SSL/TLS: Links
Resources for Security Engineers to understand & harden the SSL crypto stack. Written 2016-02. Updated 2017-04
Links open in current window, use CTRL+Link to spawn in second window
SSL Cyrptographic Libraries
libraries are a collection of software, tools and resources which explain not just their application but also the cryptos
- OpenSSL: The Defacto Open Source Library for SSL
- LibreSSL: The OpenBSD library
- MatrixSSL: An Alternative SSL Library
- BoringSSL: Google SSL Library
- GNUTLS: An Alternative SSL Library
- MbedTLS/PolarSSL: Works with Hiawatha web server & OpenVPN
- NSS: An Alternative Library by Mozilla
- CryptLib: An Alternative Library
- Schannel: The Microsoft library
- Botan: crypto library
- Crypto++: crypto library
- WolfSSL: crypto library for embedded devices, Cyassl
- Secure Transport: The Apple library
- SharkSSL: Commercial SSL library
Resources
- Fiesty Duck: ebooks by Ivan Ristic, creator of SSL Labs
- Intro to SSL: explains handshake etc
- Security/Server Side TLS: Excellent reading
- Mozilla Web Security, Mozilla Web Security Archive
- TLS (wiki), & TLS Comparison (wiki)
- Bulletproof links: Massive list of resources
- OWASP SSL: TLS Cheat Sheet
- SSL Differences to TLS
- Understanding SSL
- The Spawl - similar site good research, SSL Resources & Links,
Audit your SSL
- SSL Labs: The most comprehensive & free SSL auditor
- SSL Shopper: Fast quick certificate checker
- HTTPS watch Global: see how others stack up. HTTPS watch NZ: NZ only
Intergration
- Cipher List: Quick reference to SSL hardening.
- IIS Crypto: Harden IIS with a few clicks
Interfaces
- Mod_SSL: The Apache Interface to OpenSSL
- Mod_NSS: Apache Interface to NSS
- Mod_GNUTLS: Apache Interface to GNUTLS
- LibreSSL on FreeBSD: my notes for running bsd nginx
- OWASP SSL: TLS Cheat Sheet
Blog / Twitter
- Adam Langley, Twitter: SSL expert @ Google
- Ivan Ristic, Twitter: SSL Guru
- Tim Taubert, Twitter: Security Engineer at Mozilla
- Ilya Grigorik, Twitter: Google Web Engineer with SSL notes
RFC
- Search RFC: RFC Editor, IETF, IETF datatracker
- Technologies: DTLS, TLS Extensions Elliptic Curve
- Protocols: SSL2, SSL3, TLS1.0, TLS1.1, TLS1.2, TLS1.3 , TLS1.3 draft, DTLS
- Implementation Over: HTTP, FTP, SMTP, HSTS
- IPv4: IP, TCP, UDP
- Ciphers: AES, AES CCM, AES GCM, AES GCM ECC, Camellia
- Keys: RSA (2.1), RSA (2.0), DH
- Random Numbers: Randomness
- Elliptic Curves & Other: Chacha20-poly1305
- HMAC: SHA & HMAC-SHA, SHA2 in DNS, HMAC Message Auth, HMAC Sha1 in ESP/AH
- Misc: TLS Compression
- IPSEC: Security Architecture of IP, AH, ESP, IKEv2, SHA in IPSEC, SHA256 in IPSEC
- Suite B: RFC Suite B in TLS, RFC Suite B in IPSEC, RFC Suite B in SSH
WIKI Links
- Theory: HTTPS, SPDY, ALPN, HTTP2, Public Key Crypto
- Protocols: SSL/TLS, DTLS
- IPv4: IP, TCP, UDP
- Ciphers: Block Cipher, Stream Cipher, Authenticated Encryption, AES, GCM, CCM, DES, Camellia (Japan), Chacha, GOST (russian)
- Key Exchange: RSA, Diffie Hellman (DH), Elliptic Curve DH
- Hash-MAC: Function, MAC, Cryptographic Hashing, Comparison of Hashing, SHA-1, SHA-2, SHA-3, Compare Hashs, SHA2 validate, HMAC, AEAD Comparison, AEAD, Cipher Security Summary
- Elliptic Curves & Other: Chacha20-poly1305
- Misc: Certificate Authority, PKI, Forward Secrecy,
- IPSEC: IPSEC, IKE, AH, ESP, SPI, SHA in IPSEC, SHA256 in IPSEC
- Suite B: Suite B (Public Recommended), NSA Crypto
- Bits / Entrophy: Entropy, Password Strength
- Libraries: LibreSSL, OpenSSL, NSS,
- MAC+AEAD: HMAC, CBC MAC, Poly1305, AEAD, AEAD CCM, AEAD GCM,
- Attacks: Collisions, Brute Force, Side Channel,
Misc
- Links: OpenSSL Binary for windows, OpenSSL Ciphers, LibreSSL Ciphers, ,
- PKI: Primes & PKI,
- Cryptography General: Number Theory, PDF Resources, Ecrypt.EU, ,
- Diffie Hellman & Discrete Logarithm: Discrete logarithm, DH,
- Crypto Key Strength Guides: KeyLength - work out years cyrpto should remain secure, ,
- diffie helman: DH Parameters, ,
- elliptic curves Cr.yp.to, Wiki ECC, ecc, ecc, ecdsa, Selecting ecc discussions, rfc 4492, Safe Curves Analysis,
- Implementation: Calomel Nginx, WeakDH.org, Nginx 1, NGINX 2, Nginx 3, ,
- Attacks: AES, MiTLS research, pdf, , , ,
SSL Tools & Commands
- Certificate Decoder: "openssl x509 -in certificate.crt -text -noout"
- CSR Decoder: "openssl req -in mycsr.csr -noout -text"
- Key Matcher: "openssl x509 -noout -modulus -in certificate.crt | openssl md5", "openssl rsa -noout -modulus -in privateKey.key | openssl md5", "openssl req -noout -modulus -in CSR.csr | openssl md5"
- SSL Convertor see website for individual commands
- HMAC Generator, Hash Generator
- Cipher & Hash Output Generator: combine cleartext+Key+IV to see output