#!/usr/bin/perldoc
#?
# Generated by o-saft.pl .
# Unfortunately the format in  @help is incomplete,  for example proper  =over
# and corresponding =back  paragraph is missing. It is mandatory around  =item
# paragraphs. However, to avoid tools complaining about that,  =over and =back
# are added to each  =item  to avoid error messages in the viewer tools.
# Hence the additional identations for text following the =item are missing.
# Tested viewers: podviewer, perldoc, pod2usage, tkpod

=pod

=encoding utf8


=head1 NAME

O-Saft - OWASP SSL advanced forensic tool
    OWASP SSL audit for testers

=head1 SYNOPSIS

	o-saft.pl [COMMANDS ..] [OPTIONS ..] target [target target ...]

where  [COMMANDS]  and  [OPTIONS]  are described below  and target is
a hostname either as full qualified domain name or an IP address.
Multiple commands and targets may be combined.

All  commands  and  options  can also be specified in a  rc-file, see
L</RC-FILE>  below.

I.g. all commands start with a  C<+>  character and options start with
C<->  or  C<-->  characters. Anything else is treated as target name.

Arguments (commands, options and targets) can be used in any order.
If options are given multiple times,  or when they configure the same
behaviour (for example toggles like I<--tlsv2> and I<--no-tlsv2>), the last
given one wins.

Arguments are read from following sources in that sequence:
1. rc-file  if not disabled with I<--no-rc>
for details, please see section  L</RC-FILE>  below
2. environment variable OSAFT_OPTIONS
3. command-line

=head1 DESCRIPTION

This tool lists  information  about remote target's  SSL certificate,
and tests the remote target according given list of ciphers.

Note:  Throughout this description  C<$0>  is used as an alias for the
program name  C<o-saft.pl>.

=head1 QUICKSTART

Before going into  a detailed description  of the  purpose and usage,
here are some examples of the most common use cases:

=over

=item * Show supported (enabled) ciphers of target:

=back

	o-saft.pl +cipher --enabled example.tld

=over

=item * Show details of certificate and connection of target:

=back

	o-saft.pl +info example.tld

=over

=item * Check certificate, ciphers and SSL connection of target:

=back

	o-saft.pl +check example.tld

=over

=item * Check connection to target for vulnerabilities:

=back

	o-saft.pl +vulns example.tld

=over

=item * Get the certificate's Common Name for a bunch of servers:

=back

	o-saft.pl +cn example.tld some.tld other.tld

=over

=item * List more usage examples

=back

	o-saft.pl --help=examples

=over

=item * List all available commands:

=back

	o-saft.pl --help=commands

=over

=item * Get table of contents for complete help

=back

	o-saft.pl --help=toc

=over

=item * Show just one section, for example SECURITY, from help

=back

	o-saft.pl --help=SECURITY

=over

=item * Show all  --help=*  commands

=back

	o-saft.pl --help=HELP

=over

=item * Search for text in O-Saft's help and show with context

=back

o-saft --help=your-text

=over

=item * Start the simple GUI

=back

	o-saft.tcl 

=over

=item * Start the simple GUI which uses o-saft.pl in a Docker image

=back

	o-saft.tcl --docker

For more specialised test cases, refer to the sections  L</COMMANDS>  and
L</OPTIONS>  below. For more examples please refer to  L</EXAMPLES>  section.

For more details, please see  L</Requirements>  and  L</INSTALLATION>  below.

=head1 WHY?

Why a new tool for checking SSL security and configuration when there
are already a dozen or more such good tools in existence (in 2012)?

Unique features:

=over

=item * working in closed environments, i.e. without internet connection

=back

=over

=item * checking availability of ciphers independent of installed library

=back

=over

=item * checking for all possible ciphers (up to 65535 per SSL protocol)

=back

=over

=item * mainly same results on all platforms.

=back

Currently available tools suffer from some or all of following issues:

=over

=item * lack of tests of unusual SSL certificate configurations

=back

=over

=item * may return different results for the same checks on given target

=back

=over

=item * missing tests for modern SSL/TLS functionality

=back

=over

=item * missing tests for specific, known SSL/TLS vulnerabilities

=back

=over

=item * no support for newer, advanced, features e.g. CRL, OCSP, EV

=back

=over

=item * limited capability to create your own customised tests

=back

Other  reasons or problems  are that other tools are either binary or
use additional binaries and hence are not portable to other platforms.

In contrast to (all?) most other tools, including L<openssl(1)|openssl(1)>, it can
be used to "ask simple questions" like "does target support STS" just
by calling:

	o-saft.pl +hsts_sts example.tld

For more, please see  L</EXAMPLES>  section below.
If it should run on systems with old software (perl or Perl modules),
please see  L</DEBUG>  section below.

=head1 SECURITY

This tool is designed to be used by people doing security or forensic
analyses. Hence no malicious input is expected.

There are no special security checks implemented. Some parameters are
roughly sanitised according unwanted characters.  In particular there
are no checks according any kind of code injection.

Care should be taken, when additional tools and modules are installed
as described in  L</INSTALLATION>  below. In particular it is recommended
to do these installations into directoies  specially prepared for use
with  o-saft.pl .
No other tools of your system  should use  these additional installed
tools, for example by accident or because environment variables point
to them.

Note that compilation and installation of  additional tools (openssl,
Net::SSLeay, etc.) uses known insecure configurations and features!
This is essential to make  o-saft.pl  able to check for such insecurities.

It is  highly recommended to do these installations and use the tools
on a separate testing system.

B<DO NOT USE THESE INSTALLATIONS ON PRODUCTIVE SYSTEMS.>

=head1 CONCEPTS

The purpose of  O-Saft  is to do the work,  not to force the user  to
learn a new tool or to install "newer" software first.
However, the user "should do something" if necessary depending on the
reported results.

Developers may read more details on the concept in  doc/concepts.txt.

=head2 This help text

The sequence of the sections in the help text doesn't strictly follow
the common guidlines for UNIX-style man pages.  This is because it is
important to understand the concepts of the tool and what options and
commands are in context of the tool. In particular the  L</DESCRIPTION>  
section contains only a very brief description. The  L</OPTIONS>  section
follows the  L</COMMANDS>  section.

=head2 Results

Results of checks are marked  C<yes>  or C<no>.  This leaves the proper
interpretation, if the result is "good" or "bad", to the user.
Background:  it is not always possible to rate a result as  "good" or
"bad" or "insecure" or whatever. That's why  O-Saft  can not give the
"the best" or "proper" recommendation.  In practice it depends on the
context what a recommendation or countermeasure should be. That's why
results are marked  C<yes>  or  C<no>  if considered "questionable", or
"not good" (for example according other checks).

For more details please see  L</RESULTS>  below.

=head1 TECHNICAL INFORMATION

It is important to understand, which provided information is based on
data returned by underlaying (used) libraries and the information
computed directly.

=head2 Version 23.11.23 and later

Starting with version 23.11.23 all checks for ciphers are done by our
own plain Perl code, just the SSL/TLS-related checks and informations
use L<Net::SSLeay(3pm)|Net::SSLeay(3pm)> and openssl.
Since version 23.12.23 OpenSSL 3.0.x is supported also.

Beside  new and removed funtionality  in OpenSSL (details see below),
OpenSSL also changed some texts in its responses. Again this makes it
hard to parse openssl's output properly. Therfore checking for cipher
is now done without openssl.  Using openssl for checking ciphers must
be requested explicitly with the  I<--ciphermode=openssl>  option.

Keep in mind that it is not possible  to check if the target supports
ancient ciphers with openssl 3.x. There even does not exist a patched
version, as we used before, to do it. However, any openssl 1.x can be
be used if specified with the  I<--openssl=>  option.

Following changes in OpenSSL have been observed (incomplete list):

=over

=item *            # our command/option| OpenSSL 1.x           | OpenSSL 3.0.x

=back

=over

=item *            #-------------------+-----------------------+---------------------

=back

-ssl2 -no_ssl2     | -ssl2 -no_ssl2        | <<not supported>>
-ssl3 -no_ssl3     | -ssl3 -no_ssl3        | <<not supported>>
-tls1_3 -no_tls1_3 | <<not supported>>     | -tls1_3 -no_tls1_3
-dtls1  -dtls1_2   | <<not supported>>     | -dtls1  -dtls1_2
                  | <<not supported>>     | -legacy_renegotiation
                  | <<not supported>>     | -prioritize_chacha
I<+selfsigned>        | self signed           | num=18:self-signed
I<+sslversion>        | TLSv1.2               | TLSv12
I<+renegotiation>     | renegotiation info" (id=65281), len=1
                  |         Secure Renegotiation IS NOT supported
I<+sigkey_len>        | 2048                  | 2104
I<+sigkey_value>      | hexhex                | Signature Value hexhex
I<+dh_parameter>      | ECDH, P-256, 256 bits | X25519, 253 bits
I<+cipher-selected>   | New, TLSv1/SSLv3, ... | New, TLSv1.3, ...

=over

=item *            #-------------------+-----------------------+---------------------

=back

As the purpose of this tool is to check for any cipher,  wether known
or not, using modern OpenSSL 3.x is not feasible because it is simply
not possible. This restriction may apply to other tools which rely on
openssl or the underlying libssl too.

Beyond this limitation, checking old protocols and ciphers on targets
which use modern libraries, may result in a bunch of warnings.  If it
happens, following can be done to get a better overview:

	o-saft.pl target --header +cipher
	o-saft.pl target --header +cipher --nossl2 --nossl3 --notls1
	o-saft.pl target --header +cipher --no-warnings
	o-saft.pl target --header +cipher --nossl2 --nossl3 --notls1 --no-warnings
	o-saft.pl target --header +cipher --ciphermode=openssl --openssl=/path/openssl

=head2 Version 19.11.19 and later

Starting with version 19.11.19 the  I<+cipher>  command does not use any
external library. Checking for ciphers is done using plain Perl code.
Only other collected SSL/TLS related information requires an external
library, in general libssl.
The description about OpenSSL and libssl below applies only if any of
the options  I<--ciphermode=openssl>  or  I<--ciphermode=ssleay>  are given
with the  I<+cipher>  command.

Therefore following commands and options changed:

=over

=item *            # VERSION < 19.11.19       |  change ...

=back

=over

=item *            #--------------------------+---------------------------------

=back

=over

=item * +cipher                 | uses internal method

=back

=over

=item * +cipherall              | command obsolete, !!Hint is printed

=back

=over

=item * +cipherraw              | command obsolete, !!Hint is printed

=back

=over

=item * --force-openssl         | 

=back

=over

=item * --openssl-ciphers       | changed to  --ciphermode=openssl

=back

=over

=item * --openssl=TOOL          | TOOL only used for  +cipher  --ciphermode=openssl

=back

=over

=item * --legacy=owasp          | option obsolete

=back

=over

=item *            #--------------------------+---------------------------------

=back

The historic commands  I<+cipherall>  and  I<+cipherraw> should be replaced
with the new syntax, as follows:

=over

=item *            # VERSION < 19.11.19       |  VERSION > 19.11.19

=back

=over

=item *            #--------------------------+---------------------------------

=back

=over

=item * +cipher                 |  +cipher  --ciphermode=ssleay

=back

=over

=item * +cipher --force-openssl |  +cipher  --ciphermode=openssl

=back

=over

=item * +cipherall              |  +cipher

=back

=over

=item * +cipherraw              |  +cipher  --ciphermode=intern

=back

=over

=item *            #--------------------------+---------------------------------

=back

=head2 Version before 19.11.19

Up to version 19.11.19 the default behaviour for the  I<+cipher> command
was to use libssl. The commands  I<+cipherall>  and  I<+cipherraw>  did not
use any other library as described below.

=head2 OpenSSL, libssl, libcrypto

In general the tool uses Perl's L<Net::SSLeay(3pm)|Net::SSLeay(3pm)> module which itself
is based on libssl and/or libssleay library of the operating system.
It's possible to use other versions of these libraries, see options:

=over

=item * --exe-path=PATH  --exe=PATH

=back

=over

=item * --lib-path=PATH  --lib=PATH

=back

=over

=item * --envlibvar=NAME

=back

The external L<openssl(1)|openssl(1)> is called to extract  some information from
its output. The version of  openssl  can be controlled with following
options:

=over

=item * --openssl=TOOL

=back

=over

=item * --no-openssl

=back

=over

=item * --openssl-ciphers   --force-openssl

=back

=over

=item * --exe-path=PATH     --exe=PATH

=back

=over

=item * --openssl-cnf=PATH

=back

=over

=item * --openssl-s_client  --s_client

=back

OpenSSL is recommended to be used for libssl and libcrypto.  Versions
0.9.8k to 1.0.2e (Jan. 2016) are known to work. However, versions be-
for 1.0.0 may not provide all information.
Some functionality (checks) of  O-Saft  may be missing or fail,  when
openssl versions 1.1.x are used (because functionality was removed).
LibreSSL  is not recommended, because  some functionality  considered
insecure, has been removed.
For more details, please see  L</INSTALLATION>  below.

=head2 Certificates and CA

All checks according the validity of the certificate chain  are based
on the root CAs installed on the system.  Note that L<Net::SSLeay(3pm)|Net::SSLeay(3pm)>
and L<openssl(1)|openssl(1)> may have their own rules where to find the root CAs.
Please refer to the documentation on your system for these tools.
However, there are folloing options to tweak these rules:

=over

=item * --ca-file=FILE

=back

=over

=item * --ca-path=DIR

=back

=over

=item * --ca-depth=INT

=back

=head2 Commands and options

All arguments  starting with  C<+>  are considered  L</COMMANDS>  for this
tool. All arguments starting with  C<-->  are considered  L</OPTIONS>  for
this tool.

Reading any data from STDIN or here-documents is not yet supported.
It's reserved for future use.

=head2 Environment variables

Please see  L</ENVIRONMENT>  .

=head2 Requirements

For  I<+info>  and  I<+check>  (and all related) commands,  perl (5.x) with
following modules (minimal version) is recommended:

=over

=item * IO               1.25 (2011)

=back

=over

=item * IO::Socket::INET 1.37 (2011)

=back

=over

=item * IO::Socket::SSL  1.90 (2013)

=back

=over

=item * Net::DNS         0.66 (2011)

=back

=over

=item * Net::SSLeay      1.49 (2012)

=back

However, it is recommended to use the most recent version of the mod-
ules which then gives more accurate results and less warnings. If the
modules are missing, they can be installed for example with:

	cpan Net::SSLeay

Note: if you want to use advanced features of openssl or Net::SSLeay,
please see  L</INSTALLATION> section how to compile and install the tools
fully customised. Requirements for  OpenSSL  are described there.

Also an openssl executable should be available, but is not mandatory.

For checking DH parameters of ciphers, openssl 1.0.2  or newer should
be available. If an older version of openssl is found, we try hard to
extract the  DH parameters  from the data returned by the server, see
I<+cipher-dh>  command.

If you need to run on systems with older perl or Perl module versions
please refer to the  L</DEBUG>  section for more information.

=head2 External tools

For building and/or viewing the documentation, any of following tools
should be available:

=over

=item * aha              0.5-1

=back

=over

=item * perldoc          v3.2801

=back

=over

=item * pod2man

=back

=over

=item * pod2usage

=back

=over

=item * podviewer        v0.18

=back

=over

=item * tkpod

=back

=over

=item * tput

=back

=over

=item * stty

=back

=head1 COMMANDS

There are commands for various tests according the  SSL connection to
the target, the targets certificate and the used ciphers.

All commands are prepended by a  C<+>  character to easily distinguish
from other arguments and options. However, some I<--OPTIONS> options are
treated as commands for historical reason or compatibility with other
programs.

The most important commands are (in alphabetical order):
I<+check> I<+cipher> I<+info> I<+http> I<+list> I<+quick> I<+sni> I<+sni_check> I<+version>

A list of all available commands will be printed with:

	o-saft.pl --help=cmds

The description of all other commands will be printed with:

	o-saft.pl --header --help=commands

The summary and internal commands return requested information or the
results of checks. These are described below.

Note that some commands may be a combination of other commands, see:

	o-saft.pl --header --help=intern

The following sub-sections only describe the commands,  which do more
than giving a simple information from the target.  All other commands
can be listed with:

	o-saft.pl --header --help=commands

The final sub-sections  L</Notes about commands>  describes some notes
about special commands and related commands.

=head2 Commands for information about this tool

All these commands will exit after execution (cannot be used together
with other commands).

=head3 +ciphers

Show known ciphers in format like "openssl ciphers".
It also accepts the  -v  and  -V  option (like openssl).
Use  I<+list>  command for more information according ciphers.

=head3 +list

Show all ciphers supported by this tool. This includes cryptogrphic
details of the cipher and some internal details.

Different output formats are used for the  I<--legacy=*>  option:

=over

=item * --legacy=simple   - simple space-separated output

=back

=over

=item * --legacy=full     - TAB-separated output with more data

=back

=over

=item * --legacy=owasp    - simple output sorted according OWASP scoring

=back

=over

=item * --legacy=openssl  - output same as with  +ciphers  command

=back

=over

=item * --legacy=ssltest  - output like "ssltest --list"

=back

=head3 +VERSION

Just show version and exit.

=head3 +version

Show version information for both the program and the  Perl modules
that it uses, then exit.

Use  I<--v>  option to show more details.

=head3 +libversion

Show version of openssl.

=head3 +quit

Show internal data and exit, used for testing and debugging only.
Please see  L</TESTING>  below.

=head2 Commands to check SSL details

Following (summary and internal) commands are simply a shortcut for a
list of other commands. For details of the list use:

	o-saft.pl --help=intern

=head3 +check

Check the SSL connection for security issues. Implies  I<+cipher> .

=head3 +host

Print details about the targets hostname, DNS, etc.
These details are usually printed only for the  I<+check>  and  I<+info>
command, but not for any individual command.

=head3 +http

Perform HTTP checks (like STS, redirects etc.).

=head3 +info

Overview of most important details of the SSL connection.

Use  I<--v>  option to show details also, which span multiple lines.

=head3 +quick

Quick overview of checks. Implies  I<--enabled>  and  I<--label=short>.

=head3 +pfs

Check if servers offers ciphers with prefect forward secrecy (PFS).

=head3 +protocols

Check for protocols supported by target.

=head3 +vulns

Check for various vulnerabilities.

=head3 +sts

=head3 +hsts

Various checks according STS HTTP header.
This option implies  I<--http>,  means that  I<--no-http> is ignored.

=head3 +sni

Check for Server Name Indication (SNI) usage.

=head3 +sni_check

=head3 +check_sni

Check for Server Name Indication (SNI) usage  and  validity  of all
names (CN, subjectAltName, FQDN, etc.).

=head3 +bsi

Various checks according BSI TR-02102-2 and TR-03116-4 compliance.

=head3 +ev

Various checks according certificate's extended Validation (EV).

Hint: use option  I<--v>  I<--v>  to get information about failed checks.

=head3 +sizes

Check length, size and count of some values in the certificate.

=head3 +s_client

Dump data retrieved from  "openssl s_client ..."  call. This should
be used for debugging only.
It can be used just like openssl itself, for example:

	openssl s_client -connect host:443 -no_sslv2

=head3 +dump

Dumps internal data for SSL connection and target certificate. This
is mainly for debugging and  should not be used together with other
commands (except  I<+cipher>).
Each key-value pair is enclosed in  C<#{>  and  C<#}> .

Using  I<--trace>  I<--trace>  dumps data of  lib/SSLinfo  too.

=head3 +exec

Command used internally when requested to use other libraries.
This command should not be used directly.

=head2 Commands to test ciphers provided by target

Beside the description of the commands itself here, please see also
L</Notes about commands>  below.

=head3 +cipher

Check target for ciphers,  either all ciphers, or ciphers specified
with  I<--cipher=CIPHER>  option.

Use  I<--v>  option to see all ciphers being checked.

=head3 +cipher-default

Lists the cipher selected by the server for each protocol sometimes
referred to as "default cipher".

For each protocol the two selected ciphers are shown,  one returned
by the server if the cipher list in the  ClientHello is sorted with
the strongest cipher first, and one returned  if the cipher list in
the ClientHello is sorted with strongest cipher last.
See  L</Notes about commands>  for details.

=head3 +cipher-dh

Checked target for ciphers. All ciphers supported by the server are
printed with their DH or ECDH paramaters (if available).
ciphers.

=head3 +null

=head3 +cipher-null

Check if target accepts NULL ciphers.

=head3 +adh

=head3 +cipher-adh

Check if target accepts ciphers with anonymous key exchange.

=head3 +export

=head3 +cipher-exp

Check if target accepts EXPORT ciphers.

=head3 +cbc

=head3 +cipher-cbc

Check if target accepts CBC ciphers.

=head3 +des

=head3 +cipher-des

Check if target accepts DES ciphers.

=head3 +cipher-rc4

Check if target accepts RC4 ciphers.

=head3 +edh

=head3 +cipher-edh

Check if target supports ephemeral ciphers.

=head3 +cipher-pfs

Check if target supports ciphers with PFS.

