Questions tagged [handshake]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
3 views

TLS1.2 Handshake to SharePoint Online Failing from Windows Server 2012 R2

Having some trouble communicating with our SharePoint Online (SPO) site. I am simply going to a browser (IE v11) on a Windows Server 2012 R2 VM and navigating to the SPO home page. In Wireshark I see ...
  • 1
0 votes
1 answer
49 views

Who starts with change cipher spec in a TLS handshake?

After looking at many explanations about the TLS handshake I noticed that sometimes the server starts with the change cipher spec command and sometimes the client starts with it. I'm wondering why. Is ...
0 votes
0 answers
28 views

Which Keys TLS uses? [duplicate]

I know that in TLS 1.2 the client generates PMS (Pre Master Secret) which is used to get master_secret and Key_Block. Where Key_Block combined with clinet_random and server_random gives us: clientMAC, ...
  • 19
0 votes
2 answers
121 views

TLS1.3 handshake encryption

I was reading about TLS1.3 and my question is that are the server hello extensions encrypted? Why is it so and how are they encrypted?
  • 3
0 votes
2 answers
218 views

How browsers know which TLS handshake to use (1.2 vs. 1.3)

TLS 1.3 has a bit different handshake messages than 1.2 (and older) had. The client is supposed to send DH parameters directly in the first Client Hello message. How do browsers know if that's what ...
  • 379
0 votes
0 answers
60 views

Mutual TLS on OpenSSL - When does the server generate the CertificateVerify message?

When I am testing mutual TLS handshake performance on TLS1.3 using OpenSSL, I find a very wired thing: I created two groups of servers and clients: Server1 has a certificate signed using RSA3072, and ...
0 votes
1 answer
102 views

Block inbound TCP segments with ACK=0 vs Block inbound TCP segments with SYN=1, how are they same?

Blocking inbound TCP segments with ACK=0 Blocking inbound TCP segments with SYN=1 Both prevent external clients from making TCP connections to internal clients, but allow internal clients to connect ...
  • 1
1 vote
1 answer
979 views

How is the MIC (message integrity code) generated in WPA2?

We know that in WPA2's four-way handshake, a MIC is generated in order verify the supplicant (client). But how it is generated? Is something hashed to get the MIC? The PTK (pairwise transient key) ...
  • 13
0 votes
0 answers
203 views

symmetric key generation in TLS 1.3

Am trying to understand the phase where the symmetric key is getting generating. From what I am understanding Diffie-Hellman is used to derive the symmetric key in TLS1.3 I am reading this tls ...
  • 41
1 vote
1 answer
528 views

What is the relation between "signature_algorithms" handshake extension and TLS ciphersuite

I am learning TLS handshake and find client/serve will negotiate a cihpersuite during client/server hello. Usually, the last part of a ciphersuite is a hash algorithm, like SHA256 in ECDHE-ECDSA-...
  • 115
1 vote
0 answers
221 views

SSL Handshake in Android via Bluetooth Classic [closed]

I am working on implementing an Android App (client) which will be connected to Raspberry Pi (server) via Bluetooth Classic. To make data transfer securely, I want to implement SSL encryption between ...
3 votes
1 answer
213 views

Why can SSH negotiatie two different encryption and authentication algorithms?

I recently found out, that according to the RFC, SSH can negotiate two different cipher (and MAC) algorithms for server-to-client-encryption and for client-to-server-encryption (check section 7.1. for ...
  • 1,243
-1 votes
1 answer
107 views

Strong TLS parameters even though MITM is being performed

I am performing a MITM attack against my own network using bettercap and https proxy. On my client-side I use the Google Chrome browser and navigate to https://webs.com At the same time I use a script ...
1 vote
1 answer
166 views

TLS- Key exchange for session keys. Why?

I have a question about the Key Exchange Algorithm used in TLS process. I have read that the Key Exchange algorithm is used by client and server to exchange session keys. Do the client and server ...
  • 11
1 vote
1 answer
95 views

Is it possible that a single handshake can have 2 TLS versions included?

I am seeing different TLS versions (1.3 and 1.2) in the handshake and intermittently it fails with this error: TLSv1.3 (OUT), TLS handshake, Client hello (1):. 2020-05-28T14:44:00Z.664 [thread-...
1 vote
0 answers
796 views

Not able to capture 4 way handshake using airodump-ng

I am not able capture 4 way handshake, I also tried manually disconnecting and reconnecting my device to the network in hope that airodump-ng will capture the handshake but no luck. I checked the ...
  • 11
0 votes
1 answer
645 views

How does client verify the certificate provided by the server which is signed by different intermediate CA

I am creating a c++ secure client-server application using openssl library. I am still not clear about some aspects of the SSLHandshake procedure I have enabled Mutual TLS in-order verify the both ...
1 vote
0 answers
122 views

How does BLE secure connection ensure man in the middle protection?

I understand BLE secure connection pairing mode is improvement over Legacy Pairing. The issue with legacy pairing was intial TK value can easily be bruteforce by an attacker. In contrast, in secure ...
0 votes
1 answer
827 views

What is the role of leaf certificate private key In TLS handshake [duplicate]

What is the role of leaf certificate's private key if this certificate is signed by the intermediate certificate's private key and the certificate signature will only be validated using its public ...
1 vote
0 answers
99 views

How are symmetric encryption algorithms tracked once handshake is complete in common secure communication protocols?

My understanding is that most secure web communication protocols ultimately want to agree on a symmetric encryption algorithm to use for sending and receiving data. Once an algorithm is agreed upon by ...
0 votes
0 answers
36 views

Where the certificate public and private keys take a place? [duplicate]

I was reading this topic which talks about the handshake process and key exchange https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_7.1.0/com.ibm.mq.doc/sy10660_.htm The article says that the ...
2 votes
0 answers
86 views

Which messages are included in (D)TLS Finished message's verify_data field for session resumption

The https://www.rfc-editor.org/rfc/rfc5246#section-7.4.9 states which messages are included for PRF computation that is included in Finished messages It is clear for 'regular' (initial) handshake But ...
  • 121
1 vote
1 answer
181 views

TLS 1.2. Handshake: Where do Client and Server negotiate how the master key is built from randoms and pre?

I am currently trying to solve an exercise where I should look at a TLS 1.2 handshake trace while having access to pre and both randoms (server random and client random). In order to decrypt ...
  • 165
3 votes
1 answer
238 views

TLS 1.2 Handshake: Does the server have to take all extensions sent by the Client?

I am unsure about how extensions are handled in TLS v1.2. During the handshake, the client is able to add some extensions during ClientHello. As far I understood, the server can pick arbitrary ...
  • 165
0 votes
1 answer
155 views

Is Certification path construction algorithm needed for SSL/TLS?

In the TLS Handshake a Certificate message is sent. This message contains the (chain of) certificates needed to validate the provided certificate of the communicating party. However, I have also ...
  • 15
0 votes
1 answer
505 views

SSL server sends wrong certificate when accessed via Java

In my project I have to integrate with another system which uses quite specific SSL (and also specific cipher suite). Here's what I mean. Whenever I try to access the server with Java (send a request)...
2 votes
1 answer
294 views

Does the SSL record protocol encrypt the handshake protocol too?

As I know the first communication protocol which establishes between client and server in SSL is handshaking protocol and as this site says: The SSL record protocol is used to transfer any data ...
1 vote
1 answer
204 views

Does a TLS client needs to support one of the named groups (curves?) supported by the server for TLS handshake to succeed?

Does a TLS client needs to support one of the named groups (curves?) supported by the server for TLS handshake to succeed? Longer version: I'm running a web site using Windows Server 2016. The web ...
1 vote
2 answers
142 views

Handshake without asymmetric encryption

One of my teacher said "Without asymmetric encryption, we would be forced to use third-party to initiate any connection". I don't understand how it can be possible, what if an attack occur during the ...
0 votes
0 answers
17 views

Which part/step of the TLS handshake is essential for providing PFS? [duplicate]

I would say the key exchange part, because PFS is used only during the key exchange of server and client. Am I right or have I overlooked something?
  • 1
2 votes
1 answer
246 views

TLS handshake random bytes reused

What would happen if the random bytes provided by the client and the server in the first two messages would be reused by one peer/by both peers? I think it would highly reduce the provided security, ...
  • 123
0 votes
1 answer
266 views

Why is there only two packets in a TLS handshake?

I captured my network traffic to a web server and the SSL Handshake consists only of two packets. Why does that happen and why aren't there all the other packets?
  • 1
1 vote
2 answers
4k views

SSL handshake not visible in Wireshark

In my organization we have a cloud proxy that work on a loopback address. The vendor of this proxy has deployed an app on our machine which listens on the loopback address. I have captured the apps ...
20 votes
3 answers
6k views

Can attackers change the public key of certificate during the SSL handshake

The communication is not encrypted during the SSL handshake. If an attacker conducts a man in the middle attack between server and client to capture the certificate, and change the public key in the ...
  • 353
2 votes
0 answers
1k views

Airgeddon-ng Handshake fail [closed]

I've followed the following instructions below. This is a freshly installed Parrot OS, not using VirtualBox and etc. I am also using Alfa AWUS036NHA wifi adapter. ifconfig sudo airmon-ng start wlan1 (...
  • 21
1 vote
1 answer
213 views

how are symmetric keys generated in TLS [duplicate]

My confusion stems from reading that TLS handshake uses some kind of Diffie-Hellman, when I was certain that the symmetric key was generated by a digest of earlier packets encrypted with clients ...
0 votes
1 answer
114 views

Do wifi access points and routers get some kind of data from devices when a device is able to see them?

I was wondering if when a router is broadcasting its signal, it is able to handshake with devices that are wifi enabled and looking for a wifi network to connect and get some info from them?
1 vote
1 answer
285 views

Is it possible to setup 1-way TLS client authentication without server certificates?

Is it possible with TLS to only authenticate the client? In other words can one-way TLS be setup in such a way that only the host initiating the connection uses a client certificate and the second ...
  • 11
1 vote
1 answer
1k views

TLS-Handshake, Server Key Exchange, Diffie-Hellman: Where does key length come from?

Where does the key length come from? In this example it is 2048 bits long: Secure Sockets Layer TLSv1.2 Record Layer: Handshake Protocol: Server Key Exchange Content Type: Handshake (22)...
  • 135
3 votes
1 answer
472 views

Authentication handshake between two independent apps

I need help on a solution for below scenario from a security perspective. Scenario: There are two independent web applications App1 and App2. User will log in to App1 by performing authentication ...
  • 31
-1 votes
2 answers
2k views

Interpreting SSLLabs Handshake simulation results

While testing SSL/TLS details on ssllabs.com for a website, the Handshake Simulation part contains: TLS 1.2 > http/1.1 TLS 1.2 > h2 For eg: What do these things mean? I couldn't find it ...
1 vote
2 answers
235 views

Key reinstallation attack how does it work without a pre-shared key?

The author of the key reinstallation attack released scripts on Github to test AP and clients. To test the clients, you have to connect to a fake AP but you still need to know the pre-shared key. Of ...
0 votes
0 answers
802 views

TLS Pre-master key [duplicate]

If I have access to the pre-master key of a TLS handshake, is it possible to decrypt the rest of the handshake following this? If so, is it possible to get the pre-master key while it is still not ...
0 votes
1 answer
332 views

Can do I brutefore wifi password with handshake without wifi detection? [closed]

I have captured handshake but now I want to bruteforce wifi without detection it (in different place). Is it possible? If yes, how to do that?
0 votes
0 answers
92 views

Identify SSL invalid handshake using Wireshark

I am doing a research on "Network flow anomaly detection" and use Wireshark for my work. I have a problem of identifying the packets with invalid SSL/TLS handshakes. Is there a way/algorithm to detect ...
3 votes
1 answer
368 views

Is it possible to make HTTPS 0-RTT with help from DNS?

This article gives an implementation of encrypted SNI where a public key is retrieved from the DNS. It feels like cheating but imagine this: If the server publishes its certificate on its DNS record, ...
  • 1,613
0 votes
1 answer
485 views

How does Authenticator gets the PMK which is used to calculate PTK?

I am trying to setup a Supplicant- authenticator and AAA server to perform EAPOL mechanism. I am able to successfully completed the EAP authentication procedure but 4-way handshake was not initiated ...
2 votes
0 answers
132 views

WPA technical doubts (3)

This is the third post about the set of doubts that came up when I tried to understand WPA3. I am new to this world of cyber-security so every bit of help is welcome! Someone told me that in WPA2 ...
  • 109
0 votes
1 answer
2k views

Finding wpa2 key length

Is it possible to determine WPA key length through a successful handshake? Below is a screen capture showing the packet capture session of interest as displayed in Wireshark: My question came from ...
4 votes
2 answers
13k views

What is the Session ID parameter indicate in Client Hello and Server Hello messages

I was trying to understand the TLS handshake in depth. I set up Wireshark and captured the github.com traffic. While inspecting the Client Hello and Server Hello, I found a parameter Session ID. ...