search

drwetter / testssl.sh

Testing TLS/SSL encryption anywhere on any port
https://testssl.sh
GNU General Public License v2.0
7.89k stars 1.02k forks source link

Is is possible to test for tls racoon? #1728

Open chrisdlangton opened 4 years ago

chrisdlangton commented 4 years ago

A side channel, so maybe not. Info https://hackaday.com/2020/09/11/security-this-week-racoons-in-my-tls-bypassing-frontends-and-obscurity/

drwetter commented 4 years ago

I haven't found the time to read https://raccoon-attack.com/ completely yet (hello to Paderborn and Bochum at least).

The exceptions might be worth to look into, maybe the reuse of ephemeral and non-ephemeral keys could be detected. But that's only an assumption.

Have you read about a PoC for detection? Wondering how SSLlabs is doing that.

chrisdlangton commented 4 years ago

I came here looking for such a thing ;)