=head3 +cipher-strong

Check if target selects strongest cipher.

=head3 +cipher-weak

Check if target selects weak cipher (oposite of  I<+cipher-strong>).

=head2 Discrete commands to test SSL connection and certificate details

Discrete commands, please see:

	o-saft.pl --help=commands

=head2 Notes about commands

=head3 +cipher vs. +cipher-dh

While  I<+cipher>  prints checked ciphers,  I<+cipher-dh>  prints ciphers
with their DH or ECDH paramaters (if available)  only for supported
ciphers.

=head3 +cipher vs. +cipher-default

Both commands show the default cipher foreach protocol.

I<+cipher>  lists a summary of ciphers selected by the server for each
protocol requested by the user (for example by using options like:
I<--sslv3>  I<--tlsv1> etc.). When the  I<--v>  option is used, all selected
ciphers for all known protocols are listed. This summary focuses on
counts for various ciphers.

I<+cipher-default>  lists the  cipher selected  by the server for each
protocol.

=head3 +cipher-selected vs. +cipher-default

I<+selected>  lists the cipher selected by the server if no particular
protocol was specified and the system's default cipher list is send
in the ClientHello to the server.

I<+cipher-default>  lists the  cipher selected  by the server for each
protocol.

=head3 +cipher-strong vs. +cipher-default

I<+strong-cipher>  shows the result of the check if strong ciphers are
preferred by the server. It is a check command.

I<+cipher-default>  lists the  cipher selected  by the server for each
protocol. It is a information command.

It is not possible to check if a server uses C<SSLHonorCipherOrder>.
Even if it is used (switched on),  it is not possible to  check the
specified order of the ciphers.

I. g. it is expected that the order is according the cipher suite's
strength, meaning the most strongest first, and the weakest last.
It doesn't make sense to use an order where a weak cipher preceds a
stronger one. Such a (mis-)configuration should be detected.

Having this in mind, the algorithm to detect a  proper cipher order
is as simply as follows:
1. pass sorted cipher list with strongest cipher first
2. pass sorted cipher list with strongest cipher last
if the server returns the same cipher for both checks, it's assumed
that it prefers to use the most strongest cipher. In this case it's
obvious that C<SSLHonorCipherOrder> is set (exceptions see below).

Exceptions:
If either, the server or the client,  uses only one cipher suite in
the list, SSLHonorCipherOrder cannot be detected at all.
The same happens, if only one cipher in the client's list matches a
cipher in the server's list.

=head3 +tlsextdebug

=head3 +tlsextensions

=head3 +extensions vs. +tlsextensions

"Certificate extensions" are shown with  I<+extensions>  while the TLS
protocol extensions are shown with  I<+tlsextensions>.
Use  I<+tlsextdebug>  to show more information about the  TLS protocol
extensions.

=head3 +http2 +spdy +spdy3 +spdy31 +spdy4 +prots

These commands are just an alias for the  I<+protocols>  command.

=head3 +wildcard

=head3 +hostname vs. +wildhost vs. +altname vs. +rfc_2818

The commands  I<+cn>  and  I<+altname>  print the  information stored  in
the certificate.
The command  I<+hostname>  checks if the given hostname matches the CN
value in the certificate.  Note that wildcard names in the CN, only
allow to contain one C<*>.
The command  I<+wildcard>  checks if the given hostname does not match
any name specified in the certificate's "subjectAltname". This check
is useful  if the certificate and the configuration  must comply to
RFC 6125 or EV certificates.

=head1 OPTIONS

All options are written in lowercase. Words written in all capital in
the description here is text provided by the user.

=head2 Options for help and documentation

=head3 --h

Brief documentation of  I<--help*>  options/commands.

=head3 --help

Complete user documentation.

=head3 --help*

=head3 --help=cmds

Show available commands; short form.

=head3 --help=commands

Show available commands with short description.

=head3 --help=opt

Show available options; short form.

=head3 --help=options

Show available options with their description.

=head3 --help=checks

Show available checks.

=head3 --help=tools

Description of tools around O-Saft, when, where and how to use.

=head3 --help=cmd

Show additional and user specified commands.

=head3 --help=cfg-cmd

Show additional and user specified commands.  Output can be used in
rc-file or as option.

=head3 --help=check-cfg

=head3 --help=cfg-check

Show texts used as labels in output for checks (see  I<+check>)  ready
for use in rc-file or as option.

=head3 --help=data

Show available information.

=head3 --help=data-cfg

=head3 --help=cfg-data

=head3 --help=cfg-info

Show texts used  as labels in output for  data  (see  I<+info>)  ready
for use in rc-file or as option.

=head3 --help=hint

Show texts used in hint messages.

=head3 --help=hint-cfg

=head3 --help=cfg-hint

Show texts used in hint messages ready for use in the rc-file or as
option.

=head3 --help=text

Show texts used in various messages.

=head3 --help=text-cfg

=head3 --help=cfg-text

Show texts used in various messages ready for use in the rc-file or
as option.

=head3 --help=legacy

Show possible legacy formats (used as value in  I<--legacy=TOOL >).

=head3 --help=compliance

Show available compliance checks.

=head3 --help=intern

Show internal commands.

=head3 --help=alias

Show alias for commands and options.

=head3 --help=pattern

Show list of cipher pattern (used for  I<--cipher=CIPHER>).

=head3 --help=range

Show list of cipherranges (see  I<--cipherrange=RANGE>).

=head3 --help=toc

=head3 --help=content

Show headlines from help text. Useful to get an overview.

=head3 --help=SECTION

Show  C<SECTION>  from documentation, see  I<--help=toc>  for a list.
Example:

	o-saft.pl --help=EXAMPLES

=head3 --help=ourstr

Show regular expressions to match our own strings used in output.

=head3 --help=regex

Show regular expressions used internally.

=head3 --help=gen-html

Print documentation in HTML format.

=head3 --help=gen-pod

Print documentation in POD format.

=head3 --help=gen-wiki

Print documentation in mediawiki format.

=head3 --help=gen-cgi

Print HTML form to be used for CGI.

=head3 --help=error

=head3 --help=problem

Show  L</KNOWN PROBLEMS>  section with  description of known  error and
warning messages.

=head3 --help=faq

Show  L</KNOWN PROBLEMS>  and  L</LIMITATIONS>  section.

=head3 --help=glossary

Show common abbreviation used in the world of security.

=head3 --help=links

Show list of URLs related to SSL/TLS.

=head3 --help=rfc

Show list of RFC related to SSL/TLS.

=head3 --help=todo

Show known problems and bugs.

=head3 --help=exit

Show possible  I<--exit=KEY>  options. Used for debugging only.

=head3 --help=warnings

Show warning messages defined in code.

=head3 --help=program.code

For developers.

=head2 Options for all commands (general)

=head3 --dns

Do DNS lookups to map given hostname to IP, do a reverse lookup.

=head3 --no-dns

Do not make DNS lookups.
Note  that the corresponding IP and reverse hostname may be missing
in some messages then.

=head3 --host=HOST

Specify HOST as target to be checked. Legacy option.

=head3 --port=PORT

Specify PORT of target to be used. Legacy option.

=head3 --host=HOST --port=PORT HOST:PORT HOST

When giving more than one HOST argument,  the sequence of the given
HOST argument and the given  I<--port=PORT> and the given  I<--host=HOST>
options are important.
The rule how ports and hosts are mapped is as follows:

=over

=item * HOST:PORT arguments are used as is (connection to HOST on PORT)

=back

=over

=item * only HOST is given, then previous specified PORT is used

=back

Note that URLs are treated as HOST:PORT, if they contain a port.
Example:

	o-saft.pl +cmd host-1 --port 23 host-2 host-3:42 host-4

will connect to:

=over

=item * host-1:443

=back

=over

=item * host-2:23

=back

=over

=item * host-3:42

=back

=over

=item * host-4:23

=back

=head3 --proxyhost=PROXYHOST --proxy=PROXYHOST:PROXYPORT

Make all connection to target using PROXYHOST.

Also possible is: I<--proxy=PROXYUSER:PROXYPASS@PROXYHOST:PROXYPORT>

=head3 --proxyport=PROXYPORT

Make all connection to target using PROXYHOST:PROXYPORT.

=head3 --proxyuser=PROXYUSER

Specify username for proxy authentication.

=head3 --proxypass=PROXYPASS

Specify password for proxy authentication.

=head3 --starttls

Use C<STARTTLS> command to start a TLS connection via SMTP.
This option is a shortcut for  I<--starttls=SMTP> .

=head3 --starttls=SMTP

=head3 --starttls=PROT

Use C<STARTTLS> command to start a TLS connection via protocol.
C<PROT> may be any of:  C<SMTP>, C<IMAP>, C<IMAP2>, C<POP3>, C<FTPS>,
C<RDP>, C<LDAP> or C<XMPP> .

For  I<--starttls=SMTP>  see  I<--dns-mx>  also to use MX records instead
of host

=head3 --starttls-delay=SEC

Number of seconds to wait before sending a packet, to slow down the
C<STARTTLS> requests. Default is 0.
This may prevent blocking of requests by the target due to too much
or too fast connections.
Note:  In this case there is an automatic suspension and retry with
a longer delay.

=head3 --cgi

=head3 --cgi-exec

Internal use for CGI mode only.

=head2 Options for SSL tool

=head3 --rc

Read rc-file if exists, from directory where program was found.

=head3 --no-rc

Do not read rc-file.

=head3 --rc=FILE

Use FILE instead of the default rc-file C<.o-saft.pl>.

=head3 --exitcode

The exit status code will be greater 0, if any of following applies:

=over

=item * any check returns  C<no>, except if  C<no (<<...>>)>

=back

=over

=item * insecure protocols are available

=back

=over

=item * insecure ciphers are supported

=back

=over

=item * ciphers without PFS are supported, disable with  --exitcode-cipher

=back

In particular, the status code will be the total count of all these
checks. The status code will also be printed at end, like:

	# EXIT 23

Parts of these checks can be diasabled,  see  I<--exitcode-*>  options
below.

Use  I<--v> or I<--exitcode-v>  to see details about the performed checks.

Functionality implemented experimental, may change in future.

=head3 --exitcode-v

Print information about performed checks.

=head3 --exitcode-quiet

Do not print status code at end, like C<# EXIT 23>.

=head3 --exitcode-no-checks

Do not count checks with result C<no> for  I<--exitcode> .

=head3 --exitcode-no-low  --exitcode-no-weak  --exitcode-no-medium

Do not count LOW, WEAK or MEDIUM security ciphers for  I<--exitcode> .

=head3 --exitcode-no-ciphers

Do not count any ciphers for  I<--exitcode> .

=head3 --exitcode-no-pfs

Do not count ciphers without PFS for  I<--exitcode> .

=head3 --openssl-s_client --s_client

Use  "openssl s_slient ..."  call to retrieve more information from
the SSL connection.  This is disabled by default on Windows because
of performance problems. Without this option (default on Windows !)
following information are missing:

	compression, expansion, renegotiation, resumption,
	selfsigned, verify, chain, protocols, DH parameters

See  lib/SSLinfo  for details.

If used together with  I<--trace>, s_client  data will also be printed
in debug output of  lib/SSLinfo.

=head3 --no-openssl

Do not use external "openssl"  tool to retrieve information. Use of
"openssl" is disabled by default on Windows.
Note that this results in some missing information, see above.

=head3 --openssl=TOOL

C<TOOL>        can be a path to openssl executable; default: openssl

=head3 --openssl-cnf=FILE --openssl-conf=FILE

C<FILE>        path of directory or full path of openssl.cnf

If set, environment variable OPENSSL_CONF will be set to given path
(or file) when L<openssl(1)|openssl(1)> is started. Please see openssl's man page
for details about specifying alternate  openssl.cnf  files.

=head3 --openssl-ciphers --force-openssl

Options are obsolete. Please use  I<--ciphermode=openssl>  instead.

Use openssl to check for supported ciphers; default: L<IO::Socket(3pm)|IO::Socket(3pm)>

This option forces to use  "openssl s_slient -connect CIPHER .." to
check if a cipher is supported by the remote target. This is useful
if the  I<--lib=PATH>  option doesn't work (for example due to changes
of the API or other incompatibilities).

=head3 --exe-path=PATH

=head3 --exe=PATH

C<PATH>        is a full path where to find openssl.

=head3 --lib-path=PATH

=head3 --lib=PATH

C<PATH>        is a full path where to find libssl.so, libcrypto.so.

See  HACKER's INFO  below for a detailed description how it works.

=head3 --envlibvar=NAME

C<NAME>  is the name of a environment variable containing additional
paths for searching dynamic shared libraries.
Default is LD_LIBRARY_PATH.

Check your system for the proper name, for example:

	DYLD_LIBRARY_PATH, LIBPATH, RPATH, SHLIB_PATH.

=head3 --inc=PATH

C<PATH>        is a full path where to find additional Perl modules

This option is not avaliable as "--inc PATH".

=head3 --no-inc=REGEX

C<REGEX>       all paths matching this RegEx are removed from @INC

This option is not avaliable as "--no-inc REGEX".
See  HACKER's INFO  below for a detailed description.

=head3 --ssl-error

The connection to  a target may fail, or even block, due to various
reasons for example lost network at all, blocking at firewall, etc.
In particular when checking ciphers with  I<+cipher> , this may result
in long delays until results are printed.
Using this option stops trying to do more connections to the target
when  I<--ssl-error-max=CNT>  consecutive errors occoured, or when the
total amount of errors increases  I<--ssl-error-total=CNT>.

Note that this may result in loss of information and/or checks.

=head3 --ssl-error-max=CNT

Max. amount of consecutive errors (default: 5).

=head3 --ssl-error-timeout=SEC

Timeout in seconds when a failed connection is treated as error and
then counted (default: 1).

=head3 --ssl-error-total=CNT

Max. total amount of errors (default: 10).

=head3 --ssl-lazy

I.g. this tools tries to identify available functionality according
SSL versions from the underlaying libraries.  Unsupported  versions
are then disables and a warning is shown.
Unfortunately some libraries have  not implemented all functions to
check availability of a specific SSL version, which then results in
a compile error.

This option disables the strict check of availability.
If the underlaying library doesn't support the required SSL version
at all, following error may occour:

	Can't locate auto/Net/SSLeay/CTX_v2_new.al in @INC ...

See L</Note on SSL versions>  for a general note about SSL versions.
A more detailled description of the problem and how Net::SSLeay be-
haves, can be found in the source of  o-saft.pl ,
see section starting at

	#| check for supported SSL versions

=head3 --timeout=SEC

Timeout in seconds when connecting to the target (default: 2).

=head3 --call=METHOD

C<METHOD>      method to be used for specific functionality

Available methods:

=over

=item * C<info-socket>    - use internal socket to retrieve information

=back

=over

=item * C<info-openssl>   - use external openssl to retrieve information

=back

=over

=item * C<info-user>      - use usr_getinfo() to retrieve information

=back

=over

=item * C<cipher-socket>  - use internal socket to ckeck for ciphers

=back

=over

=item * C<cipher-openssl> - use external openssl to ckeck for ciphers

=back

=over

=item * C<cipher-user>    - use usr_getciphers() to ckeck for ciphers

=back

Method names starting with:

=over

=item * C<info->

=back

are responsible to retrieve information  about the SSL connection
and the target certificate (i.e. what the I<+info> command provides)

=over

=item * C<cipher->

=back

are responsible to connect to the target  and test if it supports
the specified ciphers  (i.e. what the  I<+cipher>  command provides)

=over

=item * C<check->

=back

are responsible for performing the checks (i.e. what's shown with
the  I<+check>  command)

=over

=item * C<score->

=back

are responsible to compute  the score based on check results

The second part of the name denotes which kind of method to call:

=over

=item * C<socket>      - the internal functionality with sockets is used

=back

=over

=item * C<openssl>     - the exteranl openssl executable is used

=back

=over

=item * C<user>        - the external special function,  as specified in

=back

                 user's  lib/OUsr.pm,  is used.

Example:

	--call=cipher-openssl

will use the external L<openssl(1)|openssl(1)> executable to check the target for
supported ciphers.

Default settings are:

	--call=info-socket --call=cipher-socket --call=check-socket

Just for curiosity, instead of using:

	o-saft.pl --call=info-user --call=cipher-user --call=check-user --call=score-user ...

consider to use your own script like:

	#!/usr/bin/env perl
	usr_getinfo();usr_getciphers();usr_checkciphers();usr_score();

:-))

=head3 -v

Print list of ciphers in style like: "openssl ciphers -v".
Option used with  I<+ciphers>  command only.

=head3 -V

Print list of ciphers in style like: "openssl ciphers -V".
Option used with  I<+ciphers>  command only.

=head2 Options for SSL connection to target

=head3 --ciphermode=intern

=head3 --ciphermode=openssl

=head3 --ciphermode=ssleay

=head3 --ciphermode=MODE

Following C<MODE>s are supported:

=over

=item * C<intern>    - scan for ciphers using internal method; (default)

=back

=over

=item * C<openssl>   - scan for ciphers using external openssl executable

=back

=over

=item * C<ssleay>    - scan for ciphers using  IO::Socket and  Net::SSLeay

=back

=over

=item * C<dump>      - same as C<intern> but print  all cipher information,

=back

             useful when postprocessed by usr/* tools

=head3 --socket-reuse

TCP socket will be reused for  next connection attempt  even if SSL
connection failed.

=head3 --no-socket-reuse

Close TCP socket and then reopen for next connection attempt if SSL
connection failed.

This is useful for some servers which may return an "TLS alert"  if
the connection fails and then fail again on the same socket.

=head3 --ignore-no-connect

A simple check if the target can be connected  will be performed by
default.  If this check fails, the target will be ignored, means no
more requested checks will be done.  As this connection check some-
times fails due to various reasons, the check can be disabled using
this option.

=head3 --no-md5-cipher

Do not use *-MD5 ciphers for other protocols than SSLv2.
This option is only effective with  I<+cipher>  command.

The purpose is to avoid warnings from L<IO::Socket::SSL(3pm)|IO::Socket::SSL(3pm)> like:

	Use of uninitialized value in subroutine entry at lib/IO/Socket/SSL.pm line 430.

which occours with some versions of L<IO::Socket::SSL(3pm)|IO::Socket::SSL(3pm)> when a
*-MD5  ciphers will be used with other protocols than SSLv2.

Note that these ciphers will be checked for SSLv2 only.

=head3 --sslv2

=head3 --sslv3

=head3 --tlsv1

=head3 --tlsv11

=head3 --tlsv12

=head3 --tlsv13

=head3 --dtlsv09

=head3 --dtlsv1

=head3 --dtlsv11

=head3 --dtlsv12

=head3 --dtlsv13

=head3 --SSL, --protocol SSL

=head3 --no-sslv2

=head3 --no-sslv3

=head3 --no-tlsv1

=head3 --no-tlsv11

=head3 --no-tlsv12

=head3 --no-tlsv13

=head3 --no-dtlsv09

=head3 --no-dtlsv1

=head3 --no-dtlsv11

=head3 --no-dtlsv12

=head3 --no-dtlsv13

=head3 --no-SSL

=over

=item * C<SSL>       can be any of:

=back

ssl, ssl2, ssl3, sslv2, sslv3, tls1, tls1, tls11, tls1.1, tls1-1,
tlsv1, tlsv11, tlsv1.1, tlsv1-1 (and similar variants for tlsv1.2
and tlsv1.3), dtls1, dtls12, dtls13.
For example:  I<--tls1>  I<--tlsv1>  I<--tlsv1_1>  are all the same.

(--SSL variants):    Test ciphers for this SSL/TLS version.
(--no-SSL variants): Don't test ciphers for this SSL/TLS version.

=head3 --no-tcp

=head3 --no-tls

Shortcut for:
I<--no-sslv2> I<--no-sslv3> I<--no-tlsv1> I<--no-tlsv11> I<--no-tlsv12> I<--no-tlsv13>

=head3 --tcp

=head3 --tls

Shortcut for:  I<--sslv2> I<--sslv3> I<--tlsv1> I<--tlsv11> I<--tlsv12> I<--tlsv13>

=head3 --no-udp

=head3 --no-dtls

Shortcut for:
I<--no-dtlsv09> I<--no-dtlsv1> I<--no-dtlsv11> I<--no-dtlsv12> I<--no-dtlsv13>

=head3 --udp

=head3 --dtls

Shortcut for:  I<--dtlsv09> I<--dtlsv1> I<--dtlsv11> I<--dtlsv12> I<--dtlsv13>

=head3 --nullsslv2

This option  forces  to assume that  SSLv2  is enabled  even if the
target does not accept any ciphers.

The target server may accept connections with  SSLv2  but not allow
any cipher. Some checks verify if  SSLv2  is enabled at all,  which
then would result in a failed test.
The default behaviour is to assume that  SSLv2 is not enabled if no
ciphers are accepted.

=head3 --http

Make a HTTP request if cipher is supported.

If used twice debugging will be enabled using  environment variable
C<HTTPS_DEBUG>.

