============================================ TOOL: Harden SSL/TLS beta OS: Windows (2000,XP,Seven,2003,2008,2008R2) Requirement : .NET Framework 2.0 Author : Thierry Zoller for G-SEC Ltd. ============================================
Developed as part of G-SEC's investigation into the "Secure SSL/TLS configuration Report 2010" (to be published) we developed this little tool. "Harden SSL/TLS" hardens the default SSL/TLS settings of Windows 2000,2003,2008,2008R2, XP,Vista,7. It allows to remotely set SSL/TLS policies allowing or denying certain ciphers/hashes or complete ciphersuites. It took longer then I expected to create this tool, Windows 7 really strengthened the cryptosuites and introduced a new way Windows handles SCHANNEL policies and required quite some re-engineering. For instance, I had to create a mini state engine just for the preferred cipher list. Harden SSL/TLS allows setting policies with regards to what ciphers and protocols are available to applications that use SCHANNEL crypto interface. A lot of windows applications do use this interface, for instance IIS, Google Chrome as well as Apple Safari and many more. By changing the settings you can indirectly control what ciphers and protocols these applications are allowed to use and stay compliant to whatever policies you use. Note: unfortunately neither chrome nor safari make use of the new TLS 1.2 protocol that Windows 7 introduced (hint hint). They both use SCHANNEL and just need to add a parameter to the SCHANNEL initialization in order to support it. (Let's see who is first) It allows to allow or deny: · Hashes · Keyexchange algorithms · Protocols · Ciphers & Ciphersuites · Priority of preferred Ciphersuites Advanced mode · Re-enable ECC P521 mode on Windows7 and 2008R2 (P521 mode was available on Vista and 2008 but removed in Windows7 and 2008R2) · Enable TLS 1.2 support on IIS 7.5 (off by default) · Set TLS Cache size and timeout Download and Information: http://blog.g-sec.lu/2010/02/harden-ssltls-tool-release.html Documentation : http://www.g-sec.lu/sslharden/documentation.pdf Video : http://www.g-sec.lu/sslharden/harde_ssl.swf -- http://www.g-sec.lu Thierry Zoller _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/