Questions tagged [tls]
SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
4,852
questions
1
vote
1answer
37 views
Does different clear text size mean different encrypted size in TLS?
Is an attacker able to intercept tls communication and get cleartext size information from the encrypted size of intercepted payloads? Or is there some kind of padding which would prevent messages ...
0
votes
1answer
86 views
Unnecessary SSL encryption in API?
Im developing my first API but I think I can optimize the server response by eliminating an SSL decryption.
The server recieves POST request with two parameters:
Action (int value)
Data (base 64 ...
0
votes
0answers
19 views
How to Load My Non-Public Site via HTTP (No SSL Config) - All Browsers Auto-Redirect to HTTPS [migrated]
I need to load my website via HTTP, but all browsers automatically redirect to HTTPS. I have no SSL setup on the site (the domain name is not registered anywhere), nor is the server expecting SSL (...
1
vote
1answer
69 views
How to listen on all encrypted (SSL/TLS) traffic of a (Windows) system under your control?
On one of my Windows machines (so I am admin and basically can do whatever I want with it) I'd like to analyse traffic which obviously is directed to a malware C&C server. The traffic is TLS ...
0
votes
1answer
85 views
Some questions about encryption in Java
I have some questions about encryption in java as I'm trying to develop a password-manager-like application for my final test in Computer Science in High School (Germany). The password manager uses a ...
-2
votes
0answers
91 views
Why honour-killing your website is the best practice if HTTPS doesn't work? [closed]
I'm trying to understand the phenomenon that's been prevalent for the last few years coming out of the security community.
I have a popular blog about cats and dogs; I'm being told I must enable ...
1
vote
1answer
62 views
Is this a PEM certificate?
I'm doing research on certificates and I've managed to find a dataset.
It is a single large text file where each line appears to be a PEM encoded certificate but I am unable to load them using pythons ...
0
votes
1answer
40 views
Signature hash algorithm SHA256 (Certificate) vs Peer signing digest: SHA1
As client I am using an API of a company. To be able to connect I have to decrease the security level to CipherString = DEFAULT@SECLEVEL = 1 in /etc/ssl/openssl.cnf using OpenSSL 1.1.1d.
Then if I ...
1
vote
0answers
28 views
Which messages are included in (D)TLS Finished message's verify_data field for session resumption
The https://tools.ietf.org/html/rfc5246#section-7.4.9 states which messages are included for PRF computation that is included in Finished messages
It is clear for 'regular' (initial) handshake
But ...
2
votes
2answers
58 views
Can I use the same truststore and keystore on the client and the server?
TL;DR: Is it possible to have both sides of a SSL/TLS connection have the same public and private key, so long as that public key is trusted by both sides?
More info if helpful:
I'm trying to test ...
1
vote
1answer
66 views
Can you restrict the services a certificate can access on the client side?
I have a verification certificate signed by my organisation’s CA, which I can use to authenticate my user account on intranet web services.
Is there someway I can sign a new certificate which can ...
0
votes
2answers
69 views
Is there anything I can do past SSL pinning to secure my connection?
My goal is to prevent man-in-the-middle (MITM) attacks through proxies. I've implemented SSL pinning, which has helped significantly, but I'm wondering if there's anything more I can do that's worth ...
0
votes
0answers
21 views
PKIX path validation failed while connecting from Java [migrated]
I have simple Java client to MQTT Mosquitto server:
public class TestMQTT3 {
public static void main(String[] args) {
System.out.println("Starting");
String serverUrl = "ssl://...
0
votes
1answer
33 views
Default values for distinguished_name
Creating certificate:
openssl req -new -newkey rsa:2048 -keyout private/cakey.pem -out careq.pem -config ./openssl.cnf
I have value that tells openssl not prompt for req_distinguished_name fields:
...
0
votes
0answers
57 views
Outside Router MitM Attack
I'm trying intercept my router's ACS requests which are behind HTTPS. I don't think my router validates certificates so it is possible to do a MitM attack. I'm using a debian installed laptop with two ...
4
votes
1answer
122 views
Certficate pinning: should I pin the leaf or intermediate?
I'm following this article : Android Security: SSL Pinning to implement certificate pinning in Android using OkHttp.
As our app clients do not update their app regulary I don't want to take the risk ...
