1

I find that sslsqueeze tool can carry attack on SSL/TLS server and does not need to perform any cryptographic operations. I think that no matter which cipher suite used in handshakes, the tool consumes the same CPU power.

Then do cipher suites used in handshakes a factor to make the server more susceptible to the attack using sslsqueeze tool?

If cipher suites really matter, does it mean that attacker can specify certain cipher suite for handshake to make the attack more likely to succeed?

1
  • 1
    I think the key agreement part tends to be much more computationally expensive than the symmetric cipher side. RSA is very expensive and has much more support than other key agreement algorithms
    – Torin
    Commented May 19, 2020 at 20:20

1 Answer 1

1

If cipher suites really matter, does it mean that attacker can specify certain cipher suite for handshake to make the attack more likely to succeed?

Conceptually yes, though not with sslsqueeze. It is a simple tool that seems to be hardcoded to establish SSL and TLS connections with RSA key exchange (I've briefly read the code, a deeper analysis might reveal otherwise).

https://github.com/mmgaggle/sslsqueeze/blob/master/sslsqueeze.c

There will be variations across different servers since RSA since different key sizes will significantly affect computational requirements.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .