Dear List,
At last. What started as an "I need an overview of best practise in
SSL/TLS configuration" type of idea, ended in a 3 month code, reverse
engineer and writing effort. I really hope this comes in handy for you
and was worth the effort. This is the "Release candidate" version of
the paper, should no errors be found it will be the final version.
This paper aims at answering the following questions :
* What SSL/TLS configuration is state of the art and considered secure (enough) for the next years?
* What SSL/TLS ciphers do modern browsers support ?
* What SSL/TLS settings do server and common SSL providers support ?
* What are the cipher suites offering most compatibility and security ?
* Should we really disable SSLv2 ? What about legacy browsers ?
* How long does RSA still stand a chance ?
* What are the recommended hashes,ciphers for the next years to come
The paper includes two tools :
* SSL Audit (alpha) :
SSL scanner scanning remote hosts for SSL/TLS support (Video)
* Harden SSL/TLS (beta) :
Windows server and client SSL/TLS hardening tool (Video)
Without further ado here is the complete package
http://blog.g-sec.lu/2010/02/new-paper-ssltls-hardening-and.html
Other Tools and Papers - http://www.g-sec.lu/products.html
PS: In order to know whether this type of publication is useful
to some and whether I should spend time on such publications in
the future, I would appreciate a heads-up if you find this to
be interesting. Thierry
Regards,
Thierry ZOLLER
