4 ms·

> TLS bugs aren't even unusual. Is there a public test-suite that implementers can check against?

• tptacek 13y ago
  No, not that I know of.
  • astrodust 13y ago
    There's the problem. Plus, if there were tests, they just become another target.
    • tptacek 13y ago
      It's hard to design a good TLS test suite, for at least a couple reasons: * The TLS stacks all have different APIs, and you'll need some fine-grained configuration over client options to exercise the code. * There are only a few important TLS stacks, and the effort required to build a test suite is probably greater than the effort required to build a TLS stack. It would still be a cool project. If it exists, I'd love to hear about it.
  • rqebmm 13y ago
    I bet the NSA has one to look for vulnerabilities like this though!