1
vote
0answers
23 views
How does HTTP Catcher (iOS app) work on SSL/TLS? [duplicate]
From the official description:
HTTP Catcher is a web debugging proxy. It can be used to intercept, inspect, modify and replay web traffic.
Can someone explain to me how HTTP Catcher manages to do ...
0
votes
1answer
66 views
Why there are some weird requests to my web hosting [duplicate]
I was doing my plesk hosting logs checking for web and database development. Somehow, I had seen some weird ip trying to communicate to hosting. Wonder what is the purpose of these anonymous requests. ...
1
vote
1answer
40 views
What's the block cipher mode of my PEM certificate?
How can I find out the mode block cipher used in a PEM certificate I have?
It's been generated with an intermediate CA that does sha256WithRSAEncryption but I need to find out if it's a GCM or CBC to ...
1
vote
1answer
62 views
Generate certificate v3 instead of v1
Trying to get certificate v3, but getting v1. I'm using following commands:
openssl req -out server.csr -newkey rsa:2048 -nodes -keyout server.key -config san_server.cnf
openssl ca -config san_server....
-1
votes
2answers
79 views
TLS1.2 vs TLS1.3
I have seen that most companies use the TLS1.2 protocol, why not use the TLS1.3?
My question here is, what are these pros and cons of both, and currently what is a better option?
0
votes
0answers
43 views
How to encrypt data on local LAN (without Internet)? [duplicate]
I'm wondering what is the bank-grade encryption for traffic between a client (say, Windows app) and a server, both on local network. It looks like to use ssl encryption, they must have Internet access ...
0
votes
1answer
41 views
TLS handshake encryption
In TLS 1.3, handshake messages after Hello and KeyShare--e.g., certificates, signature, finished--are encrypted using an AEAD cipher. Can someone explain what the rationale is? Is it mainly for ...
1
vote
1answer
47 views
Can I test ssl connection locally with a valid certificate (CA) with local dns?
I have a wildcard valid certificate signed by Certificate Authority. Is it possible to test the https locally from the server without a registered DNS?
My idea is to bind the domain name with 127.0....
1
vote
2answers
79 views
EAP vs TLS authentication
I am having trouble understanding the point of EAP.
EAP is an authentication framework, which defines several TLS based methods and encapsulations like EAP-TLS, EAP-TTLS and PEAP. These all require ...
3
votes
1answer
131 views
A workaround for external website's HTTP registration page
There is a website which I want to register for but it is a internship/job-seeking website and thus on registration some VERY sensitive data is required.
When registering Firefox alerted me that the ...
1
vote
1answer
59 views
TLS 1.2. Handshake: Where do Client and Server negotiate how the master key is built from randoms and pre?
I am currently trying to solve an exercise where I should look at a TLS 1.2 handshake trace while having access to pre and both randoms (server random and client random).
In order to decrypt ...
2
votes
0answers
93 views
Help with meterpreter reverse https
I was trying to practice with meterpreter, so I used the overflow ms17_010_eternalblue and as a payload windows/meterpreter/reverse_https but I am unable to make this payload to work properly.
1st ...
3
votes
1answer
57 views
TLS 1.2 Handshake: Does the server have to take all extensions sent by the Client?
I am unsure about how extensions are handled in TLS v1.2.
During the handshake, the client is able to add some extensions during ClientHello. As far I understood, the server can pick arbitrary ...
1
vote
0answers
27 views
Is the SDP a=crypto attribute relevant when DTLS-SRTP is used?
The a=crypto attribute in RFC 4568 has a separate section 9.2. for SRTP "Crypto" Attribute Grammar. What it basically includes is a list of attribute values required for encrypting media (crypto ...
3
votes
2answers
53 views
Client Certificates from Public Certificate Authorities
I'm looking into mutual TLS authentication for a B2B API. Is it possible to use mutual TLS authentication using X.509 certificates while relying on Public CAs?
I see that some Public CAs (from CA/...
1
vote
1answer
63 views
How to identify which certificate I'm missing to produce HTTPS calls?
I posted a question similar to this one on Stack Overflow, but that has not produced any answers so far, so I'm hoping someone here will be able to help me out.
Somewhat simplified, I'm trying to do ...
2
votes
2answers
73 views
How are PSKs agreed upon by the TLS server and client?
I've read that pre-shared keys (PSKs) are symmetric keys shared in advance among communicating parties but have found no explanation as to how the TLS client and server agree upon the value of the PSK....
1
vote
2answers
456 views
main reasons to disable TLS 1.1/1.2
What is the security risk of not disabling TLS v1.1/.2 ?
I have multiple websites on Cloudflare
1
vote
1answer
133 views
No Client Hello w/ SNI when accessing website's subdomain via link
I noticed this while testing SNI-based HTTPS filtering for fun. My test was to block mail.yahoo.com, but allow other yahoo.com services. Here are my tests using Chrome:
Access mail.yahoo.com by ...
1
vote
1answer
71 views
Questions about SOCKS5 security
I'm planning to start a distributed crawler in order to avoid common limitations imposed by servers/CDN like rate limit, region filter, and others.
My idea is to have a central server and multiple ...
1
vote
2answers
55 views
AES Traffic Security Assesment
Assume we have only access to the traffic between two module (Hardware, Software, ...) and These modules communicate with SSL (PSK).
Is it possible to assess AES encryption of this traffic?
some ...
26
votes
2answers
15k views
How are full URLs exposed when they are encrypted by HTTPS?
As far as I know, HTTPS URLs are encrypted (correct me if I'm wrong). There was a data leak recently and in one article about the leak I saw this picture:
If HTTPS URLs are encrypted then how did the ...
0
votes
0answers
37 views
How to make sure the domain level SSL certificate is present in trust store while establishing the connection to a website? [migrated]
According to my understanding, when we are trying to connect to a website/url, even if one of the certificates in the SSL certificate chain of the website is present in the trust store then connection ...
4
votes
3answers
89 views
implementing an authentication mechanism for understanding the basics of client authetication
I'm trying to implement a simple protocol to authenticate users and authorize them to access a certain web page/resource via a login form.
Please note that this is just something to use on my own and ...
-1
votes
1answer
47 views
DH cipher suites and DH OpenSSL Generated
I need a openssl generated diffie-hellman params for work with ECDHE or DHE cipher suites on TLSv1.2 nginx server?
2
votes
1answer
73 views
Can I concatenate multiple x509 certificates?
I have a very large cluster I am building of over 100 nodes, there are various types but I will use the Elasticsearch nodes as an example. I am encrypting mesh connections between nodes with TLS. ...
0
votes
2answers
173 views
Why does Firefox (version 71.0 (64-bit)) indicate “weak encryption” but Google Chrome (Version 79.0.3945.88) does not?
I read that Mozilla uses its own trust certificate store but does "weak encryption" have anything to do with whether the browser trusts the certificate?
Has it got anything to do with the signature ...
1
vote
0answers
53 views
Breakdown of signature verification in CertificateVerify (TLS 1.3) with RSA-PSS
I'm debugging a TLS v1.3 client program, which failed to verify the signature in server's CertificateVerify, so I'm learning the procedures for verifying the signature from server's CertificateVerify ...
0
votes
1answer
54 views
Proving authenticity of data accessed over TLS by an untrusted third party
Is there any way an untrusted third party who has access to content from a website over HTTPS can prove the authenticity of the data (i.e. that it was distributed by a server in possession of a ...
1
vote
1answer
37 views
Should we do request manipulation or network packet manipulation for SDN vulnerability analysis? [closed]
I am planning to do vulnerability analysis of a Software Defined Network. Since the connection between the business apps and the controller of the SDN would be done over the application layer, I would ...
1
vote
1answer
99 views
Is SSL-strip still viable as a method of attack?
Seeing as SSL-strip works by intercepting redirects and links to HTTPS, is this still a viable MITM attack now that most (all?) up to date browser go for HTTPS by default? Is there an alternative more ...
1
vote
1answer
69 views
Is a browser session encrypted using https with just the IP? [duplicate]
Accessing a webservice/website via IP with https eg. https://x.x.x.x/
the browser shows that the connection is not secure.
Is the connection actually secure/encrypted or not (more secure than ...
0
votes
1answer
45 views
Is Certification path construction algorithm needed for SSL/TLS?
In the TLS Handshake a Certificate message is sent. This message contains the (chain of) certificates needed to validate the provided certificate of the communicating party.
However, I have also ...
1
vote
3answers
128 views
Does HSTS provide security advantages on private networks?
For systems that only connect to the internet via a single dedicated private network (no WiFi hotspots), and assuming no systems or components on that network are compromised, does HSTS (HTTP Strict ...
