6

Question

  • Are there any functional (or detectable) differences between the various implementations of SSL/TLS? What are the differences between them? (e.g. which ones implement "False Start")

  • Would it be a concern that someone could detect the underlying SSL code used based on the TLS response?

Background

I'm asking because it's possible for any of the following SSL stacks to incorporate questionable features (such as false start), or may have implementation-specific bugs,

  • OpenSSL is written in C, used in Apache
  • GnuTLS are written in C
  • Sun's SSL implementation (mostly written in Java)
  • I'm not sure if the Microsoft TLS uses Win32's under the hood, or if it uses managed code.
Improve this question
1
  • 1) .net's TLS uses the windows implementation, so features depend on the version of windows 2) There are several other TLS implementations, BouncyCastle(C# and Java flavour), Mono, NSS(Firefox)
    – CodesInChaos
    Nov 30, 2012 at 21:09

1 Answer 1

Reset to default
7

There is a lot of variability in SSL/TLS; for instance, when data must be sent, it is split over one or several records, and the implementation is free to choose the size of each record as it sees fit (within the standard size constraints). Modern implementations, in particular, tend to make a few very short records (with 0 or 1 byte of application data) as a protection against the BEAST attack. Also, every implementation supports only a subset of the hundreds of possible cipher suites. The bottom-line is that it is possible to distinguish implementations from each other (I do not know of a readily available tool which does that, but it does not look very hard to do).

Leaking which implementation is used is not a big issue by itself (although it tends to make people nervous). Anyway, if the SSL server is used within a Web server, identifying the Web server already yields definite clues about the SSL implementation (if the server is IIS, the SSL code will be the one from Microsoft...). Also, there are not so many SSL/TLS implementations out there; the attacker needs not guess which is used, he just has to try out all the exploits he knows until one works.

If you use an implementation which has "questionable features", then the issue is not that the attacker may know or guess that you use this implementation -- the issue is that you use an implementation with questionable features.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .