TLS Cipher Walking

Image by PublicDomainPictures from Pixabay

I need to validate if the TLS cipher exposed by the application is secure. I therefore created two versions of the scanner, one is sequential Openssl based, the other one is parallel version implemented with Golang.

Sequential Version with Openssl

This webpage provides a nice base to use openssl s_client to walk through the ciphers. Just need to update it for the new syntax for TLS1.3. The script to walk through the TLS ciphers are shown below,

#!/usr/bin/env bash
tls1=$(openssl ciphers -tls1 | sed -e 's/:/ /g')
tls11=$(openssl ciphers -tls1_1 | sed -e 's/:/ /g')
tls12=$(openssl ciphers -tls1_2 | sed -e 's/:/ /g')
tls13=$(openssl ciphers -tls1_3 | sed -e 's/:/ /g')

for cipher in ${tls1}
do
result=$(echo -n | openssl s_client -tls1 -cipher "$cipher" -connect $1 2>&1)
if [[ "$result" =~ "Cipher is ${cipher}" ]] ; then
  echo "TLS1: ${cipher}"
fi
done

for cipher in ${tls11}
do
result=$(echo -n | openssl s_client -tls1_1 -cipher "$cipher" -connect $1 2>&1)
if [[ "$result" =~ "Cipher is ${cipher}" ]] ; then
  echo "TLS1.1: ${cipher}"
fi
done


for cipher in ${tls12}
do
result=$(echo -n | openssl s_client -tls1_2 -cipher "$cipher" -connect $1 2>&1)
if [[ "$result" =~ "Cipher is ${cipher}" ]] ; then
  echo "TLS1.2: ${cipher}"
fi
done

for cipher in ${tls13}
do
result=$(echo -n | openssl s_client -tls1_3 -ciphersuites "$cipher" -connect $1 2>&1)
if [[ "$result" =~ "Cipher is ${cipher}" ]] ; then
  echo "TLS1.3: ${cipher}"
fi
done

Test against google.com as below,

$ ./tls-cipher-walk.sh google.com:443
TLS1: AES256-SHA
TLS1: AES128-SHA
TLS1.1: AES256-SHA
TLS1.1: AES128-SHA
TLS1.2: ECDHE-ECDSA-AES256-GCM-SHA384
TLS1.2: ECDHE-RSA-AES256-GCM-SHA384
TLS1.2: ECDHE-ECDSA-CHACHA20-POLY1305
TLS1.2: ECDHE-RSA-CHACHA20-POLY1305
TLS1.2: ECDHE-ECDSA-AES128-GCM-SHA256
TLS1.2: ECDHE-RSA-AES128-GCM-SHA256
TLS1.2: ECDHE-ECDSA-AES256-SHA
TLS1.2: ECDHE-RSA-AES256-SHA
TLS1.2: ECDHE-ECDSA-AES128-SHA
TLS1.2: ECDHE-RSA-AES128-SHA
TLS1.2: AES256-GCM-SHA384
TLS1.2: AES128-GCM-SHA256
TLS1.2: AES256-SHA
TLS1.2: AES128-SHA
TLS1.3: TLS_AES_256_GCM_SHA384
TLS1.3: TLS_CHACHA20_POLY1305_SHA256
TLS1.3: TLS_AES_128_GCM_SHA256

But soon, you realise the script is slow as each of the cipher is checked in a sequential way.

Parallel Walk with Golang