Questions tagged [tls]

SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

Filter by
Sorted by
Tagged with
1 vote
0 answers
9 views

x509 certificates are still exposed even with Encrypted Client hello?

Encrypted Client Hello hides Server Name Indication (SNI). However, looking at the TLS Handshake (https://tls12.ulfheim.net/). Wouldn't it be possible for a middle-man to inspect the TLS Handshake and ...
4 votes
3 answers
8k views

Link between Cipher suites and certificate key

I'm trying to understand the SSL/TLS protocol and I'm lost on a specific point. What is the link between the public server key (eg. : "EC 256 bits" or " RSA 2048 bits") and the cipher suites ? ...
1 vote
0 answers
46 views

Why does EAP-TLS 1.3 not allow for PSK authentication?

EAP-TLS with TLS 1.3 is standardized in RFC 9190. Section 2.1.1 specifies Authentication. The RFC states that PSK authentication shall not be used except for resumption. This is surprising, because ...
0 votes
1 answer
29 views

Is key renegotiation necessary with a larger cipher in OpenVPN?

OpenVPN allows the use of their 'reneg-sec' option to renegotiate keys for the data channel at a specified interval. This helped protect against exploits like Sweet32 with 64 bit block ciphers a while ...
1 vote
2 answers
42 views

When renewing a TLS certificate (no change to CSR nor private key), will the modulus remain the same?

Here is the scenario, just wanted confirmation that I am understanding it correctly. I have a TLS certificate that will expire soon; Upon renewal, I paid the CA, and they reissued me with a new public ...
5 votes
3 answers
863 views

Decrypt TLS 1.2 traffic between .NET Windows applications

I have attempted to decrypt traffic between two .NET applications (both on Windows platforms) using Wireshark but due to the Diffie Hellman with perfect forward secrecy, I cannot use my private key ...
0 votes
0 answers
11 views

ProxyPassMatch redirect to the same request uri

I am doing a reverse proxy with apache to redirect https traffic filtering by the uri request. Right now I have the next ProxyPassMatch "^/thisisthepath$" "https:192.168.1.40/...
0 votes
0 answers
29 views

Is SSL necessary when sending password to a API from a server?

I have bought a online service which allows me to send SMS messages by making a call to the provider's SOAP-API. This is the WSDL I need to send a message: <?xml version="1.0"?> <...
0 votes
0 answers
14 views

Is there a diagram for start point on the Win 10 browser properties box when sending the CA of the website currently open [closed]

How do I POST the CA certificate of the current website to the right archive of the home server .etc. using a Windows 10 browser. Include details: The lock on the browser to open the dropdown list ...
0 votes
1 answer
64 views

P-384 vs. SHA384

Forgive my inexperience with encryption, I've been researching this for the better part of the morning and still cannot find a smoking gun answer. A vendor is requesting that we verify a website we ...
0 votes
2 answers
165 views

For organizations running modern, functioning PKI, can mTLS be used as SSO mechanism?

I am trying to determine best practices for implementing a webapp running in an extremely tight PKI environment. Assume: Yubikey like devices that have Certs with reasonable expiration dates The ...
-1 votes
0 answers
44 views

What is the math behind SYN cookies?

I understand the reason behind syn cookies is to defend the server against DoS through syn flooding by syn requests from spoofed IP addresses. I also understand that its feature is that it doesn't ...
16 votes
5 answers
4k views

How likely/possible is it that the NSA have broken common encryption techniques such as SSL/TLS?

Jumping on the NSA/Prism questions bandwagon - There's been a lot more attention drawn to facilities such as Room 641A which indicate that the NSA has been, amongst other things, applying mass ...
3 votes
1 answer
65 views

REST API behind proxy, is TLS sufficient?

I have the following problem: A service provides a REST API. Different kinds of clients (desktop applications, mobile applications, web applications) connect to this API and send and receive data. In ...
1 vote
2 answers
384 views

Why doesn't Windows send all enabled cipher suites during TLS handshake?

I have a system with custom cipher suites specified in this registry key HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002!Functions TLS_AES_256_GCM_SHA384 ...
1 vote
1 answer
35 views

Validate HTTPS traffic at later time [duplicate]

I want to capture HTTPS traffic, save it, and validate it at a later time. I want to ensure that at a later time I'm able to validate the HTTPS traffic using the certificate which was presented at the ...
26 votes
5 answers
6k views

Is it safe to ignore/override TLS warnings if user doesn't enter passwords or other data?

