full-disclosure - Harden TLS/SSL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <383391468.20100217121538@Zoller.lu>
Date: Wed, 17 Feb 2010 12:15:38 +0100
From: Thierry Zoller <Thierry@...ler.lu>
To: full-disclosure@...ts.grok.org.uk
Subject: Harden TLS/SSL - Tool release

============================================
TOOL: Harden SSL/TLS beta
OS: Windows (2000,XP,Seven,2003,2008,2008R2)
Requirement : .NET Framework 2.0
Author : Thierry Zoller for G-SEC Ltd.
============================================

Developed as part of G-SEC's investigation into the
"Secure SSL/TLS configuration Report 2010" (to be
published) we developed this little tool.

"Harden SSL/TLS" hardens the default SSL/TLS settings of
Windows 2000,2003,2008,2008R2, XP,Vista,7. It allows to
remotely set SSL/TLS policies allowing or denying certain
ciphers/hashes or complete ciphersuites.

It took longer then I expected to create this tool, Windows
7 really strengthened the cryptosuites and introduced a new
way Windows handles SCHANNEL policies and required quite
some re-engineering. For instance, I had to create a mini
state engine just for the preferred cipher list.

Harden SSL/TLS allows setting policies with regards
to what ciphers and protocols are available to applications
that use SCHANNEL crypto interface. A lot of windows
applications do use this interface, for instance IIS, Google
Chrome as well as Apple Safari and many more.

By changing the settings you can indirectly control
what ciphers and protocols these applications are
allowed to use and stay compliant to whatever policies
you use.

Note: unfortunately neither chrome nor safari make use
of the new TLS 1.2 protocol that Windows 7 introduced
(hint hint). They both use SCHANNEL and just need to
add a parameter to the SCHANNEL initialization in
order to support it. (Let's see who is first)

It allows to allow or deny:
·  Hashes
·  Keyexchange algorithms
·  Protocols
·  Ciphers & Ciphersuites
·  Priority of preferred Ciphersuites

Advanced mode
· Re-enable ECC P521 mode on Windows7 and 2008R2
  (P521 mode was available on Vista and 2008 but removed in
  Windows7 and 2008R2)
· Enable TLS 1.2 support on IIS 7.5 (off by default)
· Set TLS Cache size and timeout

Download and Information:
http://blog.g-sec.lu/2010/02/harden-ssltls-tool-release.html

Documentation :
http://www.g-sec.lu/sslharden/documentation.pdf

Video :
http://www.g-sec.lu/sslharden/harde_ssl.swf

-- 
http://www.g-sec.lu
Thierry Zoller

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/