Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve server identity management #86

Open
chris-wood opened this issue Dec 21, 2020 · 1 comment
Open

Improve server identity management #86

chris-wood opened this issue Dec 21, 2020 · 1 comment

Comments

@chris-wood
Copy link

First, thanks for your (continued) work on this project! It is certainly a useful contribution to the community, and one I'm hoping we can leverage for ongoing and emerging IETF standardization work.

Over in the tls-interop-runner repository, we're hoping to use TLS-Attacker as a continual regression test against TLS stacks. I ran into a couple of problems and questions trying to run the client and server, which I'll enumerate below. Any and all feedback on how we might resolve these (either in tls-interop-runner or here in TLS-Attacker) is more than welcome!

  • Identity management: There doesn't seem to be a way to specify a complete certificate chain to TLS-Server. This would be quite useful because it would allow us to generate certificates and their contents outside of the project and re-use them across TLS stacks. (If this is already supported, a pointer to how to use them would be greatly appreciated!)
  • Attack drivers: Is there documentation on how each of the implemented attacks run, e.g., do they require multiple consecutive connections to complete, or can they run in a single connection attempt?
  • Attack targets: Do the attacks implemented target only servers? (I assume this is the case, but wanted to confirm).
@jurajsomorovsky
Copy link
Contributor

Thank you for your interest in our project!
We are currently working on a test suite project, whose first version will be hopefully made public this year.
To address your questions:

  • certificate chain is currently not supported using the parameters, we will create an internal issue.
  • if you want to run attacks or test your implementation in general with tls-attacker, you can also use our tls-scanner: https://github.com/tls-attacker/TLS-Scanner
  • currently, only servers are supported, tls-client-scanner is a wip

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants