Hot answers tagged

4 votes

Which cipher is more secure TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA or TLS_RSA_WITH_AES_256_GCM_SHA384?

Neither cipher suite is good. Which one is the least bad depends on your threat model. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA has two problems: It uses SHA-1 to authenticate the server's signature. SHA-1 ...
user avatar
3 votes

Which cipher is more secure TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA or TLS_RSA_WITH_AES_256_GCM_SHA384?

I agree with @schroeder, I don't think you can do a direct "which is better?" comparison with cipher suites. That said, Mozilla's TLS Recommendations currently lists DHE-RSA-AES256-GCM-...
user avatar
2 votes
Accepted

Why is there an ASN1 OID and a NIST CURVE reference for the same curve?

Most of the X.509 standards are based on a format called ASN.1 (Abstract Syntax Notation). This is a tag-length-value (TLV) format that describes the structure of data. One of those data structures ...
user avatar
  • 6,685
1 vote
Accepted

When renewing a TLS certificate (no change to CSR nor private key), will the modulus remain the same?

Yes. This article recommends doing exactly what you suggest; extract the modulus from both public and private key and check that they match. But moreover, if they have re-issued based on the same CSR, ...
user avatar
1 vote

Which cipher is more secure TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA or TLS_RSA_WITH_AES_256_GCM_SHA384?

Risks of CBC ciphers To attack an implementation vulnerable to variants of POODLE and Lucky13, one of the sides needs to be vulnerable (not a given, e.g. if SChannel is used on both sides it should be ...
user avatar
  • 7,613
1 vote

Which cipher is more secure TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA or TLS_RSA_WITH_AES_256_GCM_SHA384?

On the cmd line, try: $ openssl ciphers | tr ':' '\n' This would give you the list of ciphers in the decreasing order of "strength". This list should help you evaluate the two ciphers in ...
user avatar
  • 1,136
1 vote

Check public key certificate

Since you're using OpenSSL openssl verify -check_ss_sig -CAfile cert.pem cert.pem If you mean you want to do it 'by hand' so that you see the exact data being signed (but still with OpenSSL), the ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible