Wstg: Cryp-01 Rewrite

[ThunderSon]

What's the issue?
The WSTG-CRYP-01 is old and too verbose, too unusable from a testing perspective

How do we solve it?
Clearly section it to test for the weaknesses in the protocol implementations. A full re-write

@rbsec would you be able to lend a hand in this? I can definitely work alongside you on this.

[rbsec]

Wow, that guide is.....definitely in need of a rewrite. My thoughts would be to try and align it with the transport layer security cheat sheet, so a structure something like:

• Intro stuff
• Testing server configuration
  
  
  
  • Protocols
  
  
  • Ciphers
  
  
  • Other stuff (compression, etc)
  
  
• Testing certificates
  
  
  
  • Strength (key bits, hash algorithm)
  
  
  • Trust (CN, SAN, issuer, etc)
  
  
  • Validity (dates)
  
  
• Testing for vulnerabilities
  
  
  
  • Heartbleed
  
  
  • Others (TLS CRIME, old OpenSSL, etc)
  
  
• Testing client certificates
  
  
  
  • Other user's certificates
  
  
  • Other certificates signed by same CA
  
  
  • Certificates signed by another CA
  
  
  • Header spoofing
  
  
• Tools
  
  
  
  • Brief overview of main tools
  
  
  • OpenSSL for manual testing
  
  
  • Nessus, Nmap, sslscan, sslyze, SSL Labs
  
  

Thoughts?

[ThunderSon]

In the server config I'd add in the "other stuff" the redirections issues from HTTP to HTTPS.
I like it. It covers everything in terms of ensuring TLS security.

[rbsec]

I thought about that - but then the main recommendation there is going to be around implementing HSTS - and that's already a separate check (WSTG-CONF-07).

Should these checks be included here as well, or does it make more sense for it to be somewhere else?

[ThunderSon]

We can directly link to it, instead of explaining it.

[rbsec]

@ThunderSon this issue can be closed now that #555 has been merged.