Re: TLS implementation test
- From: Tim <tim-pentest@xxxxxxxxxxxxxxxxxxx>
- Date: Sat, 21 Oct 2006 07:12:48 -0400
I have to test TLS implementation on our product. Ths goal is not to
discover a threat in TLS but to find threat in our implementation.
In my test I'll do :
- MitM
- Replay attack (I think it will not be possible because of TLS timestamps )
- Dos
- Sniffing (to check that all communications are encrypted)
What other tests could be done ?
Well, there's always modification. If someone adds or removes encrypted
data, or modifies it in transit, will your implementation detect it?
This is particularly important when using stream cipher based
ciphersuites.
Also, does your implementation do perform correct client/server
certificate validation? It's a pretty complex process, and other major
implementations have had bugs in the past in this area.
good luck,
tim
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------
- Follow-Ups:
- Re: TLS implementation test
- From: Julien
- Re: TLS implementation test
- From: Julien
- Re: TLS implementation test
- References:
- TLS implementation test
- From: Julien
- TLS implementation test
- Prev by Date: Re: TLS implementation test
- Next by Date: Re: TLS implementation test
- Previous by thread: Re: TLS implementation test
- Next by thread: Re: TLS implementation test
- Index(es):
Relevant Pages
|
