TLSv1.3 (OUT), TLS handshake, Client hello.
o/
o/
November 15, 2024 at 3:53 PM
TLSv1.3 (OUT), TLS handshake, Client hello.
o/
o/
In this LinkedIn article I explain how the SSL/TLS handshake enables secure, encrypted communication. #Cryptography #Cryptographic_Algorithms #CryptoAlgorithms #TLSHandshake #TLS_Handshake
www.linkedin.com/pulse/ssltls...
www.linkedin.com/pulse/ssltls...
The SSL/TLS handshake
This article explains how the SSL/TLS handshake establishes a secure communication channel between two endpoints: typically, client (e.g.
www.linkedin.com
September 27, 2026 at 10:52 AM
In this LinkedIn article I explain how the SSL/TLS handshake enables secure, encrypted communication. #Cryptography #Cryptographic_Algorithms #CryptoAlgorithms #TLSHandshake #TLS_Handshake
www.linkedin.com/pulse/ssltls...
www.linkedin.com/pulse/ssltls...
remake of THE TERMINATOR but it's just a guy who checks TLS certificates all day and gets ignored mid-handshake
July 12, 2026 at 11:43 AM
remake of THE TERMINATOR but it's just a guy who checks TLS certificates all day and gets ignored mid-handshake
pervert handshake to be added to TLS 1.4
March 28, 2025 at 6:06 AM
pervert handshake to be added to TLS 1.4
Allow me access to the internet. Stop dying at the TLS handshake.
September 26, 2026 at 6:11 PM
Allow me access to the internet. Stop dying at the TLS handshake.
@serena.nz walking us through a TLS handshake at 16:30 on a friday 🥲🥲
it ended with "hello friend" so it was ok
it ended with "hello friend" so it was ok
November 8, 2024 at 5:33 AM
@serena.nz walking us through a TLS handshake at 16:30 on a friday 🥲🥲
it ended with "hello friend" so it was ok
it ended with "hello friend" so it was ok
Ser "inconformada" com visibilidade de plataforma tem vantagens. Fiz questão de coletar TODOS erros de handshake TLS com os proxies. Cataloguei eles, integrei com openssl pra ter a desc de cada código, guardei o IP de origem, qual versão TLS, chiper, tudo. Hoje um alerta pegou erros de handshake +
October 14, 2024 at 2:05 PM
Ser "inconformada" com visibilidade de plataforma tem vantagens. Fiz questão de coletar TODOS erros de handshake TLS com os proxies. Cataloguei eles, integrei com openssl pra ter a desc de cada código, guardei o IP de origem, qual versão TLS, chiper, tudo. Hoje um alerta pegou erros de handshake +
Linux and FreeBSD support in-kernel TLS, but the handshake is done in user land via upcall mechanism.
September 26, 2026 at 7:16 PM
Linux and FreeBSD support in-kernel TLS, but the handshake is done in user land via upcall mechanism.
Handshake = DNS root secured by PoW, DNSSEC baked in, TLDs as on-chain assets, and DANE for cert-free TLS.
No central root, no single point of failure.
#Handshake #BlockchainDNS #Decentralization
No central root, no single point of failure.
#Handshake #BlockchainDNS #Decentralization
August 18, 2025 at 1:32 PM
Handshake = DNS root secured by PoW, DNSSEC baked in, TLDs as on-chain assets, and DANE for cert-free TLS.
No central root, no single point of failure.
#Handshake #BlockchainDNS #Decentralization
No central root, no single point of failure.
#Handshake #BlockchainDNS #Decentralization
In 2020, OpenSSL had a vuln related to the signature_algorithms_cert ext. openssl-library.org/news/secadv/...
Palo Alto apparently "solved" this in their IPS by blocking connections with "unknown" algs in sigalg_cert.
Six years later, we can't add ML-DSA to sigalg_cert in Go. sigalg_cert is dead.
Palo Alto apparently "solved" this in their IPS by blocking connections with "unknown" algs in sigalg_cert.
Six years later, we can't add ML-DSA to sigalg_cert in Go. sigalg_cert is dead.
crypto/tls: TLS 1.3 handshake timeout with tip, Go 1.26 can connect successfully · Issue #79626 · golang/go
What version of Go are you using (go version)? $ go version go version go1.27-devel_bfbbe9667e Fri May 22 15:49:08 2026 -0700 darwin/arm64 Does this issue reproduce with the latest release? No What...
github.com
June 20, 2026 at 9:23 AM
In 2020, OpenSSL had a vuln related to the signature_algorithms_cert ext. openssl-library.org/news/secadv/...
Palo Alto apparently "solved" this in their IPS by blocking connections with "unknown" algs in sigalg_cert.
Six years later, we can't add ML-DSA to sigalg_cert in Go. sigalg_cert is dead.
Palo Alto apparently "solved" this in their IPS by blocking connections with "unknown" algs in sigalg_cert.
Six years later, we can't add ML-DSA to sigalg_cert in Go. sigalg_cert is dead.
Shibboleth-Eiscafé, das ein ordentliches TLS-Handshake usw.
June 13, 2026 at 1:49 PM
Shibboleth-Eiscafé, das ein ordentliches TLS-Handshake usw.
Handshake = DNS root on a PoW blockchain.
Root zone secured by consensus, not ICANN.
DNSSEC baked in at the protocol level.
TLDs are UTXOs you control with a private key.
Works with DANE → TLS without CAs.
Resolve via hsd, Fingertip, or NextDNS.
#Handshake #DNS #DANE
Root zone secured by consensus, not ICANN.
DNSSEC baked in at the protocol level.
TLDs are UTXOs you control with a private key.
Works with DANE → TLS without CAs.
Resolve via hsd, Fingertip, or NextDNS.
#Handshake #DNS #DANE
August 11, 2025 at 8:29 AM
Handshake = DNS root on a PoW blockchain.
Root zone secured by consensus, not ICANN.
DNSSEC baked in at the protocol level.
TLDs are UTXOs you control with a private key.
Works with DANE → TLS without CAs.
Resolve via hsd, Fingertip, or NextDNS.
#Handshake #DNS #DANE
Root zone secured by consensus, not ICANN.
DNSSEC baked in at the protocol level.
TLDs are UTXOs you control with a private key.
Works with DANE → TLS without CAs.
Resolve via hsd, Fingertip, or NextDNS.
#Handshake #DNS #DANE
Probe TCP services beyond port checks: Blackbox Exporter module does TLS SNI handshakes, sends custom payloads (Redis PING, binary frames), matches response bytes https://www.valtersit.com/vault/tcp-payload-matching-with-tls-sni-and-custom-handshake-timeo-a2e567/
#blackbox #tcp-probe #ValtersIT
#blackbox #tcp-probe #ValtersIT
TCP Payload Matching with TLS SNI and Custom Handshake Timeout
www.valtersit.com
September 27, 2026 at 9:30 AM
Probe TCP services beyond port checks: Blackbox Exporter module does TLS SNI handshakes, sends custom payloads (Redis PING, binary frames), matches response bytes https://www.valtersit.com/vault/tcp-payload-matching-with-tls-sni-and-custom-handshake-timeo-a2e567/
#blackbox #tcp-probe #ValtersIT
#blackbox #tcp-probe #ValtersIT
Confidential computing's core trust mechanism is broken. The fix may not exist
Confidential computing's core trust mechanism is broken. The fix may not exist
Attested TLS: the handshake that can't prove who's on the other end
www.theregister.com
July 4, 2026 at 10:05 AM
Confidential computing's core trust mechanism is broken. The fix may not exist
bertie.cryspen.com now available with mlkem TLS and Bertie
We've launched bertie.cryspen.com with mlkem TLS, powered by our Bertie TLS 1.3 implementation. This provides a secure and efficient endpoint for your applications.
Read more here: https://buff.ly/3ZOiJT3
#mlkem #TLS #pqc
We've launched bertie.cryspen.com with mlkem TLS, powered by our Bertie TLS 1.3 implementation. This provides a secure and efficient endpoint for your applications.
Read more here: https://buff.ly/3ZOiJT3
#mlkem #TLS #pqc
X25519MLKEM768 TLS-Handshake in Bertie
bertie.cryspen.com
December 24, 2024 at 9:54 AM
bertie.cryspen.com now available with mlkem TLS and Bertie
We've launched bertie.cryspen.com with mlkem TLS, powered by our Bertie TLS 1.3 implementation. This provides a secure and efficient endpoint for your applications.
Read more here: https://buff.ly/3ZOiJT3
#mlkem #TLS #pqc
We've launched bertie.cryspen.com with mlkem TLS, powered by our Bertie TLS 1.3 implementation. This provides a secure and efficient endpoint for your applications.
Read more here: https://buff.ly/3ZOiJT3
#mlkem #TLS #pqc
telegram does suck though. they put people’s usernames in the tls handshake, what the fuck is that
October 31, 2023 at 1:45 AM
telegram does suck though. they put people’s usernames in the tls handshake, what the fuck is that
IIRC this was a downgrade attack where the client treats the should-encrypt flag as "prefer TLS" rather than "require TLS". The adversary sits in the middle of the connection, forces the initial handshake to appear as if the server doesn't support TLS, and the client happily falls back to plaintext.
May 2, 2025 at 3:35 PM
IIRC this was a downgrade attack where the client treats the should-encrypt flag as "prefer TLS" rather than "require TLS". The adversary sits in the middle of the connection, forces the initial handshake to appear as if the server doesn't support TLS, and the client happily falls back to plaintext.
i don't want your IP! i don't want your tls handshake fingerprints, i don't want your host headers and i don't want your exif data. but that's the basics of operating a service on the internet so lol
January 19, 2025 at 8:31 AM
i don't want your IP! i don't want your tls handshake fingerprints, i don't want your host headers and i don't want your exif data. but that's the basics of operating a service on the internet so lol
Rustls est disponible en version 0.23.45. Cette version corrige la mauvaise gestion de messages TLS 1.3 au mauvais niveau de chiffrement après un changement de clé (une vulnérabilité vieille de 2 ans) et intègre plusieurs backports ⬇️
github.com/rustls/rustl...
github.com/rustls/rustl...
Release 0.23.45 · rustls/rustls
Bug fix: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed a key-ch...
github.com
September 15, 2026 at 5:52 AM
Rustls est disponible en version 0.23.45. Cette version corrige la mauvaise gestion de messages TLS 1.3 au mauvais niveau de chiffrement après un changement de clé (une vulnérabilité vieille de 2 ans) et intègre plusieurs backports ⬇️
github.com/rustls/rustl...
github.com/rustls/rustl...
Bot detection goes way beyond user agents
TLS handshake to JavaScript execution tracking
@tylerayoung.com explores the cat-and-mouse game of web scraping vs bot detection. #ElixirConfUS
TLS handshake to JavaScript execution tracking
@tylerayoung.com explores the cat-and-mouse game of web scraping vs bot detection. #ElixirConfUS
August 29, 2025 at 3:55 PM
Bot detection goes way beyond user agents
TLS handshake to JavaScript execution tracking
@tylerayoung.com explores the cat-and-mouse game of web scraping vs bot detection. #ElixirConfUS
TLS handshake to JavaScript execution tracking
@tylerayoung.com explores the cat-and-mouse game of web scraping vs bot detection. #ElixirConfUS
ההישג של השבוע: להשתמש בשיר של הספייס גירלז כדי להסביר tls handshake לאנשים לא טכניים בכלל.
September 17, 2023 at 4:50 PM
ההישג של השבוע: להשתמש בשיר של הספייס גירלז כדי להסביר tls handshake לאנשים לא טכניים בכלל.
I hope the TLS working group has a secret handshake
November 17, 2023 at 1:03 PM
I hope the TLS working group has a secret handshake
We're exploring how to move on from TLS/TCP in datacenters - check out our Oakland’26 paper* about encrypted message-based transport and NDSS’26 paper* about low latency, post quantum mTLS handshake! Congrats @tianyigao.net for ANRP!
*https://micchie.net/pubs/
*https://micchie.net/pubs/
We have announced the winners of the 2026 Applied Networking Research Prize (ANRP) of the IRTF. Congratulations to all winners – we are looking forward to an excellent ANRP program in 2026!
www.irtf.org/anrp/
www.irtf.org/anrp/
January 20, 2026 at 8:27 PM
We're exploring how to move on from TLS/TCP in datacenters - check out our Oakland’26 paper* about encrypted message-based transport and NDSS’26 paper* about low latency, post quantum mTLS handshake! Congrats @tianyigao.net for ANRP!
*https://micchie.net/pubs/
*https://micchie.net/pubs/
Confidential computing's core trust mechanism is broken. The fix may not exist
Confidential computing's core trust mechanism is broken. The fix may not exist
Attested TLS: the handshake that can't prove who's on the other end
www.theregister.com
July 6, 2026 at 6:08 PM
Confidential computing's core trust mechanism is broken. The fix may not exist