=head3 --no-http

Do not make HTTP request.

=head3 --http-user-agent=UA

Use C<UA> for HTTP header "User-Agent:" in HTTP(s) requests.

=head3 --sni

Make SSL connection in SNI mode.

=head3 --no-sni

Do not make SSL connection in SNI mode (default: SNI mode).

=head3 --sni-toggle

=head3 --toggle-sni

Test with and witout SNI mode.

=head3 --force-sni

Do not check if SNI seems to be supported by L<Net::SSLeay(3pm)|Net::SSLeay(3pm)>.
Older versions of openssl and its libries do not support SNI or the
SNI support is implemented buggy. By default it's checked if SNI is
properly supported. With this option this check can be disabled.

Be warned that this may result in improper results.

=head3 --servername=NAME

=head3 --sni-name=NAME

If SNI mode is active, see  I<--sni>  above, C<NAME> is used instead of
hostname for connections to the target.  If SNI mode is not active,
see  I<--no-sni>  above, C<NAME> is not used. The default is undefined,
which forces to use the given FQDN.

This is useful, for example when an IP instead of a FQDN was given,
where a correct hostname (i.g. a FQDN) needs to be specified.

Note: i.g. there is no need to use this option,  as a correct value
for the SNI name will be choosen automatically (except for IPs).
However, it is kind of fuzzing ... even setting to an  empty string
is possible.

Limitation:  the same C<NAME> is used for all targets,  if more than
one target was specified.

=head3 --no-cert

Do not get data from target's certificate, return empty string.

=head3 --no-cert --no-cert

Do not get data from  target's certificate,  return  default string
of lib/SSLinfo (see  I<--no-cert-text=TEXT>  option).

=head3 --no-cert-text=TEXT

Set C<TEXT> to be returned from  lib/SSLinfo  if no certificate data
is collected due to use of  I<--no-cert>.

=head3 --ca-depth=INT

Check certificate chain to depth C<INT> (like openssl's -verify).

=head3 --ca-file=FILE

Use C<FILE> with bundle of CAs to verify target's certificate chain.

=head3 --ca-path=DIR

Use C<DIR> where to find CA certificates in PEM format.

=head3 --ca-force

=head3 --force-ca

B<NOT YET IMPLEMENTED>
I. g. openssl uses default settings where to find certificate files.
When  I<--ca-file=FILE>  and/or  I<--ca-path=DIR>  was used,  this default
will be overwritten by appropriate options passed to openssl. If the
default does not work as expected,  I<--force-ca>  can be used to force
setting of proper values according well known common defaults. See:

	o-saft.pl +version
	o-saft.pl +version --force-ca

to see the used settings.

=head3 --alpn

Use  -alpn  option for openssl.

=head3 --no-alpn

Do not use  -alpn  option for openssl.

=head3 --no-npn

=head3 --no-nextprotoneg

Do not use  -nextprotoneg  option for openssl.

=head3 --proto-alpn=NAME

Name of protocol to be added to list of  applcation layer protocols
(ALPN), which is used for any connection to the targets.
See  I<--cipher-alpn=NAME>  also.

=head3 --proto-npn=NAME

Name of protocol to be added to list of  next protocol negotiations
(NPN), which is used for any connection to the targets.
See  I<--cipher-npn=NAME>  also.

=head3 --ssl-compression --compression

Use SSL option "compression" for connection.

=head3 --no-ssl-compression --no-compression

Use SSL option "no compression" for connection (default: don't use)

=head3 --no-reconnect

Do not use  -reconnect  option for openssl.

=head3 --no-tlsextdebug

Do not use  -tlsextdebug  option for openssl.

=head3 --sclient-opt=VALUE

Argument or option passed to openssl's  s_client  command.

=head2 Options for  +cipher  command

=head3 --connect-delay=SEC

Additional delay in seconds  after each connect for a cipher check.
This is useful when connecting to servers which have IPS in place,
or are slow in accepting new connections or requests.

=head3 --cipher=CIPHER

Only check for C<CIPHER> instead of using ciphers from internal list
(default). Multiple options can be specified.

C<CIPHER> can be any cipher suite name or (internal) hex key, see:

	o-saft.pl +list

for known, valid keys and cipher names.

C<CIPHER> can also be any of the internal defined patterns, see:

	o-saft.pl --header --help=cipherpattern

If C<CIPHER> does not match a hex key, i.e. C<0x03000035>, it is used
as pattern (RegEx) to match cipher suite names. For example:
C<AES256-SHA> matches 28 cipher suites,  while C<AES256-SHA$> matches
14 ciphers, see:

	lib/Ciphers.pm find-names=AES256-SHA
	lib/Ciphers.pm find-names=AES256-SHA$

To be sure that exactly one cipher suite matches, use for example:

	--cipher=^AES256-SHA$
	--cipher=0x03000035

Hex keys must be specified with a leading C<0x>  followed by exactly
8 uper case hex characters C<[0-9A-F]>.

The pattern can be common RegEx like C<GCM|CHACHA>.  Simple OpenSSL-
style pattern are also accepted, for example: C<AES:ECDH>.

When  I<--ciphermode=openssl> or I<--ciphermode=ssleay> is used, C<CIPHER>
can only be any string or a hex key accepted by openssl. Examples:

=over

=item * --cipher=DHE_DSS_WITH_RC4_128_SHA

=back

=over

=item * --cipher=0x03000066

=back

will be mapped to  C<DHE-DSS-RC4-SHA>

C<CIPHER> can also be any pattern accepted by openssl, for example:

=over

=item * --cipher=C<!DES:!ADH:!aNULL>

=back

Default is C<ALL:NULL:eNULL:aNULL:LOW:EXP> as specified in lib/SSLinfo.

See  L</LIMITATIONS>  also.

=head3 --cipher-alpn=NAME

Name of protocol to be added to list of  applcation layer protocols
(ALPN), which is used for cipher checks.

=over

=item * --cipher-alpn=,     - sets empty list.

=back

=over

=item * --cipher-alpn=,,    - sets list to empty element "".

=back

=head3 --cipher-npn=NAME

Name of protocol to be added to list of  next protocol negotiations
(NPN), which is used for cipher checks.

=over

=item * --cipher-npn=,      - sets empty list.

=back

=over

=item * --cipher-npn=,,     - sets list to empty element "".

=back

Note:  setting empty list or element most likely does not work with
openssl executable (for example  I<--force-openssl>).

=head3 --cipher-curve=NAME

Name of ecliptic curve to be added to list of ecliptic curves (EC),
which is used for cipher checks.

=over

=item * --cipher-curve=,    - sets empty list.

=back

=over

=item * --cipher-curve=,,   - sets list to empty element "".

=back

Note:  setting empty list or element most likely does not work with
openssl executable (for example  I<--force-openssl>).

=head3 --range=RANGE

=head3 --cipherrange=RANGE

Specify range of cipher constants to be tested with  I<+cipher>  .
Following C<RANGE>s are supported:

=over

=item * C<rfc>             - all ciphers defined in various RFCs; default

=back

=over

=item * C<shifted>         - C<rfc> + some shifted by 64 bytes to the right

=back

=over

=item * C<intern>          - C<rfc> + C<shifted>

=back

=over

=item * C<long>            - like C<rfc> but more lazy list of constants

=back

=over

=item * C<huge>            - all constants  0x03000000 .. 0x0300FFFF

=back

=over

=item * C<safe>            - all constants  0x03000000 .. 0x032FFFFF

=back

=over

=item * C<full>            - all constants  0x03000000 .. 0x03FFFFFF

=back

=over

=item * C<SSLv2>           - all ciphers according RFC for SSLv2

=back

=over

=item * C<SSLv2_long>      - more lazy list of constants for SSLv2

=back

=over

=item * C<SSLv3>           - all ciphers according RFC for SSLv3

=back

=over

=item * C<SSLv3_SSLv2>     - all ciphers for SSLv3 with SSLv2

=back

=over

=item * C<TLSv12>          - all ciphers according RFC for TLSv12

=back

=over

=item * C<TLSv13>          - all ciphers according RFC for TLSv13

=back

=over

=item * C<GREASE>          - all GREASE ciphers according RFC

=back

=over

=item * C<c0xx>            - ECC ciphers, constants 0x0300C000 .. 0x0300C0FF

=back

=over

=item * C<ccxx>            - ECC ciphers, constants 0x0300CC00 .. 0x0300CCFF

=back

=over

=item * C<ecc>             - all constants for ciphers using ECC

=back

Note: C<SSLv2> is the internal list used for testing SSLv2 ciphers.
It does not make sense to use it for other protocols; however ...

For the full list and details about the ranges, please see:

	o-saft.pl --header --help=range

If any  I<--cipher=CIPHER>  is used,  I<--cipherrange=RANGE>  is ignored.
See  L</LIMITATIONS>  also.

=head3 --slow-server-delay=SEC

Additional delay in seconds  after the server is connected  using a
proxy or before starting C<STARTTLS>.
This is useful when connecting via  slow proxy chains or connecting
to slow servers before sending the C<STARTTLS> sequence.

=head3 --ssl-maxciphers=CNT

Maximal number of ciphers sent in a sslhello (default: 32).

=head3 --ssl-double-reneg

Send SSL extension  C<reneg_info>  even if list of ciphers includes
C<TLS_EMPTY_RENEGOTIATION_INFO_SCSV> (default: do not include)

=head3 --ssl-nodata-nocipher

Some servers do not answer  (i.g. they disconnect) if  none of  the
offered ciphers is supported by the server.

Continue testing with next ciphers  when the target  disconnects or
does not send data within specified timeout (see  I<--timeout>).
Useful for TLS intolerant servers.

=head3 --no-ssl-nodata-nocipher

Abort testing with next ciphers when the target disconnects.

=head3 --ssl-use-ecc

Use supported elliptic curves.  Default on.

=head3 --ssl-use-ec-point

Use TLS C<ec_point_formats> extension.  Default on.

=head3 --ssl-use-reneg

Test for ciphers with "secure renegotiation" flag set.
Default: don't set "secure renegotiation" flag.

=head3 --ssl-retry=CNT

Number of retries when connection timed-out (default: 2).

=head3 --ssl-timeout=SEC

Number of seconds to wait until connection is qualified as timeout.

=head3 --dns-mx

=head3 --mx

Get DNS MX records for given target and check the returned targets.
(only useful with  I<--starttls=SMTP>).

=head2 Options for checks and results

Options used for  I<+check>  command:

=head3 --enabled

Only print result for ciphers accepted by target.

=head3 --disabled

Only print result for ciphers not accepted by target.

=head3 --https_body

Prints HTTP response body of the target also, if requested with
I<+https_body>  , which is disabled by default (because it may be huge
amount of data not related to SSL/TLS).

=head3 --ignorecase

Checks are done case-insensitive.

=head3 --no-ignorecase

Checks are done case-sensitive. Default: case-insensitive.
Currently only checks according CN, alternate names in the target's
certificate compared to the given hostname are effected.

=head3 --ignore-no-reply

When checking for the TLS "heartbeat" extension, the server may not
respond at all, which would result in a  "no reply"  message.  This
marks the check for  I<+heartbleed>  as C<no>.
I.g.  a server is  not vulnerable to the  heartbleed attack  if the
TLS "heartbeat" extension is disabled. Hence the check result  C<no>
may be mis-leading.  This option  treats the  "no reply"  result as
"not vulnerable" and returns  C<yes>  then.

Note: if the server does not respond for this check,  does not mean
that the "heartbeat" extension is switched off.  If unsure, disable
this lazy check with  I<--no-ignore-no-reply> .

=head2 Options for output format

=head3 --label=TYPE

Defines the format of the descriptive text (label) for  I<+check>  and
I<+info>  command.

Following C<TYPE>s are supported:

=head3 --label=long

Prints full text for labels:

	Certificate Common Name:  some.tld

=head3 --label=short

Prints short less descriptive text for labels:

	Common Name:              some.tld

=head3 --label=key

Internal format: print name of key instead of text as label. Key is
Prints name of key instead of text as label. The key is that of the
internal data structure(s).

	[cn]                      some.tld

For ciphers and protocols, the corresponding  hex value  is used as
key. Note that these values are unique.

=head3 --legacy=*

=head3 --legacy=TOOL

For compatibility with other tools,  the output format used for the
result of the  I<+cipher>  command can be adjusted to mimic the format
of other SSL testing tools.

The argument to the  I<--legacy=TOOL >  option  is the name of the tool
who's format of output is to be simulated.

Following C<TOOL>s are supported:

=over

=item * C<sslaudit>          - similar to  sslaudit

=back

=over

=item * C<sslcipher>         - similar to  ssl-cipher-check

=back

=over

=item * C<ssldiagnos>        - similar to  ssldiagnos

=back

=over

=item * C<sslscan>           - similar to  sslscan

=back

=over

=item * C<ssltest>           - similar to  ssltest

=back

=over

=item * C<ssltestg>          - similar to  ssltest -g

=back

=over

=item * C<ssltest-g>         - similar to  ssltest -g

=back

=over

=item * C<sslyze>            - similar to  sslyze

=back

=over

=item * C<ssl-cipher-check>  - same as sslcipher

=back

=over

=item * C<ssl-cert-check>    - similar to  ssl-cert-check

=back

=over

=item * C<testsslserver>     - similar to  TestSSLServer.jar

=back

=over

=item * C<thcsslcHeck>       - similar to  THCSSLCheck

=back

Note that these legacy formats only apply to  output of the checked
ciphers. Other texts like headers and footers are adapted slightly.

When using ths option, please do not expect identical output as the
C<TOOL>. It is a best guess and should be parsable in a very similar
way.

=head3 --legacy=TYPE

=head3 --legacy=compact

Internal format: mainly avoid tabs and spaces format is as follows:

	Some Label:<-- anything right of colon is data

=head3 --legacy=full

Internal format: pretty print each label in its own line,  followed
by data prepended by tab character (useful for  I<+info>  only).

=head3 --legacy=owasp

Results for cipher checks use rating from OWASP Cipher Cheat Sheet.

=head3 --legacy=quick

Internal format: use tab as separator; ciphers are printed with bit
length (implies  I<--tab>).

=head3 --legacy=simple

Internal default format.

=head3 --format=0x

=head3 --format=\x

=head3 --format=/x

=head3 --format=hex

=head3 --format=raw

This option is used to specify the format of the result lines. This
covers the value of the result line only.

=over

=item * C<raw>       - Print raw data as passed from  lib/SSLinfo.

=back

Note:  all data will be printed as is,  without  additional label
or formatting. It's recommended to use the  option in conjunction
with exactly one command.  Otherwise the user needs  to know  how
to "read" the printed data.

=over

=item * C<hex>       - Convert some data to hex: 2 bytes separated by C<:>.

=back

=over

=item * C<0x>        - Convert some data with hex values:

=back

             2 bytes prepended by C<0x> and separated by a space.

=over

=item * C</x>        - Same as  --format=\x

=back

=over

=item * C<\x>        - Convert some data with hex values:

=back

             2 bytes prepended by C<\x> and no separating char.

=head3 --tty

=head3 --format-tty

Get the screen width and then adapt  output of documentation to fit
to that width. If the environment variable C<COLUMNS> is not set the
command C<tput> or C<stty> of system is used to get the screen width.

It's a very simple approach to make texts better readable on narrow
devices like tablets. For more details, please see:

	perdoc o-saft.pl   # the section Note:tty  there

=head3 --format-width=NN

Set the screen width to C<NN> characters (see  I<--format-tty>  also).
Default will be calculated automatically.

=head3 --format-ident=NN

Set the amount of spaces used for identation (see  I<--tty>  also).
Default is 2.

=head3 --format-arrow=CHR

Set the additional chacacter when lines are split. Default: ↲

=head3 --header

Print formatting header.  Default for  I<+check>,  I<+info>,  I<+quick>  and
and  I<+cipher>  only.

=head3 --no-header

Do not print formatting header.
Usefull if raw output should be passed to other programs.

Note: must be used on command-line to inhibit all header lines.

=head3 --ignore-cmd=CMD

=head3 --ignore-output=CMD

=head3 --no-cmd=CMD

=head3 --no-output=CMD

Do not print output (data or check result) for command C<CMD>. C<CMD>
is any valid command, see  L</COMMANDS> ,  without leading C<+>.
Option can be used multiple times.

I<--ignore-out=>,    sets empty list.

=head3 --score

Print scoring results. Default for  I<+check>.

=head3 --no-score

Do not print scoring results.

=head3 --separator=CHAR

=head3 --sep=CHAR

C<CHAR>    will be used as separator between  label and value of the
       printed results. Default is  C<:>.

=head3 --tab

C<TAB> character (0x09, \t)  will be used as separator between label
and value of the printed results.
As label and value are already separated by a  TAB  character, this
options is only useful in conjunction with the  I<--legacy=compact>
option.

=head3 --showhost

Prefix each printed line with the given hostname (target).
The hostname will be followed by the separator character.

=head3 --std-format=*

=head3 --std-format=utf8

=head3 --std-format=crlf

=head3 --std-format=raw

=head3 --std-format=unix

=head3 --std-format=CHARSET

This option is used to specify the general output format for STDOUT
and STDERR. All results are written to STDOUT,  errors and warnings
may also be written to STDERR .  The default is C<:unix:utf8>, which
is the perlish definition used internally.

Following values are supported:

=over

=item * C<raw>

=back

=over

=item * C<unix>      - Print raw data, binary in bytes without conversion.

=back

Note:  binary here just means characters (as all output is text).

=over

=item * C<utf8>      - Convert all characters to UTF-8.

=back

=over

=item * C<crlf>      - Use CR LF as end of line.

=back

=over

=item * C<CHARSET>   - can be any of the local installed  character sets,

=back

             like UTF-8, UTF-16LE, CP1252, iso-8859-7, etc..
             This conversion may print its own warnings.

The option can be used multiple times with different values.
To reset the  default behaviour, either  C<raw>  or  C<unix>  must be
used. Obviously, they must be used first. All other values are used
additionally.
Note:  C<utf8> just defines the format of the characters, it does no
further checks on the converted characters. In contrast, C<UTF-8> is
used as real encoding and does some checks.

For more details, please see  "perldoc -f binmode" .

Currently (Jan. 2018), these options must be used before any I<--help>
option.

=head3 --win-CR

Obsolete, please use  I<--std-format=crlf> .

=head2 Options for compatibility with other programs

Please see other programs for detailed description (if not obvious:).
Note that often only the long form options are accepted as most short
form options are ambiguous.
If other programs use the same option,but with a different behaviour,
then thes other options are not supported.
For a list of supported options, please see:

	o-saft.pl --help=alias

Following list contains only those options not shown with:

	o-saft.pl --help=alias

# Tool's Option         | (Tool)          o-saft.pl Option
#-----------------------+--------------+------------------------

=over

=item * --checks CMD          | (TLS-Check.pl)  same as  +CMD

=back

=over

=item * -h, -h=HOST           | (various tools) same as  --host HOST

=back

=over

=item * -p, -p=PORT           | (various tools) same as  --port PORT

=back

=over

=item * -t HOST               | (ssldiagnos)    same as  --host HOST

=back

=over

=item * --UDP                 | (ssldiagnos)    same as  --udp

=back

=over

=item * --timeout, --grep     | (ssltest.pl)    ignored

=back

=over

=item * -r,  -s,  -t,  -x     | (ssltest.pl)    ignored

=back

=over

=item * --insecure            | (cnark.pl)      ignored

=back

=over

=item * --nopct --nocolor     | (ssldiagnos)    ignored

=back

=over

=item * -connect, -H, -u, -url, -U            ignored

=back

=over

=item * -noSSL                |                 same as  --no-SSL

=back

=over

=item * -no_SSL               |                 same as  --no-SSL

=back

#-----------------------+--------------+------------------------

For definition of  C<SSL>  see  I<--SSL >  and  I<--no-SSL >  above.

=head2 Options for customisation

=head3 --cfg-CFG

Option for customisation have the general from:  I<--cfg-CFG=KEY=TEXT>
For general descriptions please see  L</CUSTOMISATION>  section below.

=head3 --cfg-cmd=CMD=LIST

Redefine list of commands. Sets  C<%cfg{cmd-CMD}>  to  C<LIST>.
Commands can be written without the leading  C<+>.
If  CMD  is any of the known internal commands, it will be redifned.
If  CMD  is a unknown command, it will be created.

Example:

	--cfg-cmd=sni="sni hostname"
An example  I<+preload>  can be found in  C<.o-saft.pl> .

To get a list of commands and their settings, use:

	o-saft.pl --help=intern

Main purpose is to reduce list of commands or to print them sorted.

=head3 --cfg-checks=KEY=TEXT

=head3 --cfg-data=KEY=TEXT

Redefine texts used for labels in output. Sets C<%data{KEY}{txt}>  or
C<%checks{KEY}{txt}>  to  C<TEXT>.

