Questions tagged [handshake]
The handshake tag has no usage guidance.
0
votes
1answer
51 views
Authentication handshake between two independent apps
I need help on a solution for below scenario from a security perspective.
Scenario:
There are two independent web applications App1 and App2.
User will log in to App1 by performing authentication ...
-2
votes
2answers
83 views
Interpreting SSLLabs Handshake simulation results
While testing SSL/TLS details on ssllabs.com for a website, the Handshake Simulation part contains:
TLS 1.2 > http/1.1
TLS 1.2 > h2
For eg:
What do these things mean? I couldn't find it ...
1
vote
1answer
91 views
Key reinstallation attack how does it work without a pre-shared key?
The author of the key reinstallation attack released scripts on Github to test AP and clients.
To test the clients, you have to connect to a fake AP but you still need to know the pre-shared key. Of ...
0
votes
0answers
45 views
TLS Pre-master key [duplicate]
If I have access to the pre-master key of a TLS handshake, is it possible to decrypt the rest of the handshake following this?
If so, is it possible to get the pre-master key while it is still not ...
0
votes
1answer
76 views
Can do I brutefore wifi password with handshake without wifi detection? [closed]
I have captured handshake but now I want to bruteforce wifi without detection it (in different place). Is it possible? If yes, how to do that?
0
votes
0answers
30 views
Identify SSL invalid handshake using Wireshark
I am doing a research on "Network flow anomaly detection" and use Wireshark for my work. I have a problem of identifying the packets with invalid SSL/TLS handshakes. Is there a way/algorithm to detect ...
3
votes
1answer
204 views
Is it possible to make HTTPS 0-RTT with help from DNS?
This article gives an implementation of encrypted SNI where a public key is retrieved from the DNS. It feels like cheating but imagine this: If the server publishes its certificate on its DNS record, ...
0
votes
1answer
61 views
How does Authenticator gets the PMK which is used to calculate PTK?
I am trying to setup a Supplicant- authenticator and AAA server to perform EAPOL mechanism.
I am able to successfully completed the EAP authentication procedure but 4-way handshake was not initiated ...
2
votes
0answers
66 views
WPA technical doubts (3)
This is the third post about the set of doubts that came up when I tried to understand WPA3. I am new to this world of cyber-security so every bit of help is welcome!
Someone told me that in WPA2 ...
0
votes
1answer
403 views
Finding wpa2 key length
Is it possible to determine WPA key length through a successful handshake?
Below is a screen capture showing the packet capture session of interest as displayed in Wireshark:
My question came from ...
0
votes
2answers
1k views
What is the Session ID parameter indicate in Client Hello and Server Hello messages
I was trying to understand the TLS handshake in depth. I set up Wireshark and captured the github.com traffic. While inspecting the Client Hello and Server Hello, I found a parameter Session ID.
...
2
votes
1answer
112 views
TLS 1.2 Missing Finished Message
I'm setting up a TLS connection for the purposes of sending secure SIP. The remote gateway (Twilio) doesn't always send a finish message and as such those requests fail. Everything else appears to ...
1
vote
2answers
481 views
Where is Hashing Used in the TLS Handshake
I understand the basic steps in the TLS handshake. My question is, where and how does one-way hashing fit into the steps below? Is it the session key that is hashed? Many texts mention that the ...
0
votes
1answer
86 views
How SSL Handshake recognise any attack
I already know that a replay attack on an SSL handshake is ineffective, but if we suppose that an "intruder" has listened and has got all of the information from a previous handshake, how will the ...
1
vote
0answers
124 views
Why WPA2 did not design a PTK based on asymmetric cryptography?
I was shocked to learn how the PTK is crafted from the PMK in WPA2 WiFi.
PMK is made with crypt_hash(SSID + PSK). OK, seems good.
Then, the client and the Access Point (AP) make the famous 4 way ...
1
vote
2answers
161 views
Do TLS standards require the server-side preference to always be used when negotiating ciphers to use?
Someone told me the other day that the TLS standards require the server-side to always have the authority to decide which mutual cipher to use when negotiating with a remote client.
This makes sense,...
2
votes
0answers
42 views
What forces SSL exchange to require my smartcard to finish handshake
First, I hope that this is a legitimate question because it is spawned by what I am experiencing and what is happening. The environment is as follows... I have an apache reverse proxy, that I stood ...
3
votes
1answer
337 views
What are the factors making a WPA2 handshake suitable for cracking?
Days ago I was dumping handshakes of my APs using airodump-ng. I would later use aircrack-ng to crack them using wordlists which would purposely contain the passphrases. However, I noticed that some ...
0
votes
2answers
120 views
Why not encrypt TLS handshake?
this is my first question here, I've researched this briefly but couldn't find any satisfying answer.
TLS handshakes are being sent over the wire unencrypted. This way someone that eavesdrops can ...
2
votes
1answer
204 views
In TLS 1.3 handshake, can an internal error at the client be interpreted as a decrypt error at the server?
In TLS 1.3 handshake protocol, the client sends the ClientHello message to the server. The server then sends back the ServerHello message followed by some encrypted messages. The client then computes ...
4
votes
1answer
119 views
Circumventing Netflow's visibility on SSL traffic
In a SSL handshake, the hostname is visible most of the time as it is needed to validate the certificate over HTTP. Netflow is thus able to pick up the common name from the certificate exchange, ...
1
vote
0answers
335 views
SSL/TLS handshake potential vulnerabilities [duplicate]
After handshake one could be assure that data are encrypted and secure.
But before that, handshake parameters are transferred via not secured channel. One could be MitM during the handshake procedure....
1
vote
0answers
222 views
what is the logic in choosing a certificate chain during a “server-hello” message in a SSL/TLS handshake
In a client-server ssl handshake, my server sends a certificate chain back to the client in a server-hello message. But I want to understand as to how that particular certificate chain is getting ...
2
votes
1answer
4k views
HandShake TLS- Certificate Unknown
I have added the necessary certificates to communicate a web service by TLS, both the client and the server added the certificates to the keystore, but in the handshake, certificate unknown is ...
1
vote
2answers
62 views
Decide for client certificate auth in https based on hostname or url
Let's assume this (made-up) scenario: I install a webserver that reacts on two hostnames (anonymousserver.com and authenticatedserver.com)
I would like the following behaviour:
If the webserver is ...
1
vote
2answers
1k views
Airodump-ng doesn't capture handshake or sees any devices connected on Kali, but captures everything on Backtrack. How to fix it? [closed]
I ran into a problem in using kali linux system.
Kali doesn't allow me to see any devices connected to certain spot or capture any handshakes, I know that it can capture them(and see connected ...
1
vote
1answer
499 views
Sniffed SSL/TLS decryption : handshake necessary?
I read some topics where people claim to be able to decrypt SSL/TLS communications just by having the private key of the recipient.
But, I recently learned that a public key can, but should never ...
3
votes
0answers
383 views
Raspberry Pi (Raspbian) not capturing WPA2 handshake with Aircrack-ng [closed]
I've been using Aircrack for a short time now with my Alfa wfif adapter on my laptop and it's been working perfectly. However when I try and do the same thing on my Raspberry Pi it's having issues ...
