RFC-7366 has been out for a few years and most TLS libraries have implemented encrypt-then-mac, but I didn’t came across many web sites that actually support it. So I want to do a quick study on the support rate of the said extension. What would be a good tool for this? I tried ssltest but it doesn’t report extensions.

  • Why can't you just capture the traffic and look at the TLS handshake with wireshark? The extensions can all be seen when looking at the TLS details. – Steffen Ullrich Apr 27 at 7:02
  • If you dont want to use wireshark as Steffen mention you can use github.com/drwetter/testssl.sh that gives extra information – camp0 Apr 27 at 14:16
  • 1
    All you want is to see the ServerHello message, so you can use a template of TLS 1.2 ClientHello with everything hardcoded except the SNI (many sites don't work without correct SNI) and send that, wait for ServerHello (use timeout) and close the connection, record the ServerHello. You don't need a full ASN.1 library, and you don't need to perform any crypto, so you don't need a TLS library, just something that can do async IO (many sockets in a single process cheaply) and buffer and write out the responses into some kind of log you can parse later to produce your results (SQLite would work). – Z.T. Apr 27 at 14:53
  • @Z.T. Yes that’s the idea – qweruiop Apr 27 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.