To get a list of preconfigured labels, use:

	o-saft.pl --help=cfg-checks
	o-saft.pl --help=cfg-data

=head3 --cfg-cipher=CIPHER=value

Redefine the security value (i.e. HIGH) in the cipher description.
Example:

	--cfg-cipher=NULL-MD5=no-security-at-all

=head3 --cfg-text=KEY=TEXT

Redefine general texts used in output. Sets C<%text{KEY}>  to  C<TEXT>.

To get a list of preconfigured texts, use:

	o-saft.pl --help=cfg-text

Note that \n, \r and \t are replaced by the corresponding character
when read from rc-file.

=head3 --cfg-text=FILE

Read definitions for  C<%text{KEY}="my text"> from file  C<FILE>.

=head3 --cfg-hint=KEY=TEXT

Redefine texts used for hints. Sets  C<%cfg{hints}{KEY}>  to  C<TEXT>.

To get a list of preconfigured texts, use:

	o-saft.pl --help=cfg-hint

=head3 --cfg-init=KEY=VALUE

Set the internal  C<%cfg> hash. This options is intended for testing
and debugging only. Please see  L</TESTING>  below.

=head3 --call=METHOD

See  L</Options for SSL tool>.

=head3 --usr

=head3 --user

Execute functions defined in  lib/OUsr.pm.

=head3 --usr-*

=head3 --user-*

Options ignored, but stored as is internal in  $cfg{usr-args} .
These options can be used in  lib/OUsr.pm  or  lib/OTrace.pm.

=head3 --experimental

Use experimental functionality.
Some functionality of this tool is  under development and only used
when this option is given.

=head2 Options for tracing and debugging

The terms "trace" and "debug" are used interchangeable herein.  The
functionality enabled by the options described below is more likely
considered "tracing".

=head3 --n

Do not execute, just show commands (only useful in conjunction with
using openssl).

=head3 Difference --trace vs. --v

I<--v>  prints more information what actually is done. I<--trace>  prints
more information about internal data such as procedure names and/or
variable names with their values.

=head3 --v

=head3 --verbose

Print more information about checks.

Note that  I<--v>  is different from  -v  (see above).

=head3 --v-cipher

=head3 --cipher-v

Print each cipher being checked (with  I<--ciphermode=openssl>  only).

=head3 --trace

Print debugging messages, function names, variable names or values.

=head3 --trace --trace

Print more debugging messages and pass C<trace=2> to Net::SSLeay and
lib/SSLinfo.

=head3 --trace --trace --trace

Print more debugging messages and pass C<trace=3> to Net::SSLeay and
lib/SSLinfo.

=head3 --trace --trace --trace --trace

Print processing of all command-line arguments.

=head3 --trace-cli

Print complete command-line first. Used for internal testing.

=head3 --trace-arg

=head3 --trace--

Print command-line argument processing.

=head3 --trace-cmd

Option obsolete since Version 23.11.23. Please use  I<--v>  instead.

=head3 --trace-key

=head3 --trace@

Print some internal variable names in output texts (labels).
Variable names are prefixed to printed line and enclosed in  # .
Example without  I<--trace-key> :

	Certificate Serial Number:          deadbeef

Example with     I<--trace-key> :

	#serial#          Certificate Serial Number:          deadbeef

=head3 --trace-time

Prints trace output with timestamps.

=head3 --trace=VALUE

Alias for  I<--trace-VALUE>  options (see above).

# Trace Option      | Alias Option
#-------------------+-----------------------------

=over

=item * --trace=1         | same as  --trace

=back

=over

=item * --trace=2         | same as  --trace  --trace

=back

=over

=item * --trace=arg       | same as  --trace-arg

=back

=over

=item * --trace=cli       | same as  --trace-cli

=back

=over

=item * --trace=key       | same as  --trace-key

=back

=over

=item * --trace=time      | same as  --trace-time

=back

#-------------------+-----------------------------

=head3 --hint

Print hint messages (!!Hint:).

=head3 --no-hint

Do not print hint messages (!!Hint:).

=head3 --warning

Print warning messages (**WARNING:).

=head3 --no-warning

Do not print warning messages (**WARNING:).

=head3 --warnings-dups

=head3 --no-warnings-no-dups

Do not suppress duplicate warning messages (**WARNING:).
Warning messages not printed multiple times by default: 303 304 412

=head3 --warning-ignore=NNN

=head3 --ignore-warning=NNN

Supress printing of warning messages with number NNN (**WARNING:).
Mainly used for internal testing.

=head3 --quiet

=head3 --silent

Shortcut for:  I<--no-warning> I<--no-hint> .

=head3 --exit=KEY

Terminate  o-saft.pl  at specified C<KEY>. Please see  L</TESTING>  below.

=head2 Options vs. Commands

For compatibility with other programs and lazy users,  some arguments
looking like options are silently taken as commands.  This means that
I<--THIS>  becomes  I<+THIS>  then. These options are:

=over

=item * --help

=back

=over

=item * --abbr

=back

=over

=item * --todo

=back

=over

=item * --chain

=back

=over

=item * --default

=back

=over

=item * --fingerprint

=back

=over

=item * --list

=back

=over

=item * --version

=back

Take care that this behaviour may be removed in future versions as it
conflicts with those options and commands which actually exist, like:

I<--sni>  vs.  I<+sni>

=head1 LAZY SYNOPSIS

=head2 Commands

Following strings are treated as a command instead of target names:

=over

=item * ciphers

=back

=over

=item * s_client

=back

=over

=item * version

=back

A warning will be printed.

=head2 Options

We support following options, which are all identical, for lazy users
and for compatibility with other programs.

=head3 Option variants

=over

=item * --port PORT

=back

=over

=item * --port=PORT

=back

This applies to most such options,  I<--port>  is just an example.  When
used in the rc-file, the  I<--OPTION=VALUE>  variant must be used.

=head3 Option names

Dash C<->, dot C<.> and/or underscore C<_> in option names are optional,
all following are the same:

=over

=item * --no.dns

=back

=over

=item * --no-dns

=back

=over

=item * --no_dns

=back

=over

=item * --nodns

=back

This applies to all such options,  I<--no-dns>  is just an example.

=head2 Targets

Following syntax is supported also:

	o-saft.pl http://some.tld other.tld:3889/some/path?a=b

Note that only the hostname and the port are used from an URL.

=head2 Options vs. Commands

See  L</Options vs. Commands>  in  L</OPTIONS>  section above

=head1 RESULTS

All output is designed to be easily parsed by postprocessors.  Please
see  L</OUTPUT>  section below for details.

For the results,  we have to distinguish  those  returned by  I<+cipher>
command  and those from  all other tests and checks like   I<+check>  or
I<+info>  command.

=head3 +cipher

The cipher checks will return  one line for each  tested cipher. It
contains at least the cipher name,  C<yes>  or  C<no>  whether  it is
supported or not, and a security qualification. It may look like:

	AES256-SHA       yes    HIGH
	NULL-SHA         no     weak

Depending on the used  I<--legacy=*>  option the format may differ and
also contain more information.  For details see  I<--legacy=*>  option
below.

The text for security qualifications are (mainly) those returned by
openssl (version 1.0.1): LOW, MEDIUM, HIGH and WEAK.
The same texts, but with all lower case characters, are used if the
qualification was adapted herein. Following rules for adjusting the
qualification were used:

=over

=item * weak:

=back

=over

=item ** all *NULL* ciphers

=back

=over

=item ** all *RC2* and *RC4* ciphers

=back

=over

=item ** all *EXPORT*  ciphers

=back

=over

=item ** all *anon* (a.k.a ADH a.k.a DHA) ciphers

=back

=over

=item ** all *CBC* and *CBC3* (a.k.a 3DES, EDE-CBC) and DES ciphers

=back

=over

=item * low:

=back

=over

=item * medium:

=back

=over

=item ** all *PSK* ciphers using CBC (assumes that the PSK is secure)

=back

=over

=item * high:

=back

=over

=item ** all *DHE*AES(128|256)* ciphers

=back

=over

=item ** all *CHACHA* ciphers

=back

=over

=item ** all *PSK* ciphers (except those using

=back

=head3 +check

These tests return a line with  a label  describing the test  and a
test result for it. The  idea is to report  C<yes>  if the result is
considered "secure"  otherwise report  C<no>  followed by the reason
why it's considered insecure. Example of a check considered secure:

	Label of the performed check:           yes

Example of a check considered insecure:

	Label of the performed check:           no (reason why)

Note  that there are tests where the results  appear confusing when
first viewed, like for www.wi.ld:

	Certificate is valid according given hostname:  no (*.wi.ld)
	Certificate's wildcard does not match hostname: yes

This can for example occur with:

	Certificate Common Name:                *.wi.ld
	Certificate Subject's Alternate Names:  DNS:www.wi.ld

Please check the result with the  I<+info>  command also to  verify if
the check sounds reasonable.

=head3 +info

The test result contains detailed information. The labels there are
mainly the same as for the  I<+check>  command.

=head1 CHECKS

All SSL related check performed by the tool will be described here.

=head2 General checks

Lookup the IP of the given hostname (FQDN), and then tries to reverse
resolve the FQDN again.

=head2 SSL ciphers

Check which ciphers are supported by target. Please see  L</RESULTS>  for
details of this check.

=head2 SSL connection

=head3 heartbeat

Check if "heartbeat" extension is supported by target.

=head3 poodle

Check if target is vulnerable to POODLE attack (SSLv3 enabled).

=head3 robot

Check if target is vulnerable to ROBOT attack (server offers ciphers
with RSA encryption).

=head3 sloth

Check if target is vulnerable to SLOTH attack  (server offers RSA-MD5
or ECDSA-MD5 ciphers).

=head3 sweet32

Check if target is vulnerable to Sweet32 attack (server offers CBC or
CBC3 or DES or 3DES ciphers).

Note that FIPS-140 compliance requires 3DES ciphers, hence compliant
systems are then vulnerable to Sweet32 attacks.

=head3 ALPN

Check if target supports ALPN. Following messages are evaluated:

	ALPN protocol: h2-14
	No ALPN negotiated

Please see also  L</CHECKS>  ALPN and NPN  below.

=head2 SSL vulnerabilities

=head3 ADH

Check if ciphers for anonymous key exchange are supported: ADH|DHA.
Such key exchanges can be sniffed.

=head3 EDH

Check if ephemeral ciphers are supported: DHE|EDH.
They are necessary to support Perfect Forward Secrecy (PFS).

=head3 BEAST

Check if ciphers with CBC for protocol SSLv1, SSLv3 or TLSv1 are used.
TLSv1.2 checks are not yet implemented.

=head3 CRIME

Connection is vulnerable if target supports SSL-level compression, or
supports SPDY/3 (because SPDY/3 uses compression).
See http://zoompf.com/2012/09/explaining-the-crime-weakness-in-spdy-and-ssl

Note: SPDY/3 is only possible if the client explicitely asks for this
alternate protocol (for example  "openssl ... -nextprotoneg spdy/3").

=head3 DROWN

Connection is vulnerable if target supports SSLv2.

=head3 FREAK

Attack against SSL/TLS to downgrade to EXPORT ciphers.
Currently (2018) a simple check is used:   SSLv3 enabled and EXPORT
ciphers supported by server.
See CVE-2015-0204 and https://freakattack.com/ .

=head3 HEARTBLEED

Check if target is vulnerable to heartbleed attack, see CVE-2014-0160
and http://heartbleed.com/ .

=head3 HEIST

Not implemented.

There are no checks for the HEIST attack implemented, because this is
an attack on TCP/IP rather than SSL/TLS on top of TCP/IP.

=head3 KCI

To perform a MiTM attack with Key Compromise Impersonation, the atta-
cker needs to engage the victim to install and use a client certificate.
This is considered a low risk and hence not tested here.

=head3 Logjam

Check if target is vulenerable to Logjam attack.
Check if target suports  EXPORT ciphers  and/or  DH Parameter is less
than 2048 bits. ECDH must be greater to 511 bits.

=head3 Lucky13

Check if CBC ciphers are offered.
Note the recommendation  to be safe against  Lucky13  was to use  RC4
ciphers. But they are also subject to attacks (see below).  Hence the
check is only for CBC ciphers.

=head3 RC4

Check if RC4 ciphers are supported.
They are assumed to be broken.
Note that  I<+rc4>  reports the vulnerabilitiy to the  RC4 Attack, while
I<+cipher-rc4>  simply reports if  RC4 ciphers are offered.  However the
check, and hence the result, is the same.

=head3 PFS

Check if DHE ciphers are used.  Checks also if the TLS session ticket
is random or not used at all.
TLSv1.2 checks are not yet implemented.

=head3 POODLE

Check if target is vulnerable to  POODLE attack (just check if  SSLv3
is enabled).

=head3 Practical Invalid Curve Attack

This attack allows an attacker to read the servers private key if the
server does not check properly the passed points for a ecliptic curve
when EDH ciphers are used.

This check will not send multiple invalid points,  but only checks if
the server closes the connection or responds with no matching cipher.

=head3 ROBOT

Bleichebacher's Oracle attack against SSL/TLS ciphers.

Not implemented.
https://robotattack.org/

=head3 SLOTH

Currently (2016) we check for ciphers with  ECDSA, RSA-MD5.
Checking the TLS extension C<tls-unique> is not yet implemented.

=head3 Sweet32

Currently (2016) we check for ciphers with CBC or CBC3 or DES or 3DES.

=head3 Ticketbleed

B<NOT YET IMPLEMENTED>
Check if target is vulnerable to ticketbleed, means that it returns
up to 31 random bytes from memory as Session Ticket, see CVE-2016-9244
and https://filippo.io/Ticketbleed/ .

=head2 Target (server) configuration and support

=head3 BEAST, BREACH, CRIME, DROWN, FREAK, Logjam, Lucky13, POODLE, RC4, ROBOT,

=head3 SLOTH, Sweet32

See above.

=head3 Renegotiation

Check if the server allows client-side initiated renegotiation.

=head3 Version rollback attacks

B<NOT YET IMPLEMENTED>
Check if the server allows changing the protocol.

=head3 DH parameter

Check if target's DH Parameter is less 512 or 2048 bits.

=head3 SSTP

Check if target supports SSTP by accepting method SSTP_DUPLEX_POST.

The check does not send other methods (like CONNECT) to verify if the
protocol is fully supported.

Supporting SSTP is considered insecure, because SSTP allows to tunnel
other, probably insecure, protocols.

=head2 Target (server) certificate

=head3 Certificate Hashes

Check that fingerprint is not MD5.
Check that certificate private key signature is SHA2 or better.

=head3 Root CA

Provided certificate by target should not be a Root CA.

=head3 Self-signed certificate

Certificate should not be self-signed.

=head3 FQDN is listed in subjectAltname (RFC2818)

The FQDN must be listed in the certificates subjectAltname.
The check command  I<+rfc_2818_names>  is based on the info command
I<+verify_hostname> . The check was added in 05/2017 because browsers
started to complain if the FQDN is not part of the subjectAltname.

=head3 IP in CommonName or subjectAltname (RFC6125)

B<NOT YET IMPLEMENTED>

=head3 Basic Constraints

Certificate extension Basic Constraints should be CA:FALSE.

=head3 OCSP, CRL, CPS

Certificate should contain URL for OCSP and CRL.

=head3 Private Key encyption

Certificates signature key supports encryption.

=head3 Private Key encyption well known

Certificates signature key encryption algorithm is well known.

=head3 Public Key encyption

Certificates public key supports encryption.

=head3 Public Key encyption well known

Certificates public key encryption algorithm is well known.

=head3 Public Key Modulus Exponent size

The modulus exponent should be = 65537 as it is a prime number and an
easy to calculate exponent.
If the exponent is less than 65537, "Boradcast" attacks are possible.

However, some (mainly historic) SSL implementations may have problems
to connect because they are not able to do the crypt mathematics with
exponenents larger than 65536.

If ecliptic curves are used, the result for these checks is always
C<no (<<N/A ...)>.

=head3 Sizes and Lengths of Certificate Settings

Serial Number <= 20 octets (RFC5280, 4.1.2.2.  Serial Number)

B<...>

=head3 DV-SSL - Domain Validation Certificate

The Certificate must provide:

=over

=item * Common Name C</CN=> field

=back

=over

=item * Common Name C</CN=> in C<subject> or C<subjectAltname> field

=back

=over

=item * Domain name in C<commonName> or C<altname> field

=back

=head3 EV-SSL - Extended Validation Certificate

This check is performed according the requirements defined by the CA/
Browser Forum  https://www.cabforum.org/contents.html .
The certificate must provide:

=over

=item * DV - Domain Validation Certificate (see above)

=back

=over

=item * Organization name C</O=> or C<subject> field

=back

=over

=item * Organization name must be less to 64 characters

=back

=over

=item * Business Category C</businessCategory=> in C<subject> field

=back

=over

=item * Registration Number C</serialNumber=> in C<subject> field

=back

=over

=item * Address of Place of Business in C<subject> field

=back

Required are: C</C=>, C</ST=>, C</L=>

Optional are: C</street=>, C</postalCode=>

=over

=item * Validation period does not exceed 27 month

=back

See  L</LIMITATIONS>  also.

=head2 Target (server) HTTP(S) support

=head3 STS header (see RFC 6797)

Using STS is no perfect security.  While the very first request using
http: is always prone to a MiTM attack, MiTM is possible to following
requests again, if STS is not well implemented on the server.

=over

=item * Request with http: should be redirected to https:

=back

=over

=item * Redirects should use status code 301 (even others will work)

=back

=over

=item * Redirect's Location header must contain schema https:

=back

=over

=item * Redirect's Location header must redirect to same FQDN

=back

=over

=item * Redirect may use Refresh instead of Location header (not RFC6797)

=back

=over

=item * Redirects from HTTP must not contain STS header

=back

=over

=item * Answer from redirected page (HTTPS) must contain STS header

=back

=over

=item * Answer from redirected page for IP must not contain STS header

=back

=over

=item * STS header must contain includeSubDirectoy directive

=back

=over

=item * STS header max-age should be less than 1 month

=back

=over

=item * STS must not be set in http-equiv attribute of a meta TAG

=back

=head3 STS header preload attribute (+preload)

To satisfy the requirements on  https://hstspreload.appspot.com/  the
HSTS header must:

=over

=item * have the max-age with at least 18 weeks (10886400 seconds)

=back

=over

=item * have the includeSubDomains attribute

=back

=over

=item * have the preload attribute

=back

=over

=item * redirect to https first, then to sub-domains (if redirected)

=back

=over

=item * have an HSTS header in each redirect to https.

=back

Additionally, the site must have:

=over

=item * a valid certificate

=back

=over

=item * serve all subdomains over https.

=back

Except the last requirement,  I<+preload>  will do the checks.
Note that  I<+preload>  is defined in  C<.o-saft.pl>  only.

=head3 Public Key Pins header

TBD - to be described ...

=head2 Sizes

Mainly in the certificate various counts, lengths and sizes of values
are checked and reported. All commands for these checks start with
C<+cnt_>  or  C<+len_>.  Up to now, there is no  C<yes>  or  C<no>  value
for these checks.

Following commands will check the value to be in  a specific range to
become  C<yes>  or  C<no>:

=over

=item * +sts_maxage1d       - C<yes> if HSTS maxage < 1 day

=back

=over

=item * +sts_maxage1m       - C<yes> if HSTS maxage < 1 month

=back

=over

=item * +sts_maxage1y       - C<yes> if HSTS maxage < 1 year

=back

=over

=item * +sts_maxage18       - C<yes> if HSTS maxage < 18 weeks (5 months)

=back

=over

=item * +sts_maxagexy       - C<yes> if HSTS maxage > 1 year

=back

=over

=item * +modulus_exp_1      - Public Key Modulus Exponent <>1

=back

=over

=item * +modulus_exp_65537  - Public Key Modulus Exponent =65537

=back

=over

=item * +modulus_exp_oldssl - Public Key Modulus Exponent <65537

=back

=over

=item * +modulus_size_oldssl - Public Key Modulus <16385 bits

=back

For some details of these checks, please see the description above at
Public Key Modulus Exponent size

The recommendations for  DH parameters (RSA and ecliptice curve)  are
are checked as follows:

=over

=item * +dh_512             - DH Parameter >= 512 bits

=back

=over

=item * +dh_2048            - DH Parameter >= 2048 bits

=back

=over

=item * +ecdh_256           - DH Parameter >= 256 bits (ECDH)

=back

=over

=item * +ecdh_512           - DH Parameter >= 512 bits (ECDH)

=back

Note that only one of the checks  C<+dh_*>  and  C<+ecdh_*>  can return
C<yes>.

=head2 ALPN and NPN

The commands for the checks to report  C<yes>  or  C<no>, are  I<+hasalpn>
and  I<+hasnpn>.

Both, the Application Layer Protocol Negotiation (ALPN) and the  Next
Protocol Negotiation (NPN) will be tested. The commands for that are:

=over

=item * +alpns

=back

=over

=item * +npns

=back

Each, ALPN and NPN, is tested separately with all known protocols.
The test sets only one protocol,  tries to make a connection and then
checks if the protocol was accepted by the server. The collected list
of protocols will be printed with the aforementioned commands, or the
I<+info>  command. Note the difference for the commands  I<+next_protocols>
and  I<+alpns>, where  I<+next_protocols>  simply reports  what  the server
itself advertises, while  I<+alpns>  reports what the server supports if
asked for.