A user is trying to access a poorly maintained website using a modern OS (Windows 10) and web browser (Firefox 100.0). They want to download something from there, but they are seeing a security ...
0 votes
2 answers
235 views

X509 / SSL certificates in practise

After learning the theory behind cryptography I'm having quite some problems understanding how SSL or X509 certificates works in practise and I simply cannot find useful information in the internet. ...
6 votes
1 answer
15k views

TLS/SSL Certificate - Key usage and encryption

So I'm looking at google.com's SSL certificate and do not understand a few things: I totally get that it ensures the identity of Google's webserver, but don't understand how it proves anything about ...
5 votes
1 answer
1k views

How to decrypt Diffie-Hellman encryption in WebRTC?

I have installed a WebRTC server application, which is designed for Contact Center solutions: communicates with internal PCs in pure RTP (agents), and with external PCs (customers) using encrypted ...
115 votes
18 answers
20k views

Does an established HTTPS connection mean a line is really secure?

From the view of somebody offering a web application, when somebody connects with TLS (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
2 votes
0 answers
923 views

What are the different secrets in the SSLKEYLOGFILE file?

I've dumped the secrets from a TLS handshake into a text file but I don't understand what the different secrets are. I have: SERVER_HANDSHAKE_TRAFFIC_SECRET EXPORTER_SECRET SERVER_TRAFFIC_SECRET_0 ...
6 votes
3 answers
694 views

DHE exchange and client authentication

If a server has a known public key and a Diffie-Hellman exchange is performed and signed by that key, is there any benefit to authenticating the client before establishing a secure channel instead of ...
1 vote
0 answers
88 views

How exactly does OpenVPN's tls-auth option apply HMAC to packet messages?

Update: I've been able to work out everything I was asking about packet structure when I was finally able to get Wireshark to work, but there is one last thing I'm confused on which I detail at the ...
0 votes
4 answers
119 views

Which cipher is more secure TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA or TLS_RSA_WITH_AES_256_GCM_SHA384?

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA supports forward secrecy but it doesn't use GCM mode and use SHA1 TLS_RSA_WITH_AES_256_GCM_SHA384 uses GCM mode and SHA2 but it doesn't support forward secrecy. ...
0 votes
4 answers
157 views

If your router gets hacked, can the hacker acquire your RSA private key to decrypt HTTPS and view full URL's?

In order to decrypt HTTPS you need the public key and the private key. How can a hacker acquire the private key? What exactly does he have to do to get it? I read that they use packet sniffers like ...
395 votes
10 answers
271k views

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
10 votes
3 answers
2k views

Upgrade-Insecure-Requests as an alternative for HSTS

I have seen that websites automatically transform HTTP requests into HTTPS without the HTTP Strict Transport Security (HSTS) Header. So does the following line in the request fully alleviate the ...
0 votes
1 answer
35 views

Email TLS coverage for forwarded recipient email address

When an email recipient server (say server-A) is configured to forward to another email addresses (on say server-B), is TLS applied all the way up to server-B, or does it end at server-A, or something ...
0 votes
1 answer
38 views

Secure FTP (AUTH TLS) fails from office lan

From our office LAN, Secure FTP connections fail. But with a VPN client connection, there is no problem. What could be the cause of this problem, what do we have to change on our firewall? I normally ...
1 vote
1 answer
42 views

Is providing a static TLS key during an OpenVPN handshake useless for commercial providers?

When using OpenVPN, tls-auth and tls-crypt are widely adopted options, allowing a static key to be used in the initial handshake. This helps prevent against DoS attacks, as without the valid key a ...
2 votes
2 answers
1k views

iOS traffic not shown in proxy when SSL pinning enabled

I have and iOS application to test. As per the latest security fix SSL pinning is enabled in the app. But now I am not able to see any traffic related to the application in my proxy tool. But ...
1 vote
1 answer
50 views

Certificate warnings on websites with client certificate authentication

I have been operating websites that use client certificates to authenticate the users. To my understanding, you need to make your own CA. First of all, that way an attacker will have huge troubles to ...
2 votes
2 answers
57 views

Java support for TLS_DHE_RSA_WITH_AES_128_CCM

My test tool uses java and I need it to use TLS_DHE_RSA_WITH_AES_128_CCM. Does standard java (Oracle) support CCM cipher suites? I am seeing oracle links mentioning CCM but am not able to make it work....
3 votes
2 answers
697 views

Can I concatenate multiple x509 certificates?

