Questions tagged [tls]
SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols which provide communication security (privacy and integrity) for a bidirectional data channel.
675 questions
17
votes
3
answers
1k
views
What is controversial about adding standalone (non-hybrid) ML-KEM to TLS 1.3?
[This appears to be a controversial topic. I am not knowledgeable enough to attempt to choose sides; I would just like to verify that I have understood the argument.]
[tl;dr: The questions are at the ...
- 275
1
vote
0
answers
78
views
Why does TLS 1.3 derive MS from dHS instead of using dHS directly? Also, why is dHS used as salt instead of as an input key?
I am trying to understand the rationale behind the design choices in TLS 1.3, and am stuck on a couple points regarding the derivation of the master secret ($\mathsf{MS}$) from the derived handshake ...
- 11
0
votes
1
answer
94
views
Questions about TLS 1.3 Server Hello in Matrix Protocol Traffic (Wireshark Capture)
I’m analyzing a Matrix protocol connection and captured its traffic in Wireshark. In the TLS handshake, I looked at the Server Hello message and came across a few confusing things:
-The "Change ...
- 191
2
votes
1
answer
124
views
Is ECDSA_SHA1 signature scheme supported in TLS 1.3?
I am writing a TLS client which advertises all IANA registry parameters. One such TLS parameter in the registry is ECDSA_SHA1 which is a signature scheme supported for TLS 1.3 communication.
Now, my ...
- 23
3
votes
0
answers
126
views
What are the backward compatibility issues with increasing the TLS 1.3 record size for post-quantum cryptography?
This is a bit of a follow-up question to What are the design-level constraints in TLS 1.3 for post-quantum adoption?
The IETF draft to increase the TLS 1.3 record size to accommodate larger post-...
- 18.2k
1
vote
1
answer
261
views
What are the design-level constraints in TLS 1.3 for post-quantum adoption?
To be more specific: How do the structural design choices in TLS 1.3 (such as message flow, handshake compression, and record layer framing) interfere with or limit the integration of large post-...
- 18.2k
1
vote
1
answer
202
views
Is SPHINCS+ viable for authenticating websites?
After seeing the number of entrants in the NIST PQCS that were broken and after considering that hash-based signature schemes are more studied, I've concluded that SPHINCS+ is a safer bet for digital ...
- 4,338
2
votes
1
answer
277
views
Cost of TLS (1.3) Handshake using RSA compared to cost of using ECC?
In the TLS 1.3 handshake, the server has to sign stuff in its Hello, and the client has to verify the server's certificate and the signature which uses the certified key. I'm guessing that's a ...
- 121
6
votes
1
answer
156
views
How has WhatsApp addressed group member authenticity and forged acknowledgements since the 2018 "More is Less" paper?
I’ve been reading the 2018 paper “More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema”, which outlines several interesting vulnerabilities in the group messaging ...
- 191
0
votes
0
answers
54
views
Is TLS1.2/3 + PSK recommended for future products?
I have build multiple embedded devices with TLS1.2/3 + PSK using mbedtls and wolfssl libraries.
My products have been with microcontrollers(ESP32, Silicon labs, etc.) and OpenWRT based Linux products. ...
- 101
1
vote
0
answers
86
views
TLS 1.2 Server finish message packet error
Working on TLS1.2 on cipher suite ECDHE_RSA_AES_256_GCM_SHA384. On the server side, currently at the stage of server finish message. Always getting alert message.(Encrypted). And client closes.
What I ...
- 21
1
vote
1
answer
203
views
Clarification in TLS 1.2 key derivation process
Using
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 in tls 1.2 handshake.
Reference to TLS 1.2 standard documentation regarding the key generation. And the question 50815
(Clarification needed in TLS 1.2 key ...
- 21
0
votes
2
answers
189
views
Hash calculation for TLS 1.2 Finished message
I'm trying to understand the data that go into a TLS "Finished" handshake message. At present I'm focused on TLS 1.2 -- if I can't get that right then there's no point in looking at other ...
- 1
2
votes
1
answer
167
views
why there is a need to send iv with cipher text?
From what I understand by reading TLS 1.2 RFC (key calculation), PRF is used for this with the master key to derive the IV, so both side can generate the same IV because of the nature of PRF.
...
- 123
1
vote
1
answer
223
views
Preventing BEAST by using authorisation header instead of cookies
Historical question as BEAST is mitigated in TLS 1.1 and earlier TLS is deprecated.
BEAST is a chosen plaintext attack, possible in web browsers because cross-origin requests have cookies ...
- 125