=head2 Compliances

Note that it is not possible to satisfy all following compliances.
Best match is: C<PSF> and C<ISM> and C<PCI> and C<lazy BSI TR-02102-2>.
In general it is difficult to satisfy all conditions of a compliance,
and it is also difficult to check  all these conditions.  That is why
some compliance checks are not completely implemented.
For details see below please.

Also note that in the  rc-file  the output of results for some checks
is disabled by default. A  C<!!Hint:>  message will be printed, if any
of these checks are used.

=over

=item * FIPS-140

=back

=over

=item * ISM

=back

=over

=item * PCI

=back

=over

=item * BSI TR-02102-2 (2016-01)

=back

=over

=item * BSI TR-03116-4

=back

=over

=item * RFC 2818

=back

=over

=item * RFC 6125

=back

=over

=item * RFC 6797

=back

=over

=item * RFC 7525

=back

=head3 BSI TR-02102-2 (+tr-02102+ +tr-02102- +bsi)

Checks if connection and ciphers are compliant according TR-02102-2,
see https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen
/TechnischeRichtlinien/TR02102/BSI-TR-02102-2_pdf.pdf?__blob=publicationFile

(following headlines are taken from TR-02102-2 Version 2016-01)

3.1.3 Schlüssellängen bei EC-Verfahren
die EC-Verfahren ...  und weitere Erläuterungen siehe Bemerkung 4 in Kapitel 3 in [TR-02102-1] .

3.2   SSL/TLS_Versionen

Only TLSv1.2 allowed (except for  I<+tr-02102->  which also allows
TLSv1.1)

3.3.1 Empfohlene Cipher Suites

Allows only *DHE-*-SHA256, *DHE-*-SHA384, *DH-*-SHA256 and
*DH-*-SHA384 ciphers and PSK ciphers with ephermeral keys.
For  I<+tr-02102+>  they must be AES-GCM,  I<+tr02102-> also allows
B<AES-CBC.>

3.3.2 Übergangsregelungen

SHA1 temporary allowed. SHA256 and SHA384 recommended.
RC4 not reocmmended.
Use of SHA1 will only be checked for  I<+tr-02102+>

3.4.1 Session Renegotation

Only server-side (secure) renegotiation allowed (see RFC 5746).

3.4.2 Verkürzung der HMAC-Ausgabe

Truncated HMAC according RFC 6066 not recommended.

3.4.3 TLS-Kompression und der CRIME-Angriff

No TLS compression.

3.4.4 Der Lucky13-Angriff
3.4.5 Die "Encrypt-then-MAC"-Erweiterung

Use of AES-GCM ciphers only.
Use of Encrypt-then-MAC according RFC 7366 cannot be checked.

3.4.6 Die Heartbeat-Erweiterung

Target must not support the heartbeat extension.

3.4.7 Die Extended Master Secret Extension

Use of Extended Master Secret Extension according RFC 7627 cannot
be checked.

3.5 Authentisierung der Kommunikationspartner

Not checked as only applicable for VPN connections.

3.6 Domainparameter und Schlüssellängen

Check if signature key is > 2048 bits.

3.6.1 Verwendung von elliptischen Kurven

**NOT YET IMPLEMENTED**

Use only following curves according RFC 5639 and RFC 7027:
brainpoolP256r1, brainpoolP384r1, brainpoolP512r1

Use of secp256r1 and secp384r1  temporary allowed.

4.1 Schlüsselspeicherung

This requirement is not testable from remote.

4.2 Umgang mit Ephemeralschlüsseln

This requirement is not testable from remote.

4.3 Zufallszahlen

This requirement is not testable from remote.

=head3 BSI TR-03116-4 (+tr-03116+ +tr-03116- +bsi)

Checks if connection and ciphers are compliant according TR-03116-4,
see https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen
/TechnischeRichtlinien/TR03116/BSI-TR-03116-4.pdf?__blob=publicationFile

(following headlines are taken from there)

2.1.1 TLS-Versionen und Sessions

Allows only TLS 1.2.

2.1.2 Cipher Suites

Cipher suites must be ECDHE-ECDSA or -RSA with AES128 and SHA265.
For curiosity, stronger cipher suites with AES256 and/or SHA384 are
not not allowed. To follow this curiosity the  I<+tr-03116->  (lazy)
check allows the stronger cipher suites ;-)

2.1.1 TLS-Versionen und Sessions

The TLS session lifetime must not exceed 2 days.

2.1.4.2 Encrypt-then-MAC-Extension

2.1.4.3 OCSP-Stapling

MUST have C<OCSP Stapling URL>.

4.1.1 Zertifizierungsstellen/Vertrauensanker

Certificate must provide all root CAs. (NOT YET IMPLEMENTED).

Should use a small certificate trust chain.

4.1.2 Zertifikate

Must have C<CRLDistributionPoint> or C<AuthorityInfoAccess>.

End-user certificate must not be valid longer than 3 years.
Root-CA certificate must not be valid longer than 5 years.

Certificate extension C<pathLenConstraint> must exist, and should be
a small value ("small" is not defined).

All certificates must contain the extension C<KeyUsage>.

Wildcards for C<CN> or C<Subject> or C<SubjectAltName> are not allowed
in any certificate.

EV certificates are recommended (NOT YET checked properly).

4.1.3 Zertifikatsverifikation

Must verify all certificates in the chain down to their root-CA.
(NOT YET IMPLEMENTED).

Certificate must be valid according issue and expire date.

All Checks must be doen for all certificates in the chain.

4.1.4 Domainparameter und Schlüssellängen

This requirement is not testable from remote.

4 5.2 Zufallszahlen

This requirement is not testable from remote.

=head3 RFC 2818 (+rfc2818)

Check if the FQDN is listed in the certificates C<subjectAltname>.

=head3 RFC 6125 (+rfc6125)

Checks values C<CommonName>, C<Subject> and C<SubjectAltname>  of the
certificate for:

=over

=item * must all be valid characters for DNS

=back

=over

=item * must not contain more than one wildcard

=back

=over

=item * must not contain invalid wildcards

=back

=over

=item * must not contain invalid IDN characters

=back

=head3 RFC 6797 (+rfc6797)

Same as STS header  I<+hsts> .

=head3 RFC 7525 (+rfc7525)

Checks if connection and ciphers are compliant according RFC 7525.
See http://tools.ietf.org/rfc/rfc7525.txt
(following headlines are taken from there)

3.1.1.  SSL/TLS Protocol Versions

SSLv2 and SSLv3 must not be supportetd.
TLSv1 should only be supported if there is no TLSv1.1 or TLSv1.2.
Either TLSv1.1 or TLSv1.2 must be supported, preferred is TLSv1.2.

3.1.2.  DTLS Protocol Versions

DTLSv1 and DTLSv1.1 must not be supported.

3.1.3.  Fallback to Lower Versions

(check implecitely done by 3.1.1, see above)

3.2.  Strict TLS

Check if server provides Strict Transport Security.
(C<STARTTLS> check NOT YET IMPLEMENTED).

3.3.  Compression

Compression on TLS must not be supported.

3.4.  TLS Session Resumption

Server must support resumtion and random session tickets.
(Randomnes of session tickets implemented YET experimental.)

Check if ticket is authenticated and encrypted NOT YET IMPLEMENTED.

3.5.  TLS Renegotiation

Server must support renegotiation.

3.6.  Server Name Indication

(Check for SNI support implemented experimental.)

4.  Recommendations: Cipher Suites

4.1.  General Guidelines
4.2.  Recommended Cipher Suites

Check for recommended ciphers.

4.3.  Public Key Length

DH parameter must be at least 256 bits or 2048 bits with EC.
(Check currently, 4/2016, based on openssl which may not provide DH

=over

=item *            parameters for all ciphers.)

=back

4.5.  Truncated HMAC

TLS extension "truncated hmac" must not be used.

6.  Security Considerations
6.1.  Host Name Validation

Given hostname must matches hostname in certificate's subject.

6.2.  AES-GCM
6.3.  Forward Secrecy
6.4.  Diffie-Hellman Exponent Reuse
(NOT YET IMPLEMENTED).

6.5.  Certificate Revocation

OCSP and CRL Distrbution Point in cetificate must be defined.

=head1 OUTPUT

All output is designed to make it  easily parsable by postprocessors.
Following rules are used:

=over

=item * Lines for formatting or header lines start with  C<=>.

=back

=over

=item * Lines for verbosity or tracing start with  C<#>.

=back

=over

=item * Errors, warnings and information start with  C<**>.

=back

=over

=item * Hints start with C<!!>.

=back

=over

=item * Empty lines are comments ;-)

=back

=over

=item * Label texts end with a separation character; default is  C<:>.

=back

=over

=item * Label and value for all checks are separated by at least one  TAB

=back

character.

=over

=item * Texts for additional information are enclosed in C<<<>  and  C<>>>.

=back

=over

=item * C<N/A>  is used  when no proper information was found or provided.

=back

Replace  C<N/A>  by whatever you think is adequate:  "No answer",
"Not available",  "Not applicable",  ...

Examples:

	=== Title line ===
	= this is a comment

	Label for information or check:  TABresult
	!!Hint: above result depends on the target

For more details on these lines, please refer to  L</RESULTS>  above.

When used in  I<--legacy=full>  or  I<--legacy=simple> mode, the output may
contain formatting lines for better (human) readability.

=head2 Errors, warnings, hints

Errors, warnings and hints may be part of the output as needed. While
errors and warnings are printed immediately as they occour during the
program flow, hints are printed right after the corresponding result.

Errors and warnings start with a unique  3-digit number.  The numbers
are grouped as follows:

#-------------+------------------------------------
number range | description
#-------------+------------------------------------
   0xx    | startup check, options, arguments
   1xx    | check (runtime) functionality
   2xx    | loop targets (hosts)
   3xx    | connect functions
   4xx    | cipher check functions
   5xx    | inernal check functions
   6xx    | check functions
   8xx    | print functions
#-------------+------------------------------------

Hints print an additional explanation of a specific result.  They are
are defined statically in the program code, or can be added on demand
by using the option  I<--cfg-hint=KEY=TEXT> .

=head2 Postprocessing output

It is recommended to use the   I<--legacy=quick>   option, if the output
should be postprocessed, as it omits the default separation character
(C<:> , see above) and just uses on single tab character (0x09, \t  or
TAB) to separate the label text from the text of the result. Example:

	Label of the performed checkTABresult

More examples for postprocessing the output can be found here:

	https://github.com/OWASP/O-Saft/blob/master/usr

=head1 EXIT STATUS

Following exit codes are used:

=over

=item * 0   - normal usage and execution

=back

=over

=item * 2   - command-line parsing failed, command or option missing

=back

=over

=item * >0  - only if  --exitcode  was used

=back

=head1 ENVIRONMENT

Following environment variables are incorporated:

=over

=item * LD_LIBRARY_PATH - used and extended with definitions from options

=back

=over

=item * OPENSSL         - if set, full path to openssl executable

=back

=over

=item * OPENSSL_CONF    - if set, full path to openssl's openssl.cnf or

=back

                 directory where to find openssl.cnf

=over

=item * OSAFT_CONFIG    - if set to an existing file, use it as rc-file

=back

                 donC<t read any file if given file doesn>t exist
                 file will be overwritten with  I<--rc=FILE> option

=over

=item * OSAFT_OPTIONS   - if set, all words will be used as  command-line

=back

                 argument (option, command, target)
                 note that whitespace characters aren't possible
                 in given arguments, 'cause each word is used as
                 a single argument

=over

=item * OSAFT_MAKE      - if set, some  random values  in the result  are

=back

                 replaced by constant strings; it is set for all
                 targets in all Makefile*

=head1 CUSTOMISATION

This tool can be customised as follows:

=over

=item * Using command-line options

=back

This is a simple way to redefine  specific settings.  Please  see
L</CONFIGURATION OPTIONS>  below.

=over

=item * Using configuration file

=back

A configuration file can contain multiple configuration settings.
Syntax is simply  KEY=VALUE. Please see L</CONFIGURATION FILE> below.

=over

=item * Using resource files

=back

A resource file can contain multiple command-line options. Syntax
is the same as for command-line options iteself.  Each  directory
may contain its own resource file. Please see rc-file below.

=over

=item * Using debugging files

=back

These files are - nomen est omen - used for debugging purposes.
However, they can be (mis-)used to redefine all settings too.
Please see  L</DEBUG-FILE>  below.

=over

=item * Using user specified code

=back

This file contains  user specified  program code.  It can also be
(mis-)used to redefine all settings. Please see L</USER-FILE>  below.

Customisation is done by redefining values in internal data structure
which are:  %cfg,  %data,  %checks,  %text.

Unless used in  L</DEBUG-FILE>  or  L</USER-FILE>,  there is  no need to know
these internal data structures or the names of variables; the options
will set the  proper values.  The key names being part of the option,
are printed in output with the  I<--trace-key>  option.

Texts (values) of keys in  C<%data>  are those  used in  output of the
"Information" section.  The texts of keys in  C<%checks>  are used for
output in "Performed Checks" section.  Texts of keys in  C<%text>  are
used for additional information lines or texts (mainly beginning with
C<=>).

Configuration file vs. L</RC-FILE> vs. L</DEBUG-FILE>

=over

=item * CONFIGURATION FILE

=back

Configuration files must be specified with one of the  I<--cfg-*>
options. The specified file can be a valid path. Please note that
only the characters: C<a-zA-Z_0-9,.\/()->  are allowed as pathname.
Syntax in configuration file is:  C<KEY=VALUE>  where C<KEY> is any
key as used in internal data structure.

=over

=item * RC-FILE

=back

Resource files are searched for and used automatically.
For details see  L</RC-FILE>  below.

=over

=item * DEBUG-FILE

=back

Debug files are searched for and used automatically.
For details see  L</DEBUG-FILE>  below.

=over

=item * USER-FILE

=back

The user program file is included only  if the  I<--usr>  option was
used. For details see  L</USER-FILE>  below.

L</DEBUG-FILE>  and  L</USER-FILE>  will be searched for in paths of C<@INC>.

=head2 CONFIGURATION OPTIONS

Configuration options are used to redefine  texts and labels or score
settings used in output. The options are:

=over

=item * --cfg-cmd=CMD=LIST

=back

=over

=item * --cfg-checks=KEY=TEXT

=back

=over

=item * --cfg-data=KEY=TEXT

=back

=over

=item * --cfg-hint=KEY=TEXT

=back

=over

=item * --cfg-text=KEY=TEXT

=back

=over

=item * --cfg-cipher=CIPHER=TEXT

=back

C<KEY>  is the key used in the internal data structure, and  C<TEXT> is
the value to be set for this key.  Note that unknown keys are ignored
silently.

If  C<KEY=TEXT>  is an existing filename, all lines from that file are
read and set. For details see  L</CONFIGURATION FILE>  below.

C<CIPHER>  must be a valid cipher suite name as shown with:

	o-saft.pl ciphers

Note that such configuration options should be used before any I<--help>
or  I<--help=*>  option, otherwise the changed setting is not visible.

=head2 CONFIGURATION FILE

Note that the file can contain  C<KEY=TEXT> pairs for any kind of the
configuration as given by the  I<--cfg-CFG>  option.

For example  when used with  I<--cfg-text=FILE>  only values for  %text
will be set, when used with  I<--cfg-data=FILE>  only values for  %data
will be set, and so on. C<KEY> will not be used when C<KEY=TEXT> is an
existing filename.  It is recommended to use a non-existing key, for
example  I<--cfg-text=my_file=some/path/to/private/file> .

=head2 RC-FILE

The rc-file will be searched in following sources:

	a. file given in environment variable OSAFT_CONFIG
	b. default name: program file prefixed by a '.' (dot) 
	c. file given with  --rc=FILE  option

By default only C<.o-saft.pl> in the working directory is used.

A  rc-file  can contain any of the commands and options valid for the
tool itself. The syntax for them is the same as on command-line. Each
command or option must be in a single line. Any empty or comment line
will be ignored. Comment lines start with  C<#>  or  C<=>.

Note that options with arguments must be used as  C<KEY=VALUE> instead
of  C<KEY VALUE>.

Configurations options must be written like C<--cfg-CFG=KEY=VALUE>.
Where  C<CFG>  is any of:  C<cmd>, C<check>, C<data>, C<text>  and  C<KEY>
is any key from internal data structure (see above).

All commands and options given on command-line will  overwrite  those
found in the rc-file.

=head2 DEBUG-FILE

All debugging functionality is defined in  lib/OTrace.pm .

Syntax in this file is Perl code.  For details see  L</DEBUG>  below.

=head2 USER-FILE

All user functionality is defined in   lib/OUsr.pm .

Syntax in this file is Perl code.

All functions defined in   lib/OUsr.pm   are called  when the  option
I<--usr>  was used. The functions are defined as empty stub and any code
can be inserted as need.  Please see   perldoc lib/OUsr.pm   when and
how these functions are called.

=head2 SHELL TWEAKS

Configuring the shell environment where the tool is startet,  must be
done before the tool starts. It isn't a task for the tool itself, but
it can simplify your life, somehow.

There exist customisations for some commonly used shells,  please see
the files in the ./usr/ directory.

=head2 COMMANDS

The option  I<--cfg-cmd=CMD=LIST>  can be used to define own commands.
When configuring own commands,  CMD  must not be  one of the commands
listed with  I<--help=intern>  and CMD  must constist only of digits and
letters.

Examples in  C<.o-saft.pl>  are  I<+preload>  and  I<+ciphercheck> .

=head1 CIPHER NAMES

While the SSL/TLS protocol uses integer numbers to identify  ciphers,
almost all tools use some kind of  "human readable"  texts for cipher
names.

These numbers (which are most likely written  as hex values in source
code and documentations) are the only true identifier, and we have to
rely on the tools that they use the proper integers.

As such integer or hex numbers are difficult to handle by humans,  we
decided to use human readable texts. Unfortunately no common standard
exists how to construct the names and map them to the correct number.
Some, but by far not all, oddities are described in  L</Name rodeo>.

The rules for specifying cipher names are:

=over

=item *           1) textual names as defined by IANA (see [IANA])

=back

=over

=item *           2) mapping of names and numbers as defined by IANA (see [IANA])

=back

=over

=item *           3) C<->  and  C<_>  are treated the same

=back

=over

=item *           4) abbreviations are allowed, as long as they are unique

=back

=over

=item *           5) beside IANA, OpenSSL's cipher names are preferred

=back

=over

=item *           6) name variants are supported, as long as they are unique

=back

=over

=item *           7) hex numbers can be used

=back

=over

=item *           8) our internal hex numbers for ciphers are like C<0x0300CCA9>

=back

[IANA]    http://www.iana.org/assignments/tls-parameters/tls-parameters.txt August 2022

[openssl] ... openssl 1.0.1

If in any doubt, use any of the  provided commands or options to list
to show our known ciphers. For example:

	o-saft.pl --test-ciphers-show  # or any other  --test-ciphers-*
	o-saft.pl --list
	o-saft.pl --help=ciphers-text
	o-saft.pl ciphers -V

Use  I<--help=regex>  to see which regex are used to handle all variants
of cipher suite names herein.

Mind the traps and dragons with cipher names and what number they are
actually mapped to. In particular when  I<--lib>,  I<--exe>  or  I<--openssl>
options are in use. Always use these options with  I<+list> command too.

=head2 Name rodeo

As said above, the  SSL/TLS protocol uses integer numbers to identify
ciphers, but almost all tools use some kind of  human readable  texts
for cipher names.

For example the cipher commonly known as C<DES-CBC3-SHA> is identified
by C<0x020701c0> (in openssl) and has C<SSL2_DES_192_EDE3_CBC_WITH_SHA>
as constant name. A definition is missing in IANA, but there is
C<TLS_RSA_WITH_3DES_EDE_CBC_SHA>.  There is also C<0x000A> for the same
cipher C<DES-CBC3-SHA>.  Both are valid, first one if used with SSLv2,
and second one when used with SSLv3.
It's the responsibility of each tool to map the human readable cipher
name to the correct (hex, integer) identifier.

For example Firefox uses  C<dhe_dss_des_ede3_sha>,  which is what?

Furthermore, there are different acronyms for the same thing in use.
For example  C<DHE>  and  C<EDH>  both mean "Ephemeral Diffie-Hellman".
Comments in the L<openssl(1)|openssl(1)> sources mention this.  And for curiosity
these sources use both in cypher names, but allow  C<EDH>  as shortcut
only in openssl's "ciphers"  command. Wonder about (up to 1.0.1h):

	openssl ciphers -V EDH
	openssl ciphers -V DHE
	openssl ciphers -V EECDH
	openssl ciphers -V ECDHE

Next example is  C<ADH>  which is also known as  C<DH_anon> or C<DHAnon>
or  C<DHA>  or  C<ANON_DH>.

You think this is enough? Then have a look how many acronyms are used
for  "Tripple DES".

Compared to above, the interchangeable use of  C<->  vs.  C<_> in human
readable cipher names is just a very simple one. However, see openssl
again what following means (returns):

	openssl ciphers -v RC4-MD5
	openssl ciphers -v RC4+MD5
	openssl ciphers -v RC4:-MD5
	openssl ciphers -v RC4:!MD5
	openssl ciphers -v RC4!MD5

Looking at all these oddities, it would be nice to have a common unique
naming scheme for cipher names. We have not.  As the SSL/TLS protocol
just uses a number, it would be natural to use the number as uniq key
for all cipher names, at least as key in our internal sources.

Unfortunately, the assignment of ciphers to numbers  changed over the
years, which means that the same number refers to a  different cipher
depending on the standard, and/or tool, or version of a tool you use.

As a result, we cannot use human readable cipher names as  identifier
(a.k.a unique key), as there are to many aliases for the same cipher.
And also the number  cannot be used  as unique key, as a key may have
multiple ciphers assigned.

The default behaviour will be to use the cipher names like L<openssl(1)|openssl(1)>
does. If a name is ambigous, the first matching will be choosen. This
-first matching- only applies to names provided by the user by option
or whatever, internally the latest IANA number will be used,  because
they have the most less ambiguities.

=head1 KNOWN PROBLEMS

This section describes knwon problems, and known error messages which
may occour when using o-saft.pl. This sections can be used as FAQ too
as it gives hints and workarounds.

=head2 +cipher hangs

There're various reason why this may happen:

=over

=item * target does not support SSL protocol on specified port

=back

=over

=item * target has a rate limitation or IPS is in place

=back

Start the test with the  I<--v>  option  which then reports the protocol
currently tested, like:

**INFO:   test 2640 ciphers for DTLSv12 ... (SSLhello)

Workaround: disable the protocol with the  I<--noSSL >  option  (would be
I<--no-dtls12>  in this example).
Most likely this happens with old servers not supporting DTLS or with
modern servers not supporting SSLv2, SSLv3.

Other options to test are  I<--timeout=SEC>  or  I<--connect-delay=SEC> .

=head2 Segmentation fault

Sometimes  the program terminates with a  C<Segmentation fault>.  This
mainly happens if the target does not return certificate information.
If so, the  I<--no-cert>  option may help.

=head2 **WARNING: 311: empty result from openssl; ignored at ...

This most likely occurs when the  provided cipher is  not accepted by
the server, or the server expects client certificates.

=head2 **WARNING: 311: unknown result from openssl; ignored at ...

This most likely occurs when the L<openssl(1)|openssl(1)> executable is used with a
very slow connection. Typically the reason is a connection timeout.
Try to use  I<--timeout=SEC>  option.
To get more information, use  I<--v> I<--v>  and/or  I<--trace>  also.

=head2 **WARNING: 016: undefined cipher description

May occour if ciphers are checked, but no description is available for
them herein. This results in printed cipher checks like:

	EXP-KRB5-RC4-MD5                no       <<undef>>

instead of:

	EXP-KRB5-RC4-MD5                no       weak

=head2 **WARNING: 205: Can't make a connection to your.tld:443; no initial data

=head2 **WARNING: 205: Can't make a connection to your.tld:443; target ignored

This message occours if the underlaying  SSL library (i.e. libssl.a)
was not able to connect to the target. Known observed reasons are:

=over

=item * target does not support SSL protocol on specified port

=back

=over

=item * target expects a client certificate in ClientHello message

=back

More details why the connection failed can be seen using  I<--trace=2> .

=head2 Use of uninitialized value $headers in split ... do_httpx2.al)

The warning message (like follows or similar):

	Use of uninitialized value $headers in split at blib/lib/Net/SSLeay.pm
	(autosplit into blib/lib/auto/Net/SSLeay/do_httpx2.al) line 1290.

occurs if the target refused a connection on port 80.
This is considered a bug in L<Net::SSLeay(3pm)|Net::SSLeay(3pm)>.
Workaround to get rid of this message: use  I<--no-http>  option.

=head2 invalid SSL_version specified at ... IO/Socket/SSL.pm

This error may occur on systems where a specific  SSL version is not
supported. Subject are mainly  SSLv2, SSLv3 TLSv1.3 and DTLSv1.
For DTLSv1 the full message looks like:

	invalid SSL_version specified at C:/programs/perl/perl/vendor/lib/IO/Socket/SSL.

See also  L</Note on SSL versions> .

Workaround: use option:  I<--no-sslv2>  I<--no-sslv3>  I<--no-tlsv13>  I<--no-dtlsv1>

=head2 Use of uninitialized value $_[0] in length at (eval 4) line 1.

This warning occours with IO::Socket::SSL 1.967, reason is unknown.
It seems not to harm functionality, hence no workaround, just ignore.

=head2 Use of uninitialized value in subroutine entry at lib/IO/Socket/SSL.pm line 430.

Some versions of  IO::Socket::SSL return this error message if  *-MD5
ciphers are used with other protocols than SSLv2.

Workaround: use  I<--no-md5-cipher>  option.

=head2 Can't locate auto/Net/SSLeay/CTX_v2_new.al in @INC ...

Underlaying library doesn't support the required SSL version.
See also  L</Note on SSL versions> .

Workaround: use  I<--ssl-lazy> option, or corresponding I<--no-SSL > option.

=head2 Read error: Connection reset by peer (,199725) at blib/lib/Net/SSLeay.pm\

=head2 (autosplit into blib/lib/auto/Net/SSLeay/tcp_read_all.al) line 535.

Error reported by some Net::SSLeay versions. Reason may be a timeout.
This error cannot be omitted or handled properly.

Workaround: try to use same call again (no guarantee, unfortunatelly)

=head2 Odd number of elements in anonymous hash at lib/SSLinfo.pm line 1613.

This warning from perl have been observed  when the connection to the
target to check for supported ciphers cannot be established.

This message can be ignored.

=head2 openssl: ...some/path.../libssl.so.1.0.0: no version information available (required by openssl)

Mismatch of  openssl executable  and loaded underlaying library. This
most likely happens when options  I<--lib=PATH>  and/or  I<--exe=PATH>  are
used.  See also  L</Note on SSL versions> .

Hint: use following commands to get information about used libraries:

	o-saft.pl +version
	o-saft.pl --v --v +version

=head2 Integer overflow in hexadecimal number at ...

This error message may occour on  32-bit systems if perl was not com-
piled with proper options. I.g. perl automatically converts the value
to a floating pont number.
Please report a bug with output of following command:

	o-saft.pl +s_client +dump your.tld

=head2 openssl did not return DH Paramter>>

Text may be part of a value. This means that all checks according  DH
parameters and logkam attack cannot be done.

Workaround: try to use  I<--openssl=TOOL >  option.

This text may appear in any of the compliance checks (like  I<+rfc7525>)
which may be a false positive.  For these checks openssl is also used
to get the DH Parameter.

Workaround: not available yet

=head2 No output with  +help  and/or  --help=todo

On some (mainly Windows-based) systems using

	o-saft.pl +help
	o-saft.pl --help

does not print anything.

Workaround: use  I<--v>  option.

	o-saft.pl +help --v

or

	o-saft.pl +help | more

=head2 Character set (like UTF-8) not recognised in some tools

Some tools  do not display all characters properly,  for example some
versions of  podviewer.  It is not the obligation of this tool to fix
well known bugs in other tools. However, we can offer workarounds.

Workaround: generate the affected output using  I<--std-format=*>  options
For example:

	o-saft.pl --no-rc --std-format=raw --help=gen-pod

=head2 **WARNING: on MSWin32 additional option  --v  required, sometimes ...

On some (mainly Windows-based) systems  this may happen  when calling
for example:

	o-saft.pl --help=FAQ

which then may produce:

	**WARNING: on MSWin32 additional option  --v  required, sometimes ...
	=== reading: ./.o-saft.pl (RC-FILE done) ===
	=== reading: lib/SSLinfo.pm (O-Saft module done) ===
	**USAGE: no command given
	# most common usage:
	o-saft.pl I+info&   your.tld&
	o-saft.pl I+check&  your.tld&
	o-saft.pl I+cipher& your.tld&
	# for more help use:
	o-saft.pl I--help&&

Workaround: use full path to perl.exe, for example

	C:\Programs\perl\bin\perl.exe o-saft.pl --help=FAQ

=head2 Performance problems

There are various reasons when the program responds slow, or seems to
hang. Performance issues are most likely a target-side problem.  Most
common reasons are (no specific order):

=over

=item *           a) DNS resolver problems

=back

Try with  I<--no-dns>

=over

=item *           b) target does not accept connections for https

=back

Try with  I<--no-http>

=over

=item *           c) target's certificate is not valid

=back

Try with  I<--no-cert>

=over

=item *           d) target expects that the client provides a client certificate

=back

No option provided yet ...

=over

=item *           e) target does not handle Server Name Indication (SNI)

=back

Try with  I<--no-sni>

=over

=item *           f) use of external L<openssl(1)|openssl(1)> executable

=back

Use  I<--no-openssl>

=over

=item *           g) target does not respond at all and/or blocks

=back

Use  I<--ssl-error>
For a detailed description, please see L</Connection problems>.

Other options which may help to get closer to the problem's cause:
I<--trace-time>,  I<--timeout=SEC>,  I<--trace>

Using  I<--trace-time>   should show following times:

	DNS:             1 .. 10 sec
	need_default:    <5 sec
	need_cipher:     1 ..299 sec (+cipher with socket)
	no SNI:          1 .. 10 sec
	connection test: 1 ..  5 sec
	prepare checks:  2 .. 20 sec
	checkalpn.   1 .. 15 sec
	checkprot.   1 .. 15 sec
	cipher:          <1 sec
	info:            <1 sec
	check:           <1 sec

=head1 LIMITATIONS

=head2 Commands

Some commands cannot be used together with others, for example:
I<+cipher>,  I<+ciphers>,  I<+list>,  I<+libversion>,  I<+version>,  I<+check>,  I<+help>,
I<+protocols> .

I<+quick>  should not be used together with other commands, it returns
strange output then. It is the only command which allows  I<+cipher>
together with other commands.

I<+protocols>  requires L<openssl(1)|openssl(1)> with support for  C<-nextprotoneg>
option. Otherwise the value will be empty.

=head2 Options

The option  I<--port=PORT>  must precede  I<--host=HOST>  for a target like
HOST:PORT  .

The characters  C<+> and C<=>  cannot be used for  I<--separator=CHAR>
option.

Following strings should not be used in any value for options:
C<+check>, C<+info>, C<+quick>, C<--header>
as they my trigger the  I<--header>   option unintentional.

The used L<timeout(1)|timeout(1)> command cannot be defined with a full path like
L<openssl(1)|openssl(1)> can with the  I<--openssl=path/to/openssl> .

I<--cfg-text=FILE>  cannot be used to redefine the texts  C<yes> and C<no>
as used in the output for  I<+cipher>  command.

I<--cipher=CIPHER>  accepts keys, names and patterns for ciphers.
Keys must start with C<0x> followed by exactly 8 uppercase hex chars.
If C<CIPHER> should match a cipher suite name, it must be written with
uppercase letters. If it should match a predefined pattern it must be
written with lowercase letters.
Note that currently not all OpenSSL-style patterns are supported.

I<--cipherrange=RANGE>  accepts only lowercase names.

=head2 Checks (general)

=head3 +constraints

This check is only done for the certificate provided by the target.
All other certificate in the chain are not checked.

This is currently (2018) a limitation in  o-saft.pl.

=head2 Broken pipe

This error message most likely means that the connection to specified
target was not possible (firewall or whatever reason).

=head2 Target Certificate Chain Verification

The systems default capabilities for example  libssl.so, openssl, are
used to verify the target's certificate chain.  Unfortunately various
systems have implemented different  approaches and rules how identify
and how to report a successful verification.  Consequently, this tool
can only return the same information  about the chain verification as
the used underlying tools. If that information is trustworthy depends
on how trustworthy the tools are.

These limitations apply to following commands:

=over

=item * +verify

=back

=over

=item * +selfsigned

=back

Following commands and options are useful to get more information:

=over

=item * +chain_verify,  +verify,  +error_verify,  +chain,  +s_client

=back

=over

=item * --ca-file,  --ca-path,  --ca-depth

=back

=head2 User provided files

Please note that there cannot be any guarantee that the code provided
in the  L</DEBUG-FILE> lib/OTrace.pm  or the  L</USER-FILE> lib/OUsr.pm  will
work flawless. Obviously this is the user's responsibility.

=head2 Problems and errors

Checking the target for supported ciphers may return that a cipher is
not supported by the server  misleadingly.  Reason is most likely  an
improper timeout for the connection. See  I<--timeout=SEC>  option.

If the specified targets accepts connections but does not speak  SSL,
the connection will be closed after the system's TCP/IP-timeout. This
script will hang (about 2-3 minutes).

If reverse DNS lookup fails, an error message is returned as hostname,
like:  C<<<gethostbyaddr() failed>>>.
Workaround to get rid of this message: use  I<--no-dns>  option.

All checks for EV are solely based on the information provided by the
certificate.

Some versions of openssl (< 1.x) may not support all required options
which results in various error messages,  or  more worse,  may not be
visibale at all. Available functionalitity of openssl will be checked
for right at the beginning. Proper warnings and hints are printed.
Following table shows the openssl option and how to disable it within

	o-saft.pl:
#-------------------+---------------------

=over

=item * -nextprotoneg     | --no-nextprotoneg

=back

=over

=item * -reconnect        | --no-reconnect

=back

=over

=item * -tlsextdebug      | --no-tlsextdebug

=back

=over

=item * -alpn             | --no-alpn

=back

#-------------------+---------------------

=head2 Connection problems

Sometimes the connection cannot be established. This may have various
reasons.  Unfortunaly this script seems to hang then.  In  particular
when checking for ciphers with  I<+cipher>  command.  The reason is most
likely that the server does not respond to the TCP/IP request,  hence
the script closes the connection after the configured timeout (please
see  I<--timeout=SEC>  option).

Continous connection attempts  can be inhibited with the  I<--ssl-error>
option, which is set by default. Avoiding further connections results
in a loss of information and consequentely, leads to wrong checks.

It is a trade-off to wait for all information done accurately,  or to
get the results quickly. The logic to stop connecting for I<--ssl-error>
can be controlled with following additional options:
#-----------------------+----------------------------------------

=over

=item * --ssl-error-max=CNT     | max. continous errors

=back

=over

=item * --ssl-error-timeout=SEC | treat failure as error after timeout

=back

=over

=item * --ssl-error-total=CNT   | max. amount of errors

=back

#-----------------------+----------------------------------------

This means that no more connections are made when more than

=over

=item * --ssl-error-max errors occour sequentialy

=back

or

=over

=item * --ssl-error-total errors occoured

=back

Examples:

=over

=item * --ssl-error-max=3

=back

=over

=item * --ssl-error-timeout=6

=back

=over

=item * --ssl-error-total=6

=back

no more connections are made if for example  any sequence of timeouts
occour:

	0 5 2 2                   - --ssl-error-max matches
	0 1 3 0 0 0 4 1 2 2 2     - --ssl-error-max matches
	0 5 0 2 0 2 2 0 2 0 2     - --ssl-error-total matches

This allows to fine-tune the condition when to stop connecting to the
target. For example, continous but not consecutive timeouts may indi-
cate a bad or instable network connection, but not that the target to
be connected blocks. In such a case sequence of timeouts like follows
may be observed (assuming  I<--ssl-error-max=3>):

	0 5 1 2 2 2 4 2 3 2 3 3 3 2
	. . . ^                 ^____ stop for  --ssl-error-timeout=3
	. . . |______________________ stop for  --ssl-error-timeout=2

On normal (even slow) network connections  dozens of  connections per
second are usual, hence the timeout is always  0 or 1.  Based on that
experience  I<--ssl-error>  is enabled and set with defaults as follows:

=over

=item * --ssl-error-max=5

=back

=over

=item * --ssl-error-timeout=1

=back

=over

=item * --ssl-error-total=10

=back

=head2 Poor systems

Use of L<openssl(1)|openssl(1)> is disabled by default on  Windows due to various
performance problems. It needs to be enabled with  I<--openssl>  option.

On Windows the usage of  "openssl s_client" needs to be enabled using
I<--s_client>  option.

On Windows it's a pain to specify a correct path for  I<--openssl=TOOL >
option. Variants are:

=over

=item * --openssl=/path/to/openssl.exe

=back

=over

=item * --openssl=X:/path/to/openssl.exe

=back

=over

=item * --openssl=\path\to\openssl.exe

=back

=over

=item * --openssl=X:\path\to\openssl.exe

=back

=over

=item * --openssl=\\path\\to\\openssl.exe

=back

=over

=item * --openssl=X:\\path\\to\\openssl.exe

=back

You have to fiddle around to find the proper one.

=head2 Debug and trace output

=head1 DEPENDENCIES

All Perl modules and all  private moduels and files  will be searched
for using paths  available in the  C<@INC>  variable.  C<@INC>  will be
prepended by following paths:

=over

=item * .

=back

=over

=item * ./lib

=back

=over

=item * INSTALL_PATH

=back

=over

=item * INSTALL_PATH/lib

=back

Where  C<INSTALL_PATH>  is the path where the tool is installed.
To see which files have been included use:

	o-saft.pl +version --v --user

=head2 Perl modules

=over

=item * L<IO::Socket::SSL(3pm)|IO::Socket::SSL(3pm)>

=back

=over

=item * L<IO::Socket::INET(3pm)|IO::Socket::INET(3pm)>

=back

=over

=item * L<Net::SSLeay(3pm)|Net::SSLeay(3pm)>

=back

=over

=item * lib/SSLinfo

=back

=over

=item * lib/SSLhello

=back

Perl modules loaded and used for some options only:

=over

=item * Net::DNS(3pm)

=back

=over

=item * Time::Local(3pm)

=back

=head2 Additional files used if requested

=over

=item * .o-saft.pl

=back

=over

=item * o-saft-docker

=back

=over

=item * o-saft-README

=back

=over

=item * lib/OTrace.pm

=back

=over

=item * lib/OMan.pm

=back

=over

=item * lib/OUsr.pm

=back

=head1 INSTALLATION

The tool can be installed in any path. It just requres the modules as
described in  L</DEPENDENCIES>  above. However, it's recommended that the
modules  SSLhello  and  SSLinfo  are found  in the directory  C<./lib>
where  C<o-saft.pl>  is installed.

For security reasons, most modern libraries  disabled or even removed
insecure or "dirty" functionality.  As the purpose of this tool is to
detect such insecure settings, functions, etc.,  it needs these dirty
things enabled. It needs (incomplete list):

=over

=item * insecure protocols like SSLv2, SSLv3,

=back

=over

=item * more ciphers enabled, like NULL-MD5, AECDH-NULL-SHA, etc.,

=back

=over

=item * some SSL extensions and options.

=back

Therefore we recommend to compile and install at least following:

=over

=item * OpenSSL  with SSLv2, SSLv3 and more ciphers enabled,

=back

=over

=item * Net::SSLeay  compiled with openssl version as described before.

=back

Please read the  L</SECURITY>  section first before following the install
instructions below.

=head2 Quickstart

The script  INSTALL.sh  provides a quick method to check, compile and
install anything needed. Please see:

INSTALL.sh I<--help>

For more details, read on ...

=head2 Requirements for OpenSSL

To build openssl following packages are requred  (note that the names
may differ depending on the used platform):

=over

=item * libidn11-dev

=back

=over

=item * libidn2-0-dev

=back

=over

=item * libgmp-dev

=back

=over

=item * libzip-dev

=back

=over

=item * libsctp-dev

=back

=over

=item * libkrb5-dev

=back

Also, following Perl modules should be installed:

=over

=item * Module::Build

=back

=over

=item * Net::LibIDN

=back

=over

=item * Net::LibIDN2

=back

=over

=item * Mozilla::CA

=back

=head2 OpenSSL

Currently (since 18.06.18) it is recommend to build openssl using:

	usr/install_openssl.sh

Other possibilities are:

=over

=item * compiling openssl using following sources

=back

https://github.com/PeterMosmans/openssl/
see  L</Example: Compile openssl>,

=over

=item * use any of the precomiled versions provided by https://testssl.sh/

=back

=over

=item * use Docker owasp/o-saft (which contains a special openssl)

=back

The sources are available at

=over

=item * https://github.com/PeterMosmans/openssl/archive/1.0.2-chacha.zip

=back

A precomiled static versions are available at

=over

=item * https://github.com/drwetter/testssl.sh/ (see bin directory there)

=back

For all following installation examples we assume:

=over

=item * openssl-1.0.2-chacha.zip or openssl-1.0.2d.tar.gz

=back

=over

=item * /usr/local as base installation directory

=back

=over

=item * a bourne shell (sh) compatible shell

=back

=head2 Example: Precompiled OpenSSL

Simply download the tarball or zip file for your platform, unpack it,
and install (copy) the binaries into a directory of your choice.

