TLS 1.2 Client Test Suite Data Sheet

Test Suite: TLS 1.2 Client Test Suite

Direction: Client

TLS (Transport Layer Security) represents the current standard for communications privacy in the Internet. TLS is used in server and client applications ranging from web browsers to electronic banking software and e-commerce sites. As higher-level protocols often build upon it, the dependability of the underlying TLS implementation is an integral factor in the secure operation of a wide range of software products. The robustness and security of TLS/SSL software can be verified using the TLS Client Test Suite.

Used specifications

Specification Title Notes
RFC2246 The TLS Protocol Version 1.0 Suite does not have tests for TLS1.0 protocol version
RFC2595 Using TLS with IMAP, POP3 and ACAP
RFC2817 HTTP Upgrade to TLS CONNECT method with basic authentication is supported.
RFC3207 SMTP Service Extension for Secure SMTP over Transport Layer Security
RFC3268 Advanced Encryption Standard (AES) Ciphersuites for Transport Layer Security (TLS)
RFC4279 Pre-Shared Key Ciphersuites for Transport Layer Security (TLS)
RFC4346 The Transport Layer Security (TLS) Protocol Version 1.1 Suite does not have tests for TLS1.1 protocol version
RFC4492 Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS)
RFC5054 Using the Secure Remote Password (SRP) Protocol for TLS Authentication
RFC5077 Transport Layer Security (TLS) Session Resumption without Server-Side State
RFC5246 The Transport Layer Security (TLS) Protocol Version 1.2 Obsoletes RFC4346
RFC5487 Pre-Shared Key Cipher Suites for TLS with SHA-256/384 and AES Galois Counter Mode PSK_AES_SHA ciphers added
RFC5746 Transport Layer Security (TLS) Renegotiation Indication Extension Updates RFC5246, RFC4366, RFC4347, RFC4346 and RFC2246
RFC6066 Transport Layer Security (TLS) Extensions: Extension Definitions Obsoletes RFC4366
RFC6460 Suite B Profile for Transport Layer Security (TLS)
RFC7301 Transport Layer Security (TLS) Application-Layer Protocol Negotiation Extension
RFC7626 Transport Layer Security (TLS) Session Hash and Extended Master Secret Extension
RFC7685 A Transport Layer Security (TLS) ClientHello Padding Extension No valid case support, only for anomalies
nextprotoneg TLS Next Protocol Negotiation Google Technical Note: nextprotoneg, July 2011

Tool-specific information

Tested messages Specifications
Hello Request RFC5246
Server Hello RFC5246
Server Certificate RFC5246
Server Key Exchange Message RFC5246
Certificate Request RFC5246
Server Hello Done RFC5246
Finished RFC5246
Change Cipher Spec RFC5246
Next Protocol
Supported protocol features Specifications
Transport over TCP RFC4346
TLS default handshake with HTTP, FTP or POP3 payload RFC4346
Client initiated re-handshake RFC4346
Client initiated abbreviated handshake RFC4346
Server initiated re-handshake with Hello Request message RFC4346
New Session Ticket – Session Resumption RFC5077
Supported test suite features
TLS Application Data over TCP or UDP socket
X.509 RSA/DSA/ECDSA Certificates and Private Keys from file, TCP or UDP socket
Supported TLS/SSL cipher suites Specifications
TLS_RSA_WITH_RC4_128_MD5 RFC5246
TLS_RSA_WITH_RC4_128_SHA RFC5246
TLS_RSA_WITH_DES_CBC_SHA RFC5246
TLS_RSA_WITH_3DES_EDE_CBC_SHA RFC5246
TLS_DHE_DSS_WITH_DES_CBC_SHA RFC5246
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA RFC5246
TLS_DHE_RSA_WITH_DES_CBC_SHA RFC5246
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA RFC5246
TLS_DH_anon_WITH_RC4_128_MD5 RFC5246
TLS_DH_anon_WITH_DES_CBC_SHA RFC5246
TLS_DH_anon_WITH_3DES_EDE_CBC_SHA RFC5246
TLS_RSA_WITH_AES_128_CBC_SHA256 RFC5246
TLS_RSA_WITH_AES_256_CBC_SHA256 RFC5246
TLS_RSA_WITH_AES_128_CBC_SHA RFC3268
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 RFC5288
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 RFC5288
TLS_RSA_WITH_AES_128_GCM_SHA256 RFC5288
TLS_RSA_WITH_AES_256_GCM_SHA384 RFC5288
TLS_DHE_DSS_WITH_AES_128_CBC_SHA RFC3268
TLS_DHE_RSA_WITH_AES_128_CBC_SHA RFC3268
TLS_DH_anon_WITH_AES_128_CBC_SHA RFC3268
TLS_RSA_WITH_AES_256_CBC_SHA RFC3268
TLS_DHE_DSS_WITH_AES_256_CBC_SHA RFC3268
TLS_DHE_RSA_WITH_AES_256_CBC_SHA RFC3268
TLS_DH_anon_WITH_AES_256_CBC_SHA RFC3268
TLS_RSA_EXPORT_WITH_RC4_40_MD5 RFC5246
TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 RFC5246
TLS_RSA_EXPORT_WITH_DES40_CBC_SHA RFC5246
TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA RFC5246
TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA RFC5246
TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 RFC5246
TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA RFC5246
TLS_PSK_WITH_AES_128_CBC_SHA RFC4279
TLS_PSK_WITH_AES_128_CBC_SHA256 RFC5487
TLS_PSK_WITH_AES_256_CBC_SHA384 RFC5487
TLS_PSK_WITH_AES_128_GCM_SHA256 RFC5487
TLS_PSK_WITH_AES_256_GCM_SHA384 RFC5487
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 RFC4492
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 RFC6460
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA RFC4492
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA RFC4492
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA RFC4492
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA RFC4492
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 RFC4492
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 RFC4492
TLS_ECDHE_RSA_WITH_RC4_128_SHA RFC4492
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA RFC4492
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA RFC4492
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA RFC4492
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 RFC4492
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 RFC4492
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 RFC5289
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 RFC5289
TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA RFC505
TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA RFC5054
TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA RFC5054
TLS_SRP_SHA_WITH_AES_128_CBC_SHA RFC5054
TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA RFC5054
TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA RFC5054
TLS_SRP_SHA_WITH_AES_256_CBC_SHA RFC5054
TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA RFC5054
TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA 5054
TLS_RSA_WITH_NULL_MD5 RFC5246
TLS_RSA_WITH_NULL_SHA RFC5246
TLS_NULL_WITH_NULL_NULL RFC5246
Supported SafeGuard Checks
Authentication Bypass
Certificate Validation
Heartbleed
Information Leakage
Insufficient Randomness
Unexpected Data
Weak Cryptography