How attackers extract data from cipher text using brute force?

Lets take an example. Plain text: HJOU UT Cipher text: IKPV VU Above one just a simple substitution technique. Data is random text. If attackers substitute -1 then they will get GINT TS. Otherwise if ...
6
votes
1answer
2k views

Google Chrome weird random Cipher Suite

This websites gives you information on the SSL cipher suites your browser supports for securing HTTPS connections. If you browse it with Google Chrome, you'll probably see some weird Cipher Suites in ...
1
vote
1answer
611 views

OpenVas remediation cipher suites

This is my first time running a vulnerability scan software like OpenVas. It is really a great tool to found out about vulnerabilities in the network. I have found difficult to troubleshoot the ...
0
votes
1answer
117 views

Is EV (Extended Validation) Certificate Green Bar Affected by Available Cipher Suites?

I am wondering whether Extended Validation (EV) Certificate 'green bar' on the web browser is affected by Cipher Suites. I can't find seem to find a reference that says that apart from this answer. ...
0
votes
1answer
454 views

Is TLS_ECDHE_RSA_WITH_RC4_128_SHA secure?

I was wondering whether TLS_ECDHE_RSA_WITH_RC4_128_SHA is secure. We have added it within the ciphers tag of the Tomcat configuration file.
1
vote
1answer
824 views

How to decrypt a text with substitution cipher? [closed]

I recently got a file which I had encrypted with substitution cipher a long time ago. I went to crack down the key and almost got it. But I encrypted it not just with alphabets but also with numbers ...
1
vote
1answer
677 views

What are the benefits and disadvantage of disabling <TLS1.2 client side (in browser)?

We are considering disabling TLS1.0 and TLS1.1 in the policies for a browser used organization-wide. We already have a primary browser, where >=TLS1.0 is enabled (i.e. SSLv3 is disabled). We do not ...
1
vote
0answers
1k views

SSL/TLS cipher suites order for Windows 2016 hosted https sites

We are SaaS & IaaS provider that predominantly use Windows 2012 (R2) for hosting. We have started evaluating Windows 2016 OS and noticed our sites are no longer accessible via Chrome / Firefox (...
1
vote
1answer
986 views

openssl PSK cipher support

openssl version on ubuntu machine is $ openssl version OpenSSL 1.0.2g 1 Mar 2016 Following is openssl PSK cipher list :- $ openssl ciphers -v 'PSK' PSK-AES256-CBC-SHA SSLv3 Kx=PSK Au=...
1
vote
1answer
2k views

selft signed certificate for AES128-GCM-SHA256 cipher

To generate self signed certificate for AES128-SHA256 cipher using openssl, following commands are used. AES128-SHA256 cipher commands :- openssl genrsa -aes128 -out 1.key 2048 openssl req -...