Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2025-01-07 17:20:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

Adjust pr_cipher_quality ratings

Browse Source 
This commit makes several changes to the way that ciphers are rated by pr_cipher_quality:

* It upgrades SEED ciphers to considered as strong as the corresponding AES ciphers.

* It downgrades ciphers that use AEAD, but that use a non-FS key exchange (TLS_DH_*, TLS_ECDH*, TLS_PSK_WITH_*) from best to good, thus giving them the same rating as AEAD ciphers that use static RSA (TLS_RSA_*).

* It downgrades some CBC ciphers to low (4) that are currently rated as neither good nor bad (5).

* It modifies the ratings created using OpenSSL names to provide the same ratings as those created using RFC names.
This commit is contained in:
David Cooper 2020-03-25 15:28:08 -04:00
parent 8ff45208c3
commit d177a90bbe
1 changed files with 30 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
testssl.sh
View File

@ -5948,7 +5948,7 @@ pr_cipher_quality() {
# We have an OpenSSL name and can't convert it to the RFC name which is rarely # We have an OpenSSL name and can't convert it to the RFC name which is rarely
# the case, see "prepare_arrays()" and "./etc/cipher-mapping.txt" # the case, see "prepare_arrays()" and "./etc/cipher-mapping.txt"
case "$cipher" in case "$cipher" in
*NULL*|EXP*|ADH*) *NULL*|EXP*|ADH*|AECDH*)
pr_svrty_critical "$text" pr_svrty_critical "$text"
return 1 return 1
;; ;;
@ -5956,20 +5956,34 @@ pr_cipher_quality() {
pr_svrty_high "$text" pr_svrty_high "$text"
return 2 return 2
;; ;;
AES256-GCM-SHA384|AES128-GCM-SHA256|AES256-CCM|AES128-CCM|ARIA256-GCM-SHA384|ARIA128-GCM-SHA256) AES256-GCM-SHA384|AES128-GCM-SHA256|AES256-CCM*|AES128-CCM*|ARIA256-GCM-SHA384|ARIA128-GCM-SHA256)
# RSA kx and e.g. GCM isn't certainly the best # RSA kx and e.g. GCM isn't certainly the best
pr_svrty_good "$text" pr_svrty_good "$text"
return 6 return 6
;; ;;
*CBC3*|*3DES*|*IDEA*)
pr_svrty_medium "$text"
return 3
;;
*DES*)
pr_svrty_high "$text"
return 2
;;
PSK-*GCM*|PSK-*CCM*|RSA-PSK-*GCM*|RSA-PSK-CHACHA20-POLY1305|PSK-CHACHA20-POLY1305|PSK-ARIA*-GCM-SHA*|RSA-PSK-ARIA*-GCM-SHA*)
# PSK kx and e.g. GCM isn't certainly the best
pr_svrty_good "$text"
return 6
;;
DH-*GCM*|ECDH-*GCM*)
# static DH or ECDH kx and GCM isn't certainly the best
pr_svrty_good "$text"
return 6
;;
*GCM*|*CCM*|*CHACHA20*) *GCM*|*CCM*|*CHACHA20*)
pr_svrty_best "$text" pr_svrty_best "$text"
return 7 return 7
;; #best ones ;; #best ones
*CBC3*|*SEED*|*3DES*|*IDEA*) *AES*SHA*|*CAMELLIA*SHA*|*SEED*SHA*)
pr_svrty_medium "$text"
return 3
;;
ECDHE*AES*|DHE*AES*SHA*|*CAMELLIA*SHA)
pr_svrty_low "$text" pr_svrty_low "$text"
return 4 return 4
;; ;;
@ -6000,28 +6014,23 @@ pr_cipher_quality() {
pr_svrty_high "$text" pr_svrty_high "$text"
return 2 return 2
;; ;;
*CBC3*|*SEED*|*3DES*|*IDEA*) *CBC3*|*3DES*|*IDEA*)
pr_svrty_medium "$text" pr_svrty_medium "$text"
return 3 return 3
;; ;;
TLS_RSA_*) *CBC*)
if [[ "$cipher" =~ CBC ]]; then
pr_svrty_low "$text" pr_svrty_low "$text"
return 4 return 4
else ;;
TLS_RSA_*|TLS_DH_*|TLS_ECDH_*|TLS_PSK_WITH_*)
pr_svrty_good "$text" pr_svrty_good "$text"
# RSA kx and e.g. GCM isn't certainly the best # RSA, or static DH, ECDH, or PSK kx and e.g. GCM isn't certainly the best
return 6 return 6
fi
;; ;;
*GCM*|*CCM*|*CHACHA20*) *GCM*|*CCM*|*CHACHA20*)
pr_svrty_best "$text" pr_svrty_best "$text"
return 7 return 7
;; ;;
*ECDHE*AES*CBC*|*DHE*AES*SHA*|*RSA*AES*SHA*|*CAMELLIA*SHA*)
pr_svrty_low "$text"
return 4
;;
*) *)
out "$text" out "$text"
return 5 return 5