summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2013-12-10More ciphers supportPeter Wu4-11/+20
* generate-wireshark-cs: fix key sizes for export ciphers * notes, openssl-{connect,listen}: support more cipher suites, including NULL.
2013-12-09generate-wireshark-cs: add missing EXPORT1024 casePeter Wu1-0/+1
Fixes: Unknown kex in 0x0060 TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 (tmp=RSA_EXPORT1024) Unknown kex in 0x0061 TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 (tmp=RSA_EXPORT1024) Unknown kex in 0x0062 TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA (tmp=RSA_EXPORT1024) Unknown kex in 0x0064 TLS_RSA_EXPORT1024_WITH_RC4_56_SHA (tmp=RSA_EXPORT1024) But to be honest, is there any implementation that actually use these cipher suites...?
2013-12-09generate-wireshark-cs: add RC4 and RC2 with 56 bitsHauke Mehrtens1-2/+3
This is used in some export ciphers
2013-12-09suites.txt: add suites already in wiresharkHauke Mehrtens1-0/+7
These are no official cipher suites, but they are used somewhere. Sources: - (96-102) "0x00,0x60-0x66 Reserved to avoid conflicts with widely deployed implementations" [1] - (96-97) Disabled in OpenSSL 0.9.8c, from a commit message on 14 June 2006: "the latter two [0x00,0x61 and 0x00,0x60 cipher suites] were purpotedly from draft-ietf-tls-56-bit-ciphersuites-0[01].txt, but do not really appear there" [3] - (98-102) An (expired) IETF draft on 56-bit cipher suites defines cipher suites 0x00,0x62-66 [2] [1]: http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4 [2]: http://tools.ietf.org/html/draft-ietf-tls-56-bit-ciphersuites-01 [3]: http://marc.info/?l=openssl-cvs&m=115030750911430 [ Peter: added sources ]
2013-12-09notes: how to generate suites.txtPeter Wu1-1/+3
2013-12-09generate-wireshark-cs: some fixes for CCMHauke Mehrtens1-23/+35
This applies some fixes for CCM to the cipher suite generation script. There are some special cases for CCM ciphers: the iv blocksize is always 4, it does not have a digest and the mode should be CCM or CCM_8. [ Peter: basically restructure (indent+case) and fix CCM block size. I removed the digest as that was already covered and diglen=0; is not meaningful ]
2013-12-06generate-wireshark-cs: use "0" for unavailable block sizePeter Wu1-1/+7
Stream cipher RC4 (and block cipher NULL) do not have a IV. The packet-ssl-utils code needs to be fixed up for this, but this generator can already be created. Revert this patch until the block to iv_size rename is complete.
2013-12-06generate-wireshark-cs: visual alignmentPeter Wu1-3/+18
Previously, everything was concatenated, making it more difficult to spot errors.
2013-12-06generate-wireshark-cs: CCM supportPeter Wu1-2/+9
2013-12-06cyassl-test: test ciphers supported by CyaSSLPeter Wu2-0/+115
2013-12-06run-ws: helper to run wireshark for SSL debuggingPeter Wu1-0/+40
Example usage, assuming 'premaster.txt' in corrent directory: ./run-ws /tmp/wsbuild/tshark dump.pcapng Example, with filtering for SSL record type Application Data (23): ./run-ws /usr/bin/wireshark dump.pcapng.gz \ -Y ssl.record.content_type==23
2013-12-06openssl-{connect,listen}: fix usage, reduce outputPeter Wu3-12/+17
The CLIENT_RANDOM is applicable to clients only, so remove it from ServerHello. Also update notes with cmake+gcrypt instructions.
2013-12-03cyassl patch for AES-CCM testingPeter Wu2-0/+124
See https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9499
2013-12-03generate-wireshark-cs: add CCM and CCM_8 modesPeter Wu1-0/+2
2013-12-03generate-wireshark-cs: use hexadecimal IDsPeter Wu1-1/+1
2013-12-03notes: cmake command, SSLKEYLOGFILE, RC2Peter Wu1-1/+7
2013-10-28tshark-iophs-percent.awk: add script to add percentagesPeter Wu1-0/+49
Requested by [aspirin] on #wireshark, this script adds a percentage number to the tshark statistics output. Adding a percentage bar can also be done, but is an exercise for later at the moment.
2013-10-27openssl-*: support custom s_server/s_client argsPeter Wu2-9/+30
2013-10-02Add cleanup patches in developmentPeter Wu5-0/+929
I previously mentioned that nobody seems to support AES CCM for PSK, but then I noticed that bug 8567 uses this for a DTLS capture. I might need to add some of these missing cases to the ssl_get_keyex_alg function. [1]: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8567
2013-10-02Update notes, ssl_get_keyex_alg.txt.diffPeter Wu2-98/+127
The new ssl_get_keyex_alg.txt.diff has been generated with the following patches applied: - (unrelated) ssl: Support PSK larger than 16 octets - Use correct key exchange type for ECDHE ciphers - (unrelated) ssl: drop unused SIG_ field and constants - Add more PSK and Camellia ciphers - Simplify determining key exchange algorithm, more PSK support
2013-10-01generate-wireshark-cs: fix ECDH, add PSK, drop SIG_Peter Wu6-19/+443
ssl_get_keyex_alg.txt contains the current supported list of cipher suites for key exchange by the ssl_get_keyex_alg() function. It was generated with: awk -F '[ :;\t]+' '/^gint ssl_get_keyex_alg/{p=1} /case/{if(p)a[$3]=0} /return/{for(i in a)print i, $3;delete a} /^} /{if(p)exit}' packet-ssl-utils.c This file can then be converted and sorted with: while read num name; do echo $((num)) $name; done < ssl_get_keyex_alg.txt | sort -n > /tmp/1 To get the current cipher suites list: awk -F '[ {,]+' '/,KEX_/{print $2, $3}' packet-ssl-utils.c > /tmp/2 Check which cipher suites are missing or have an incorrect key exchange: diff -y /tmp/[12] It turned out that the ECDH cipher suites were incorrectly marked as DH (tested on top of SVN rev 52320). Therefore adjust the generate-wireshark-cs file.
2013-10-01decrypt: support other ciphers, handle smaller key materialPeter Wu1-8/+36
2013-10-01number-to-name.awk: support suites.txt file formatPeter Wu1-1/+9
2013-09-30openssl-{connect,listen}: Add PSK supportPeter Wu2-6/+9
Wireshark already supports these suites, yay :)
2013-09-26Add libgcrypt patch to add RC2 support for 128-bit keysPeter Wu1-0/+86
Sent to gcrypt-devel@gnupg.org.
2013-09-22Add WIP patch for build, unittests fixesPeter Wu1-0/+850
I stopped when I had the thousandth dependency issue after crypt/libairpdcap.la, this time (again) some broken headers (wsutil something if I remember correctly? Or was it something related to LUA?)
2013-09-19premaster updated with SSLv2 challengePeter Wu1-0/+3
2013-09-19openssl-connect: support SSLv2 ClientHelloPeter Wu1-4/+12
Making assumptions about ClientHello is very fragile, but since we are controlling the client, it should not be a big deal.
2013-09-19Remove patched bugs from notesPeter Wu1-14/+0
2013-09-19Distinguish GCM ciphers, fix RC2 typePeter Wu1-3/+5
RC2 is a block, not a stream. I thought I fixed this some time ago...
2013-09-18Disable compression for openssl-connectPeter Wu1-0/+1
This makes it easier to see relations in plaintext (if any).
2013-09-18Add tool for decrypting SSL given IV and keyPeter Wu1-0/+80
2013-09-16Drop digest length and export flag.Peter Wu1-1/+1
This is removed because it is redundant, see https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9144#c16
2013-09-16Add tools to map a number to name (and vice versa)Peter Wu2-0/+50
2013-09-16openssl-connect: print keys earlierPeter Wu1-9/+17
2013-09-16Add dump for all OpenSSL 1.0.1e cipher suites except SRP and PSKPeter Wu3-0/+289
./openssl-listen /tmp/test-certs dumpcap -f '(host ::1 or host 127.0.0.1) and tcp portrange 4430-4433' \ -i lo -w all/dump.pcapng ./openssl-connect < all/ciphers-without-SRP-PSK.txt > all/premaster.txt # kill dumpcap Check with: wireshark -o ssl.keylog_file:$PWD/premaster.txt dump.pcapng \ -o http.ssl.port:4430-4433 -o ssl.debug_file:debug.txt debug.txt is not added because it is a 5.8 MiB file (1.3 MiB gzipped).
2013-09-15openssl-connect: Parse certificate type from namePeter Wu1-11/+20
This allows for something like: openssl ciphers -V | grep -v \ SRP- | ./openssl-connect /tmp/test-certs
2013-09-15Add ECDH-RSA support for toolsPeter Wu3-21/+63
2013-09-15Add server/client tools for testing ciphersPeter Wu2-0/+168
2013-09-15generate-wireshark-cs: support export, IDEA, DES, RC2Peter Wu1-18/+60
And also support reading suites.txt (generated from IANA's CSV[1]). Not supported are SRP, KRB5, PSK, ARIA and CCM. Suggested usage: grep -vE '_(SRP|KRB5|PSK|ARIA)_|_CCM(_|$)' suites.txt | ./generate-wireshark-cs [1]: http://www.iana.org/assignments/tls-parameters/tls-parameters-4.csv
2013-09-15Update notes, fixing typos and update ciphers listPeter Wu1-28/+36
2013-09-15Extend gen-cipher-test descriptionPeter Wu2-3/+55
2013-09-14Initial commit of notes, dumps and scriptsPeter Wu24-0/+59419
generated by cgit v1.2.1 (git 2.18.0) at 2024-05-19 15:38:56 +0000