Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 561
  • Last Modified:

SSL: Anonymous and non-anomynous

I have read up on SSL,

with the client sending the key, cipher and hash

The sender then verifying those fields

The client creates a master secret code and sends it to the server with its public key

The server decrytps the master secret with its private key

And thus encyption is possible

Now I am seeing references to anonymous and non-anonymous SSSL

Could some one please give me a brief descrrition of this and what the title or key phrase that identifies non-anonymous SSL ?

Any links would also be helpful

Thanks
0
Anthony Lucia
Asked:
Anthony Lucia
1 Solution
 
Rich RumbleSecurity SamuraiCommented:
I didn't even know about Anonymous Ciphers, seems like a bad idea
https://www.openssl.org/docs/apps/ciphers.html#item_aNULL
http://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange
Although Diffie–Hellman key agreement itself is an anonymous (non-authenticated) key-agreement protocol, it provides the basis for a variety of authenticated protocols, and is used to provide perfect forward secrecy in Transport Layer Security's ephemeral modes (referred to as EDH or DHE depending on the cipher suite).
https://www.owasp.org/index.php/Testing_for_Weak_SSL/TSL_Ciphers,_Insufficient_Transport_Layer_Protection_%28OWASP-EN-002%29#Testing_for_Weak_SSL.2FTLS_Ciphers.2FProtocols.2FKeys_vulnerabilities
-rich
0
 
Dave HoweSoftware and Hardware EngineerCommented:
@richrumble: That said, a CA cert only protects you from people whose money they won't take :)

I am waiting for DANE to take over, although given it destroys the CA business model, I am not expecting it to happen any time soon. Then we just have the DNS root to worry about.

Sadly, Marlinspike's Convergence never took off.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Easily Design & Build Your Next Website

Squarespace’s all-in-one platform gives you everything you need to express yourself creatively online, whether it is with a domain, website, or online store. Get started with your free trial today, and when ready, take 10% off your first purchase with offer code 'EXPERTS'.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now