I have a very large cluster I am building of over 100 nodes, there are various types but I will use the Elasticsearch nodes as an example. I am encrypting mesh connections between nodes with TLS. ...
1 vote
0 answers
19 views

Would adding encryption to an MPLS provide additional protection for application access which is over TLS?

I have users at a remote site who access business application via an MPLS. The applications use HTTPS (TLS). The MPLS connection that we have is non-encrypted. The data is sensitive. Would adding ...
0 votes
0 answers
91 views

I was asked to install an SSL .cert in my server, should I do this?

I am trying to connect to a company's internal API (I am working on a project for them). This company has an API that has an SSL certificate from Sectigo. From what I have gathered is a pretty well ...
1 vote
5 answers
674 views

Manual DNS change

If I manually change my DNS setting in the router or in Windows settings from the provider's one to, say, 8.8.4.4 by Google - will it mean that my ISP has no idea which sites I am going to? Maybe it ...
0 votes
2 answers
1k views

Using Tor in public WIFI is it secured? [duplicate]

Is using the Tor network to visit the web pages in public wifi secure or not since Tor will help to make us anonymous (hide the metadata such as URLs) and HTTPS helps us to protect the content. Will ...
2 votes
1 answer
1k views

Is SSL/TLS sufficient for safe transit of binary data via API traffic?

We are using object storage from the vendor of our cloud server to store image templates (vhd) of our cloud server in the event that we need to re-provision our server install quickly. We would like ...
0 votes
0 answers
14 views

Hijacking of sessions: public unencrypted network vs public “password” protected network

What, if any, functional security difference exists between having an unsecured “open” public wifi and one that uses a publicly available password? An example of the latter is: a wifi with SSID “...
4 votes
2 answers
293 views

Does accessing a server over HTTP vs HTTPS make any difference when using a VPN?

Building on Does using VPN improve security when connecting to a HTTP website?, I need to access servers at a client site. These are only accessible when using the site VPN. The services currently run ...
0 votes
0 answers
60 views

Using someone else's SSL certificate [duplicate]

As far as I know, the SSL certificate is public and anyone can read it. Is it possible in this case, for example, when someone, having copied the SSL certificate of my bank for himself, will be able ...
0 votes
0 answers
19 views

When in a container do TCP API calls need TLS? [duplicate]

I have an application I'm building where all components will be contained inside a single container. I'm wondering about API calls within the container between the components, i.e using localhost, ...
0 votes
1 answer
51 views

Why is Nessus report HTTP running a web server on port 80 when I'm sure that it isn't?

From a Nessus scan I have the following output regarding HTTP and the use of port 80: Info N/A 43111 HTTP Methods Allowed (per directory) Info N/A 24260 HyperText ...
5 votes
2 answers
435 views

Can Heartbleed expose a Tor user's IP address?

It is interesting to observe, that Tor exit nodes with out-of-date OpenSSL implementations can themselves be affected by the Heartbleed bug. Can Heartbleed expose a Tor user's IP address merely by ...
3 votes
1 answer
2k views

In depth Tor encryption design details

I am currently struggling with understanding the details of a connection in Tor, mainly because I try to understand PCTCP. In this paper the authors claim that the changes are local to the onion ...
0 votes
3 answers
283 views

Tor security if ISP blocks TLS channel?

If ISP blocks TLS channel while a user is using Tor, can he read the Tor traffic, since Tor uses TLS encryption ?
3 votes
2 answers
397 views

Can First Hop Man in the Middle be Defeated with Tor or VPN?

I was reading this article about a certain in flight WiFi provider issuing fake SSL certificates for Google. This doesn't really surprise me all that much since I'm well aware of the concept of ...
2 votes
2 answers
3k views

What can be a reason you DON'T want to use port 443 for SSL communications

We are trying to make a connection to a other service for my company and the webservice is hosted over a VPN on port 444 with SSL. I am just wondering why you should NOT want to use the standarized ...

1
2 3 4 5
111