Collaborate Disseminate
TLS negotiates a ciphersuite and TLS version to use during handshake. It confirms the handshake was not tampered with and the ciphersuite and TLS version were not downgraded using the negotiated ciphers, as explained here. Ho… Continue reading Why TLS does not sign ciphersuite?
SMTP uses STARTTLS extension to upgrade SMTP to SMTP Secure (STMPS). According the the RFC, the client and server starts TLS as follows:
S: <waits for connection on TCP port 25>
C: <opens connection>
S: 220… Continue reading What happens if STARTTLS dropped in SMTP?
This question already has an answer here:
SSL/TLS CipherSuite TLS_NULL_WITH_NULL_NULL
1 answer
Can browsers connect HTTPS w… Continue reading What is the use of the NULL cipher suite in TLS? [duplicate]
I am using the SSLsplit module of Pineapple Tetra in an attempt to identify if android applications transmit data without encryption. In one of the output logs I encountered these lines:
2017-07-06 19:25:17 UTC ssl [andro… Continue reading SSLsplit (Pineapple Tetra module) output log
Similar to this security stackexchange question, I was wondering if there’s any downside, considering the services/servers security, if only TLS 1.2 allowed, but TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing… Continue reading Security implications of a missing SCSV, but with only TLS 1.2 allowed
I know it won’t work on every server because some don’t allow SSLv3 but I tried many servers and my attack doesn’t seem to work.
For now, I attempt to downgrade to TLS 1.0 (also recognized by the number 769 in the protocol)…. Continue reading SSLv3 downgrading attack – avoiding fallback alert
In the Finished handshake of TLS all previous messages exchanged are sent from the client to the server (and reverse) and protected by a MAC. This is what also “prevents” TLS_FALLBACK_SCSV from being modified/deleted by an at… Continue reading How can an attacker downgrade/modify the cipher suites when they are MACed? (Freak, Logjam use downgrade attacks)
Ssllabs does not give A+ (highest) rating if the server does not support TLS_FALLBACK_SCSV to prevent downgrade attack. But I am wondering, is it really any useful if the server legitimately provide support only for 3 latest versions of TL… Continue reading Is TLS_FALLBACK_SCSV useless if only TLS (1.0, 1.1, 1.2) is supported?
Should I use SSL/TLS renegotiation? In other words: does SSL/TLS renegotiation enhance or weaken the security?