full-disclosure - TLS/SSL Hardening & Compatibility Report 2010

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 18 Feb 2010 16:00:08 +0100
From: Thierry Zoller <Thierry@...ler.lu>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk, 
	<submissions@...ketstormsecurity.org>, <websecurity@...appsec.org>
Subject: TLS/SSL Hardening & Compatibility Report 2010

Dear List,

At  last.  What  started as an "I need an overview of best practise in
SSL/TLS configuration" type of idea, ended in a 3 month code, reverse
engineer and writing effort. I really hope this comes in handy for you
and was worth the effort. This is the "Release candidate" version of
the paper, should no errors be found it will be the final version.

This paper aims at answering the following questions :

    * What SSL/TLS configuration is state of the art and considered secure (enough) for the next years?
    * What SSL/TLS ciphers do modern browsers support ?
    * What SSL/TLS settings do server and common SSL providers support ? 
    * What are the cipher suites offering most compatibility and security ?
    * Should we really disable SSLv2 ? What about legacy browsers ?
    * How long does RSA still stand a chance ?
    * What are the recommended hashes,ciphers for the next years to come

The paper includes two tools :

    * SSL Audit (alpha) :
    SSL scanner scanning remote hosts for SSL/TLS support (Video)
    * Harden SSL/TLS (beta) :
    Windows server and client SSL/TLS hardening tool (Video)

Without further ado here is the complete package
http://blog.g-sec.lu/2010/02/new-paper-ssltls-hardening-and.html

Other Tools and Papers - http://www.g-sec.lu/products.html

PS: In order to know whether this type of publication is useful
to some and whether I should spend time on such publications in
the future, I would appreciate a heads-up if you find this to
be interesting. Thierry

Regards,
Thierry ZOLLER

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/