3 ms·
Does anyone know if there is an SSL specification somewhere? One could then start to write tests at various levels to ensure compliance with the specification.
by solarengineer 10y ago
Does anyone know if there is an SSL specification somewhere? One could then start to write tests at various levels to ensure compliance with the specification. This test suite could then be considered a compatibility test suite as well.
- CiPHPerCoder 10y agoThere are numerous RFCs, yes.
- theandrewbailey 10y agoThe SSL spec (if you can call it that) and everything it depends on is spread over about a dozen or so RFCs. Good luck.
- IgorPartola 10y agoThis has been discussed to death, and the conclusion is generally that testing for unknown security bugs is not possible (or at least not practical).
- lmm 10y agoThe spec generally only specifies the correct behaviour, not what the program should be doing with e.g. malformed ASN.1.