Features

Protocol-independent

Algorithms

• public key

• digital signature

• key exchange

• block cipher

• stream cipher

• cryptographic hash

• elliptic-curve

• message authentication code

Vulnerabilities

• D(HE)at

• Logjam

• Sweet32

• Shatter

• Weak DH

Parameters

• Diffie-Hellman (finite field)

  • defined by standard

    • RFC 2539 (a.k.a MODP, Oakley Group)

    • RFC 3526 (a.k.a MODP for IKE)

    • RFC 5114

    • RFC 7919 (a.k.a FFDH)

  • software built-in

    • Apache HTTP Server

    • HAProxy

    • Postfix

    • ProFTPD

    • SOcket CAT (socat)

Stores

• Trusted root CA certificate trust stores

  • Apple

  • Google

  • Microsoft

  • Mozilla

  • Oracle

• Certificate Transparency (CT) Logs

  • Cloudflare

  • DigiCert

  • Google

  • Let’s Encrypt

  • Sectigo

  • TrustAsia

  • …

Protocol-dependent

Attributes

• Internet Key Exchange (IKE)

  • IKEv1

    • Encryption Algorithm

    • Hash Algorithm

    • Authentication Method

    • Group Description

    • Life Type

    • Pseudorandom Function

  • IKEv2

    • Encryption Algorithm

    • Pseudorandom Function

    • Integrity Algorithm

    • Diffie-Hellman Group

    • Extended Sequence Numbers

• Secure Socket Layer (SSL)

  • cipher kind

• Transport Layer Security (TLS)

  • application-layer protocol name

  • certificate compression algorithm

  • cipher suite

  • compression method

  • elliptic-curve point format

  • extension type

  • fallback SCSV

  • hash and signature algorithm

  • named curve

  • next protocol name

  • psk key exchange mode

  • renegotiation indication

  • token binding parameter

• Secure Shell (SSH)

  • key exchange

  • public key

  • encryption

  • message authentication code

  • compression

  • elliptic curve domain parameter identifier

• Domain Name System

  • DNS resource record (RR) types

  • DNSSEC algorithm types

  • DNSSEC digest types

Client Capabilities

• Transport Layer Security (TLS)

  • Hypertext Transfer Protocol Secure (HTTPS)

    • Chromium

    • Firefox

    • Opera

Vulnerabilities

• Transport Layer Security (TLS)

  • CRIME

  • DROWN

  • Export-grade

  • FREAK

  • Lucky13

  • POODLE

  • RC4 NOMORE