Note that  Net::SSLeay  needs to be adapted properly then.

=head2 Example: Compile openssl

OpenSSL can be used from http://openssl.org/ or, as recommended, from
https://github.com/PeterMosmans/openssl/ .

OpenSSL-chacha
Compiling and installing the later is as simple as:

	unzip openssl-1.0.2-chacha.zip
	cd openssl-1.0.2-chacha
	./config --shared -Wl,-rpath=/usr/local/lib
	make
	make test
	make install

which will install openssl, libssl.so, libcrypto.so  and some include
files as well as the include files in  /usr/local/ .
The shared version of the libraries are necessary for  Net::SSLeay.

For a more complete build, plese see:  usr/install_openssl.sh .

OpenSSL.org
Building openssl from the offical  openssl.org  sources requires some
patching before compiling and installing the libraries and binaries.

Example with openssl-1.0.2d:

	echo == unpack tarball
	tar xf openssl-1.0.2d.tar.gz
	cd openssl-1.0.2d

	echo == backup files to be modified
	cp ssl/s2_lib.c{,.bak}
	cp ssl/s3_lib.c{,.bak}
	cp ssl/ssl3.h{,.bak}
	cp ssl/tls1.h{,.bak}

	echo == patch files
	vi ssl/tls1.h         +/TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES/
	# define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES  1
	vi ssl/ssl3.h ssl/s{2,3}_lib.c   +"/# *if 0/"
	#==> remove all   # if 0  and corresponding  #endif
	#    except if lines contain:
	#        _FZA
	#        /* Fortezza ciphersuite from SSL 3.0
	#        /* Do not set the compare functions,
	#        if (s->shutdown  SSL_SEND_SHUTDOWN)&

	echo == configure with static libraries
	echo omitt the zlib options if zlib-1g-dev is not installed
	echo omitt the krb5 options if no kerberos libraries available
	LD_RUN_PATH=/usr/local/openssl/lib
	LDFLAGS="-rpath=$LD_RUN_PATH" & export LDFLAGS&
	./config --prefix=/usr/local --openssldir=/usr/local/ssl \
	enable-zlib zlib zlib-dynamic enable-ssl2 \
	enable-krb5 --with-krb5-flavor=MIT \
	enable-mdc2 enable-md2 enable-rc5  enable-rc2 \
	enable-cms  enable-ec  enable-ec2m enable-ecdh enable-ecdsa \
	enable-gost enable-seed enable-idea enable-camellia \
	enable-rfc3779 enable-ec_nistp_64_gcc_128 \
	experimental-jpake -fPIC \
	-DTEMP_GOST_TLS -DTLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES \
	-shared

	echo == make binaries and libraries
	make depend
	make
	make test
	make install

	echo == if you want static binaries and libraries
	make clean
	echo same ./config as before but without shared option
	./config --prefix=/usr/local --openssldir=/usr/local/ssl \
	enable-zlib zlib zlib-dynamic enable-ssl2 \
	enable-krb5 --with-krb5-flavor=MIT \
	enable-mdc2 enable-md2 enable-rc5  enable-rc2 \
	enable-cms  enable-ec  enable-ec2m enable-ecdh enable-ecdsa \
	enable-gost enable-seed enable-idea enable-camellia \
	enable-rfc3779 enable-ec_nistp_64_gcc_128 \
	experimental-jpake -fPIC  -static \
	-DTEMP_GOST_TLS -DTLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES
	make depend
	make
	make test
	echo next make will overwrite the previously installed dynamic
	echo shared openssl binary with the static openssl binary
	make install

=head2 Example: Compile Net::SSLeay

To enable support for ancient protocol versions,  Net::SSLeay must be
compiled manually after patching C<SSLeay.xs> (see below).
Reason is, that  Net::SSLeay  enables some functionality for  SSL/TLS
according the identified openssl version. There is, currently (2015),
no possibility to enable this functionality  by passing options on to
the configuration script C<perl Makefile.PL>.

Building our own library and module (with openssl from C</usr/local>):

	echo == unpack tarball
	tar xf Net-SSLeay-1.72.tar.gz
	cd Net-SSLeay-1.72

	echo == patch files
	echo "edit SSLeay.xs and change some #if as described below"
	LD_RUN_PATH=/usr/local/openssl/lib
	LDFLAGS="-rpath=$LD_RUN_PATH" & export LDFLAGS&
	env OPENSSL_PREFIX=/usr/local perl Makefile.PL PREFIX=/usr/local \
	INC=-I/usr/local/include  DEFINE=-DOPENSSL_BUILD_UNSAFE=1
	make
	make install
	cd /tmp & o-saft.pl +version&

SSLeay.xs needs to be changed as follows:

=over

=item * search for

=back

	#ifndef OPENSSL_NO_SSL2
	#if OPENSSL_VERSION_NUMBER < 0x10000000L

	const SSL_METHOD *
	SSLv2_method()

	#endif
	#endif

	#ifndef OPENSSL_NO_SSL3
	#if OPENSSL_VERSION_NUMBER < 0x10002000L

	const SSL_METHOD *
	SSLv3_method()

	#endif
	#endif

=over

=item * and replace by

=back

	const SSL_METHOD *
	SSLv2_method()

	const SSL_METHOD *
	SSLv3_method()

Note that  Net::SSLeay  will be installed in C</usr/local/> then. This
can be adapted to your needs by passing another path to the  C<PREFIX>
and  C<DESTDIR>  parameter.

Following command can be used to check  which methods are avilable in
Net::SSLeay, hence above patches can be verified:

	perl -MSSLinfo -le 'print SSLinfo::ssleay_test();'

=head2 Testing openssl

After installation as descibed above finished, openssl may be tested:

	echo already installed openssl (found with PATH environment)
	openssl ciphers -v
	openssl ciphers -V -ssl2
	openssl ciphers -V -ssl3
	openssl ciphers -V ALL
	openssl ciphers -V ALL:COMPLEMENTOFALL
	openssl ciphers -V ALL:eNULL:EXP

	echo own compiled and installed openssl
	/usr/local/openssl ciphers -v
	/usr/local/openssl ciphers -V -ssl2
	/usr/local/openssl ciphers -V -ssl3
	/usr/local/openssl ciphers -V ALL
	/usr/local/openssl ciphers -V ALL:COMPLEMENTOFALL
	/usr/local/openssl ciphers -V ALL:eNULL:EXP

The difference should be obvious.
Note, the commands using  C<ALL:COMPLEMENTOFALL>  and  C<ALL:eNULL:EXP>
should return the same result.

=head2 Testing Net::SSLeay

As we want to test the separately installed  Net::SSLeay,  it is best
to do it with  o-saft.pl  itself:

	o-saft.pl +version

we should see a line similar to follwong at the end of the output:

	Net::SSLeay   1.72  /usr/local/lib/x86_64-linux-gnu/perl/5.20.2/Net/SSLeay.pm

Now check for supported (known) ciphers:

	o-saft.pl ciphers -V

we should see lines similar to those of the last C</usr/local/openssl>
call. However, it should contain more cipher lines.

=head2 Stand-alone executable

Some people asked for a stand-alone executable (mainly for Windows).
Even Perl is a scripting language there are situations where a stand-
alone executable would be nice, for example if the installed perl and
its libraries are outdated, or if perl is missing at all.

Currently (2016) there are following possibilities to generate such a
stand-alone executable:

=over

=item * perl with PAR::Packer module

=back

	pp -C -c o-saft.pl
	pp -C -c o-saft.pl -M Net::DNS -M Net::SSLeay -M IO::Socket \
	-M SSLinfo -M SSLhello -M OCfg
	pp -C -c checkAllCiphers.pl
	pp -C -c checkAllCiphers.pl -M Net::DNS

=over

=item * ActiveState perl with its perlapp

=back

	perlapp --clean o-saft.pl
	perlapp --clean o-saft.pl -M Net::DNS -M Net::SSLeay -M IO::Socket \
	-M SSLinfo -M SSLhello -M OCfg
	perlapp --clean checkAllCiphers.pl
	perlapp --clean checkAllCiphers.pl -M Net::DNS -M OCfg

=over

=item * perl2exe from IndigoSTar

=back

	perl2exe o-saft.pl
	perl2exe checkAllCiphers.pl

For details  on building the executable,  for example  how to include
all required modules, please refer to the documentation of the tool.

=over

=item * http://search.cpan.org/~rschupp/PAR-Packer-1.030/lib/PAR/Packer.pm

=back

=over

=item * http://docs.activestate.com/pdk/6.0/PerlApp.html

=back

=over

=item * http://www.indigostar.com

=back

Note that  pre-build executables (build by perlapp, perl2exe)  cannot
be provided due to licence problems.
Also note that using  stand-alone executable have not been tested the
same way as the  o-saft.pl  itself. Use them at your own risk.

=head1 ABOUT CGI

This script can be used as CGI application.  Output is the same as in
common CLI mode. The output will be prefixed with the HTTP header
C<Content-Type:text/plain>.
The script  "o-saft.cgi"  should be used as wrapper for "o-saft.pl" .
The HTML form  "o-saft.cgi.html"  which can be generated with:

	o-saft.pl --help=gen-cgi

should be used as front-end for  "o-saft.cgi".

=head2 CGI-form functionality

This form provides following functionality:

=over

=item * top menu bar with following menus:

=back

=over

=item ** ☰          - general informations about CGI usage

=back

=over

=item ** Cmd        - quick commands menu

=back

=over

=item ** Opt        - quick options menu

=back

=over

=item ** Help       - various help pages

=back

=over

=item * input field "Host[:Port]" for a target (hostname or URL)

=back

=over

=item * GUI sections

=back

=over

=item ** Simple GUI - simple form with most common commands and options

=back

             Each provided I<+command> buttons submit the form with
             the selected options and the clicked command.

=over

=item ** Full GUI Commands & Options - form with all commands and options

=back

             Its content is the same as in sections  L</COMMANDS>  
             and  L</OPTIONS>  of the complete help page (see I<--help>
             option or "☰ -> ? Help" in top menu bar).

In both GUI sections following buttons exist:

=over

=item * ^             - return to top of form

=back

=over

=item * start         - submit form with selected command and options

=back

In general, command buttons which submit the form are yellow. Buttons
which show some help, mainly in a new browser tab, are grey.

=head2 CGI-form limitations

=over

=item * The generated form provides commands and options which are rejected

=back

by  o-saft.cgi  (see below).

=over

=item * The generated form may contain references (links) to sections which

=back

are not part of the form.

=over

=item * Only one target can be provided,  however, it is obvious how to use

=back

more targets ...

=over

=item * The  --html4  or  --html5  option should be used together  with the

=back

I<--header>  option, otherwise the generated HTML may be corrupted for
some commands.

=head2 CGI script limitations

The script returns an empty page (HTML body) for following reasons:

=over

=item * Use of local or multicast IPs as target.

=back

=over

=item * Use of dangerous commands or options.

=back

For deatils please see

	o-saft.pl --help=ABOUT
	perldoc o-saft.cgi

=head1 DOCKER

The tool can be used inside a Docker image. To start  o-saft.pl  inside
the Docker image, use following:

	o-saft-docker +info some.tld
or

	docker run --rm -it owasp/o-saft +info some.tld

For more details, please refer to:

	o-saft-docker usage
	o-saft-docker -help

=head1 BUILD DOCKER IMAGE

The Docker image can be installed as follows:

	docker pull owasp/o-saft

The image can also easily be build from the Dockerfile (which is part
of the distribution) as follows:

	o-saft-docker build

To build the image from the Dockerfile with docker commands, see:

	o-saft-docker -n build

For more details, please refer to:

	o-saft-docker -help

=head1 SEE ALSO

=over

=item * L<openssl(1)|openssl(1)>, L<Net::SSLeay(3pm)|Net::SSLeay(3pm)>, lib/SSLhello, lib/SSLinfo, L<timeout(1)|timeout(1)>

=back

=over

=item * http://www.openssl.org/docs/apps/ciphers.html

=back

=over

=item * L<IO::Socket::SSL(3pm)|IO::Socket::SSL(3pm)>, L<IO::Socket::INET(3pm)|IO::Socket::INET(3pm)>

=back

=over

=item * o-saft, o-saft-docker, o-saft-docker-dev, Dockerfile, docker

=back

=head1 HACKER's INFO

=head2 Note on SSL versions

Automatically detecting the supported SSL versions of the underlaying
system is a hard job and not always possible. Reasons could be:

=over

=item * used Perl modules (Socket::SSL, Net::SSLeay) does not handle errors

=back

properly. Erros may be:

	invalid SSL_version specified at ... IO/Socket/SSL.pm
	Use of uninitialized value in subroutine entry at lib/IO/Socket/SSL.pm

There're some workarounds implemented since version 15.11.15 .

=over

=item * the underlaying libssl does not support the version, which then may

=back

result in segmentation fault

=over

=item * the underlaying libssl is newer than the Perl module and the module

=back

has not been reinstalled. This most often happens with  Net::SSLeay
This can be detected with (see version numbers for Net::SSLeay):

	o-saft.pl +version

=over

=item * perl (in particular a used module, see above)  may bail out  with a

=back

compile error, like

	Can't locate auto/Net/SSLeay/CTX_v2_new.al in @INC ...

There're some workarounds implemented since version 15.11.15 .

We try to detect unsupported versions and disable them automatically,
a warning like follwoing is shown then:

	**WARNING: 303: SSL version 'SSLv2': not supported by openssl

All such warnings look like:

	**WARNING: 303: SSL version 'SSLv2': ...

If problems occour with  SSL versions, following commands and options
may help to get closer to the reason or can be used as workaround:

	o-saft.pl +version
	o-saft.pl +version --v
	o-saft.pl +version | grep versions
	o-saft.pl +version | grep 0x
	o-saft.pl +protocols your.tld
	o-saft.pl +protocols your.tld --no-rc

Checking for SSL version is done at one place in the code, search for

	supported SSL versions

However, there are some dirty hacks where  SSLv2 and SSLv3 is checked
again.

=head2 Manipulating Perl's @INC

Most perl executables use a compiled-in  list of directories where to
find its modules. This list is available in Perl's @INC variable.

There are various ways to add more directories to @INC  but no simple
method to remove directories from it.

The option  I<--no-inc=PATTERN>  can be used to  remove directories from
@INC. Note that PATTERN is a RegEx and will remove all matching paths
from @INC. Example:

remove all directories starting with "/usr/local/":

	o-saft.pl --no-inc=^/usr/local/ ...

remove all directories containing "/local/":

	o-saft.pl --no-inc=/local/ ...

just remove "/usr/local/lib/site_perl"

	o-saft.pl --no-inc=^/usr/local/lib/site_perl$ ...

For convenience the option  I<--inc=PATH>  exists and adds the specified
path to @INC (same as using "perl -IPATH ...".

The patterns given with  I<--no-inc=>  are removed from @INC  late, when
all default directories and those passed with  I<--inc=>  were added.

=head2 Using private libssl.so and libcrypt.so

For all  cryptographic functionality  the libraries  installed on the
system will be used. In particular Perl's L<Net::SSLeay(3pm)|Net::SSLeay(3pm)> module, the
system's  libssl.so and libcrypt.so  and the L<openssl(1)|openssl(1)> executable.

It is possible to provide your own libraries, if the  Perl module and
the executable are  linked using dynamic shared objects (a.k.a shared
library, position independent code).
The appropriate option is  I<--lib=PATH>.

On most systems these libraries are loaded at startup of the program.
The runtime loader uses a preconfigured list of directories  where to
find these libraries. Also most systems provide a special environment
variable to specify  additional paths  to directories where to search
for libraries, for example the  LD_LIBRARY_PATH environment variable.
This is the default environment variable used herein.  If your system
uses  another name it must be specified with the  I<--envlibvar=NAME>
option, where  L</NAME>  is the name of the environment variable.

=head2 Understanding  --exe=PATH, --lib=PATH, --openssl=TOOL

If any of  I<--exe=PATH>  or  I<--lib=PATH>  is provided, the pragram calls
(C<exec>) itself recursively with all given options, except the option
itself. The environment variables  C<LD_LIBRARY_PATH>  and C<PATH>  are
set before executing as follows:

=over

=item * prepend  C<PATH>  with all values given by  --exe=PATH

=back

=over

=item * prepend  C<LD_LIBRARY_PATH>  with all values given by  --lib=PATH

=back

This is exactly, what L</Cumbersome approach> below describes. So these
option simply provide a shortcut for that.

Note that  I<--openssl=TOOL >  is a full path to the  openssl  executable
and will not be changed.  However, if it is a relative path, it might
be searched for using the previously set  C<PATH>  (see above).

Note that  C<LD_LIBRARY_PATH>  is the default.  It can be changed with
the  I<--envlibvar=NAME>  option.

While  I<--exe>  mainly impacts the L<openssl(1)|openssl(1)> executable,  I<--lib>  also
impacts o-saft.pl itself, as it loads other shared libraries if found.

Bear in mind that  all these options  can affect the behaviour of the
openssl subsystem,  influencing both  which executable is called  and
which shared libraries will be used.

Note that no checks are done if the options are set proper. To verify
the settings, following commands may be used:

	o-saft.pl --lib=YOUR-PATH --exe=YOUR-EXE +version
	o-saft.pl --lib=YOUR-PATH --exe=YOUR-EXE --v +version
	o-saft.pl --lib=YOUR-PATH --exe=YOUR-EXE --v --v +version

Why so many options?  Exactly as described above, these options allow
the users to tune the behaviour of the tool to their needs.  A common
use case is to enable the use of a separate openssl build independent
of the OpenSSL package used by the operating system.  This allows the
user fine grained control over OpenSSL's encryption suites  which are
compiled/available, without affecting the core system.

=head2 Caveats

Depending on your system and the used modules and executables, it can
be tricky to replace the configured shared libraries with own ones.
Reasons are:

=over

=item *           a) the linked library name contains a version number,

=back

=over

=item *           b) the linked library uses a fixed path,

=back

=over

=item *           c) the linked library is searched at a predefined path,

=back

=over

=item *           d) the executable checks the library version when loaded.

=back

Only the first one a) can be circumvented.  The last one d) can often
be ignored as it only prints a warning or error message.

To circumvent the "name with version number" problem try following:

=over

=item *         1) use L<ldd(1)|ldd(1)> (or a similar tool) to get the names used by openssl:

=back

	ldd /usr/bin/openssl

which returns something like:

	libssl.so.0.9.8 => /lib/libssl.so.0.9.8 (0x00007f940cb6d000)
	libcrypto.so.0.9.8 => /lib/libcrypto.so.0.9.8 (0x00007f940c7de000)
	libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f940c5d9000)
	libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f940c3c1000)
	libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f940c02c000)
	/lib64/ld-linux-x86-64.so.2 (0x00007f940cdea000)

Here only the first two libraries are important.  Both,  libcrypto.so
and libssl.so  need to be version "0.9.8" (in this example).

=over

=item *         2) create a directory for your libraries, for example:

=back

	mkdir /tmp/dada

=over

=item *         3) place your libraries there, assuming they are:

=back

	/tmp/dada/libssl.so.1.42
	/tmp/dada/libcrypto.so.1.42

=over

=item *         4) create symbolic links in that directory:

=back

	ln -s libssl.so.1.42    libssl.so.0.9.8
	ln -s libcrypto.so.1.42 libcrypto.so.0.9.8

=over

=item *         5) test program with following option:

=back

	o-saft.pl +libversion --lib=/tmp/dada
	o-saft.pl +list --v   --lib=/tmp/dada

or:

	o-saft.pl +libversion --lib=/tmp/dada -exe=/path/to-openssl
	o-saft.pl +list --v   --lib=/tmp/dada -exe=/path/to-openssl

=over

=item *         6) start program with your options, for example:

=back

	o-saft.pl --lib=/tmp/dada +ciphers

This works if L<openssl(1)|openssl(1)> uses the same shared libraries as
L<Net::SSLeay(3pm)|Net::SSLeay(3pm)>,  which most likely is the case.

It's tested with Unix/Linux only. It may work on other platforms also
if they support such an environment variable and the installed
L<Net::SSLeay(3pm)|Net::SSLeay(3pm)> and L<openssl(1)|openssl(1)> are linked using dynamic shared
objects.

Depending on  compile time settings  and/or  the location of the used
tool or lib, a warning like following may occur:

	WARNING: can't open config file: /path/to/openssl/ssl/openssl.cnf

This warning can be ignored, usually as  req  or  ca  sub commands of
openssl is not used here.
To fix the problem, either use  I<--openssl-cnf=FILE>  option or set the
the environment variable OPENSSL_CONF properly.

=head3 Cumbersome approach

A more cumbersome approach to call  this program is to set  following
environment variables in your shell:

	PATH=/tmp/dada-1.42/apps:$PATH
	LD_LIBRARY_PATH=/tmp/dada-1.42

=head3 Windows caveats

I.g. the used libraries on Windows are libeay32.dll and ssleay32.dll.

Windows also supports the LD_LIBRARY_PATH environment variable. If it
does not work as expected with that variable, it might be possible to
place the libs in the same directory as the  corresponding executable
(which is found by the PATH environment variable).

=head2 Using CGI mode

This script can be used as  CGI application. Output is the same as in
common CLI mode, using  C<Content-Type:text/plain>.  Keep in mind that
the used modules like L<Net::SSLeay(3pm)|Net::SSLeay(3pm)> will write some debug messages
on  STDERR instead  STDOUT.  Therefore multiple  I<--v>  and/or  I<--trace>
options behave slightly different.

No additional external files like  L</RC-FILE> or L</DEBUG-FILE>  are read in
CGI mode; they are silently ignored.
Some options are disabled in CGI mode  because they are dangerous  or
don't make any sense.

=head3 WARNING

There are  no  input data validation checks implemented herein. All
input data is url-decoded once and then used verbatim.
More advanced checks must be done outside before calling this tool.
Please see  o-saft.cgi  .

It is not recommended to run this tool in CGI mode.
You have been warned!

=head2 Using user specified code

There are some functions called within the program flow, which can be
filled with any Perl code.  Empty stubs of the functions are prepared
in  lib/OUsr.pm.  See also  L</USER-FILE> .

=head1 DEBUG

For debugging, tracing or using outdated modules, please see:

	o-saft.pl --help=development

=head1 TESTING

What is "testing"?
This tool itself is for testing something (TLS etc.),  so it needs to
be explained what testing here is about.  Following testing types are
distinguished:

=over

=item * User testing

=back

=over

=item * Functional testing

=back

=over

=item * Developer (internal) testing

=back

=over

=item * Testing results

=back

All descriptions intended for development and can be found with:

	o-saft.pl --help=development

=head2 User testing

During normal use of the tool, "testing" is only required for hunting
problems with the connected target. Following options for tracing and
verbosity can be used for that:

=head3 --v

Print more information about checks.

=head3 --trace

Print debugging messages.
For more details, please see  L</Options for tracing and debugging> .

=head2 Functional testing

=head2 Developer (internal) testing

=head2 Testing results

Please see:  C<o-saft.pl I<--help=development>>

=head1 EXAMPLES

(o-saft.pl in all following examples is the name of the tool)

=head2 General

	o-saft.pl +cipher some.tld
	o-saft.pl +info   some.tld
	o-saft.pl +check  some.tld
	o-saft.pl +quick  some.tld
	o-saft.pl +help=commands
	o-saft.pl +certificate  some.tld
	o-saft.pl +fingerprint  some.tld 444
	o-saft.pl +after +dates some.tld
	o-saft.pl +version
	o-saft.pl +version --v
	o-saft.pl +list
	o-saft.pl +list    --v

=head2 Some specials

=over

=item * Get an idea how messages look like

=back

	o-saft.pl +check --cipher=RC4 some.tld

=over

=item * Check for Server Name Indication (SNI) usage only

=back

	o-saft.pl +sni some.tld

=over

=item * Check for SNI and print certificate's subject and altname

=back

	o-saft.pl +sni +cn +altname some.tld

=over

=item * Check for all SNI, certificate's subject and altname issues

=back

	o-saft.pl +sni_check some.tld

=over

=item * Only print supported ciphers

=back

	o-saft.pl +cipher --enabled some.tld

=over

=item * Only print unsupported ciphers

=back

	o-saft.pl +cipher --disabled some.tld

=over

=item * Test for a specific ciphers

=back

	o-saft.pl +cipher --cipher=ADH-AES256-SHA some.tld

=over

=item * Test for DTLS ciphers only

=back

	o-saft.pl +cipher --no-tls

=over

=item * Test for SSL/TLS ciphers only

=back

	o-saft.pl +cipher --no-dtls

=over

=item * Test for TLSv1.3 ciphers only

=back

	o-saft.pl +cipher --no-tls --no-dtls --tlsv13

=over

=item * Consequently following tests no ciphers at all

=back

	o-saft.pl +cipher --no-tls --no-dtls

=over

=item * Test using a private libssl.so, libcrypto.so and openssl

=back

	o-saft.pl +cipher --lib=/foo/bar-1.42 --exe=/foo/bar-1.42/apps some.tld

=over

=item * Test using a private openssl

=back

	o-saft.pl +cipher --openssl=/foo/bar-1.42/openssl some.tld

=over

=item * Test using a private openssl also for testing supported ciphers

=back

	o-saft.pl +cipher --openssl=/foo/bar-1.42/openssl --force-openssl some.tld

=over

=item * Show supported (enabled) ciphers with their DH parameters:

=back

	o-saft.pl +cipher-dh --ciphermode=openssl example.tld

=over

=item * Check for all known ciphers (simple internal test function):

=back

	checkAllCiphers.pl example.tld
	checkAllCiphers.pl example.tld --range=full --v

=over

=item * Use your private texts in output

=back

	o-saft.pl +check some.tld --cfg-text=desc="my special description"

=over

=item * Use your private texts from rc-file

=back

	o-saft.pl --help=cfg-text >> .o-saft.pl
edit as needed: .o-saft.pl

	o-saft.pl +check some.tld

=over

=item * Use your private hint texts in output

=back

	o-saft.pl +check some.tld --cfg-hint=renegotiation="my special hint text"

=over

=item * Get the certificate's Common Name for a bunch of servers:

=back

	o-saft.pl +cn example.tld some.tld other.tld
	o-saft.pl +cn example.tld some.tld other.tld --showhost --no-header

=over

=item * Generate simple parsable output

=back

	o-saft.pl --legacy=quick --no-header +info  some.tld
	o-saft.pl --legacy=quick --no-header +check some.tld
	o-saft.pl --legacy=quick --no-header --trace-key +info  some.tld
	o-saft.pl --legacy=quick --no-header --trace-key +check some.tld

=over

=item * Generate simple parsable output for multiple hosts

=back

	o-saft.pl --legacy=quick --no-header --trace-key --showhost +check some.tld other.tld

=over

=item * Just for curiosity

=back

	o-saft.pl some.tld +fingerprint --format=raw
	o-saft.pl some.tld +certificate --format=raw | openssl x509 -noout -fingerprint

=head2 Testing with exit code

=over

=item * Test SSL/TLS connection and return exit code

=back

	o-saft.pl +check  --exitcode  some.tld

=over

=item * Test ciphers and return exit code with details about exit code

=back

	o-saft.pl +cipher --exitcode --exitcode-v  some.tld

=over

=item * Test ciphers and return exit code for ciphers only

=back

	o-saft.pl +cipher --exitcode --exitcode-no-prot  some.tld

=over

=item * Test with exit code but avoid checks considered C<yes> even if C<no>

=back

	o-saft.pl +check  --exitcode --ignore-out=ev- --ignore-out=rfc_7525 some.tld

=head2 Specials for hunting problems with connections etc.

=over

=item * Do not read rc-file .o-saft.pl

=back

	o-saft.pl +info some.tld --no-rc

=over

=item * Show command-line argument processing

=back

	o-saft.pl +info some.tld --trace-arg

=over

=item * Simple tracing

=back

	o-saft.pl +cn   some.tld --trace
	o-saft.pl +info some.tld --trace

=over

=item * A bit more tracing

=back

	o-saft.pl +cn   some.tld --trace --trace

=over

=item * Show internal variable names in output

=back

	o-saft.pl +info some.tld --trace-key

=over

=item * Show internal argument processeing

=back

	o-saft.pl +info --trace-arg some.tld

=over

=item * Show internal control flow

=back

	o-saft.pl +info some.tld --v
	o-saft.pl +info some.tld --trace-me

=over

=item * Show internal timing

=back

	o-saft.pl +info some.tld --trace-time

=over

=item * Show checking ciphers

=back

	o-saft.pl +cipher some.tld --v

=over

=item * Show checking ciphers

=back

	o-saft.pl +cipher some.tld --v --v --ciphermode=openssl

=over

=item * Show values retrieved from target certificate directly

=back

	o-saft.pl +info some.tld --no-cert --no-cert --no-cert-text=Value-from-Certificate

=over

=item * Show certificate CA verifications

=back

	o-saft.pl some.tld +chain_verify +verify +error_verify +chain

=over

=item * Avoid most performance and timeout problems (don't use  --v --trace)

=back

	o-saft.pl +info some.tld --no-dns --no-sni --ignore-no-conn
	o-saft.pl +info some.tld --no-dns --no-sni --no-cert --no-http --no-openssl

=over

=item * Identify timeout problems

=back

	o-saft.pl +info some.tld --v --trace-time

this will show lines containing:
#O-Saft  CMD: test ...

=head1 DOCUMENTATION

For a description how documentation is organised, please see:

perldoc o-saft.pl

The documentation here focuses on user part only.

=head2 User documentation

The complete user documentation (or "help") is provided with:

	o-saft.pl --help

But it may be difficult to find the proper information there.  To get
more selective documentations, the  I<--help=*>  options can be used. To
get an overview which  I<--help=*>  options are available, use:

	o-saft.pl --help=HELP

It can be used to get well known parts of the documentation specified
by the keyword, (C<HELP> in example above).
To find any text with some lines of context, following could be used:

	o-saft.pl --help | egrep -i -C 3 "some text"

This is simply avaiable with the wrapper tool "o-saft":

o-saft --help="some text"

In the GUI a more sophisticate search is implemented, see the  "Help"
window there:

	o-saft.tcl 

All files used for documentation, wether source files, or contributed
files, or generated files, are located in the  doc/  directory.

=head2 Developer documentation

To get used to documentation for developers, best start reading:

doc/concepts.txt
perldoc t/Makefile.pod

=head1 ATTRIBUTION

Based on ideas (in alphabetical order) of:

=over

=item * cnark.pl, SSLAudit.pl sslscan, ssltest.pl, sslyze.py, testssl.sh

=back

=over

=item * O-Saft - OWASP SSL advanced forensic tool

=back

Thanks to Gregor Kuznik for this title.

=over

=item * Basic cipher check and some proxy functionality implemented by Torsten Gigler.

=back

=over

=item * For re-writing some docs in proper English, thanks to Robb Watson.

=back

=over

=item * Code to check heartbleed vulnerability adapted from

=back

Steffen Ullrich (08. April 2014):
https://github.com/noxxi/p5-scripts/blob/master/check-ssl-heartbleed.pl

=over

=item * Colouration inspired by https://testssl.sh/ .

=back

=head1 VERSION

@(#) 24.01.24

=head1 AUTHOR

31. July 2012 Achim Hoffmann

Project Home: https://owasp.org/www-project-o-saft/

=head1 TODO

=over

=item * new features

=back

=over

=item ** client certificate

=back

=over

=item ** some STRATTLS need : HELP STARTTLS HELP as output of HELPs are different

=back

=over

=item ** Checking fallback from TLS 1.1 to TLS 1.0 (see ssl-cipher-check.pl)

=back

=over

=item ** Minimal encryption strength: weak encryption (40-bit) (TestSSLServer.jar)

=back

=over

=item * missing checks

=back

=over

=item ** SSL_honor_cipher_order => 1

=back

=over

=item ** implement TLSv1.2 checks

=back

=over

=item ** DNSEC and TLSA

=back

=over

=item ** checkcert(): KeyUsage, keyCertSign, BasicConstraints

=back

=over

=item ** DV and EV miss some minor checks; see checkdv() and checkev()

=back

=over

=item ** +constraints does not check +constraints in the certificate of

=back

the certificate chain.

=over

=item ** TR-03116-4: does not check data in certificate chain

=back

=over

=item ** RFC 7525: does not check data in certificate chain

=back

=over

=item ** RFC 7525: 3.2.  Strict TLS (for C<STARTTLS>)

=back

=over

=item ** RFC 7525: 3.4.  TLS Session Resumption (session ticket must be

=back

authenticated and encrypted)

=over

=item ** RFC 7525: 3.6.  Server Name Indication (more reliable check)

=back

=over

=item ** RFC 7525: 4.3.  Public Key Length (need more reliable check)

=back

=over

=item ** RFC 7525: 6.2.  AES-GCM

=back

=over

=item ** RFC 7525: 6.3.  Forward Secrecy

=back

=over

=item ** RFC 7525: 6.4.  Diffie-Hellman Exponent Reuse

=back

=over

=item * vulnerabilities

=back

=over

=item ** Ticketbleed

=back

=over

=item ** complete TIME, BREACH check

=back

=over

=item ** BEAST more checks, see: http://www.bolet.org/TestSSLServer/

=back

=over

=item * verify CA chain:

=back

=over

=item ** lib/SSLinfo.pm implement verify*

=back

=over

=item ** implement +check_chain (see lib/SSLinfo.pm implement verify* also)

=back

=over

=item ** implement +ca = +verify +chain +rootcert +expired +fingerprint

=back

=over

=item * postprocessing

=back

Remove all options for output formatting. Use a "postprocess" script
instead.

=over

=item ** scoring

=back

implement score for PFS; lower score if not all ciphers support PFS
make clear usage of score from %checks

=over

=item ** write postprocessor for tabular data, like

=back

ssl-cert-check -p 443 -s mail.google.com -i -V

=over

=item * lib/SSLinfo

=back

=over

=item ** Net::SSLeay::ctrl()  sometimes fails, but doesn't return error message

=back

=over

=item ** Net::SSLeay::CTX_clear_options()

=back

Need to check the difference between the  SSL_OP_LEGACY_SERVER_CONNECT  and
SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;  see also SSL_clear_options().
see https://www.openssl.org/docs/ssl/SSL_CTX_set_options.html

=over

=item ** lib/SSLinfo::do_ssl_close()  does not really work

=back

=over

=item * Windows

=back

=over

=item ** Unicode:

=back

try: cmd /K chcp 65001
or:  chcp 65001
or:  reg add hklm\system\currentcontrolset\control\nls\codepage -v oemcp -d 65001

=over

=item ** perl

=back

perl 5.10.x from PortableApps does not work, because it misses
IO/Socket/SSL.pm, however, checkAllCiphers.pl works.
perl from older PortableApps/xampp (i.e. 1.7.x) does not work,
because IO/Socket/SSL.pm is too old (1.37).

=over

=item ** Windows

=back

on Windows print of strings > 32k does not work.
Ugly workaround using I<--v> implemented in lib/OMan.pm only.

=over

=item * internal

=back

=over

=item ** move all configuration and code for command-line arguments to Arg.pm

=back

=over

=item ** use qr() for defining regex, see $cfg{C<regex>}

=back

=over

=item ** print_line() has ugly code for legacy=cipher

=back

=over

=item ** "Label" texts are defined twice: o-saft.pl and Net::SSLeay

=back

=over

=item ** make a clear concept how to handle +CMD whether they report

=back

checks or information (a.k.a %data vs. %check_*)
currently (2016) each single command returns all values

=over

=item ** client certificates not yet implemented in _usesocket() _useopenssl(),

=back

see t.client-cert.txt

=over

=item ** (nicht wichtig, aber sauber programmieren)

=back

_get_default(): lib/SSLinfo::default() benutzen

Generated with:

        o-saft.pl --no-warnings --no-header --help=gen-pod > o-saft.pod

=cut

# begin abbr

# =head1 abbr


# # SID	@(#) glossary.txt 3.2 24/05/27 10:39:10
# 
# # acronym | description
# #------+----------------------------------------------------------------------+
# 0-Length OpenSSL	invalid MAC, valid padding with 0-length record (variant of POODLE exploit)
# 0-RTT	zero Round-Trip Time
# 3Fish	see Threefish
# 3SHAKE	sometimes for: TLS Triple Handshake Attack
# AA	Attribute Authority
# AAD	Additional Authenticated Data
# ACME	Automated Certificate Management Environment
# ACL	Access Control List
# Achterbahn	80-, 128-bit key stream cipher (2006)
# ACHTERBAHN-80	see Achterbahn
# ACHTERBAHN-128	see Achterbahn
# Adiantum	ChaCha stream cipher with Poly1305 and XChaCha12
# ADH	Anonymous Diffie-Hellman
# Adler32	hash function
# AE	Authenticated Encryption
# AEAD	Authenticated Encryption with Additional Data
# AECDHE	Anonymous Ephemeral ECDH
# AEM	Authenticated Encryption Mode aka Advanced Encryption Mode aka OCB3
# AES	Advanced Encryption Standard, symmetric block cipher
# AESCCM	AES with CCM
# AESCCM8	AES with CCM8
# AESGCM	AEAD algorithms AEAD_AES_128_GCM and AEAD_AES_256_GCM
# AES-CCM	alias for AESCCM
# AES-GCM	alias for AESGCM
# # AES-GCM	AES-GCM is an authenticated encryption mode that uses the AES block cipher in counter mode with a polynomial MAC based on Galois field multiplication.
# AES-GCM-SIV	Nonce Misuse-Resistant Authenticated Encryption (RFC8452)
# AES-CTR	?
# AES-XTS	?
# AIA	Authority Information Access (certificate extension)
# AKC	Agreement with Key Confirmation
# AKID	Authority Key IDentifier
# ALPN	Application Layer Protocol Negotiation
# ALPACA	Application Layer and Content Confusion Attack	(Exploit SSL/TLS)
# AMASTRID	stream cipher
# Anubis	128-bit symmetric block cipher
# ARC4	Alleged RC4 (see RC4)
# ARCFOUR	alias for ARC4
# Argon2	Password hashing function (J. Aumasson, 2014)
# Argon2d	variant of Argon2
# Argon2i	variant of Argon2
# Argon2id	variant of Argon2
# ARIA	128-bit symmetric block cipher
# ARX	add–rotate–xor
# ASN	Autonomous System Number
# ASN.1	Abstract Syntax Notation number One
# AtE	Authenticate-then-Encrypt (see also MtE)
# BACPA	Blockwise-Adaptive Chosen-Plaintext Attack
# BADA55	"locate weak cryptography somewhere", Bernstein, Lange, et al.
# BADA55-VPR-224	improved verifiably pseudorandom 224-bit curve
# BADA55-VR-224	curve using the same prime as NIST P-224
# BADA55-VR-256	curve using the same prime as NIST P-256
# BADA55-VR-384	curve using the same prime as NIST P-384
# Bar Mitzvah	vulnerabilty of TLS sessions protected with RC4
# BDH	Bilinear Diffie-Hellman
# BEAR	block cipher combining stream cipher and hash function
# BEAST	Browser Exploit Against SSL/TLS	(Exploit SSL/TLS)
# BEAST .	fast block cipher for arbitrary blocksizes (rarely)
# BER	Basic Encoding Rules
# BGP	Boorder Gateway Protocol
# bcrypt	hash function (Niels Provos, David Mazières, 1999)
# BLAKE	hash function (Jean-Philippe Aumasson, Luca Henzen, Willi Meier, Raphael C.-W. Phan, 2008)
# BLAKE2	fast secure hashing function (2012)
# BLAKE2b	see BLAKE (64 bit)
# BLAKE2s-128	see BLAKE (32 bit)
# BLAKE3	fast secure hashing function (20??)
# BLAKE3	??
# BLAKE-32	see BLAKE (32 bit)
# BLAKE-64	see BLAKE (64 bit)
# BLAKE-224	see BLAKE (224 bit)
# BLAKE-256	see BLAKE (256 bit)
# BLAKE-384	see BLAKE (384 bit)
# BLAKE-512	see BLAKE (512 bit)
# Blowfish	64-bit symmetric block cipher (1993)
# boomerang attack	attack on BLAKE
# BPA	Branch Prediction Analysis
# Brainpool	signature algorithm, from BSI
# BREACH	Browser Reconnaissance & Exfiltration via Adaptive Compression of Hypertext; a variant of CRIME	(Exploit SSL/TLS)
# Bullrun	NSA program to break encrypted communication
# CAMELLIA	encryption algorithm (by Mitsubishi and NTT), 128-bit symmetric block cipher
# CAST	Carlisle Adams and Stafford Tavares, symmetric block cipher
# CAST-128	Carlisle Adams and Stafford Tavares, 64-bit symmetric block cipher
# CAST5	alias for CAST-128
# CAST-256	Carlisle Adams and Stafford Tavares, 128-bit symmetric block cipher
# CAST6	alias for CAST-256
# cipher suite	cipher suite is a named combination of authentication, encryption, and message authentication code algorithms
# CA	Certificate Authority (aka root CA)
# CAA	Certificate Authority Authorization
# CAA RR	CAA Resource Record
# CBC	Cyclic Block Chaining
# CBC 	Cipher Block Chaining (sometimes)
# CBC  	Ciplier Block Chaining (sometimes)
# CBC-MAC	Cipher Block Chaining - Message Authentication Code
# CBC-MAC-ELB	Cipher Block Chaining - Message Authentication Code - Encrypt Last Block
# CBC3	alias for Tripple DES (sometimes, used in cipher suite names)
# CCA	chosen-ciphertext attack
# CCM	Counter with CBC-MAC Mode (authenticated encryption block cipher mode) (with 16-octet authentication tag)
# CCM-8	Counter with CBC-MAC Mode (authenticated encryption block cipher mode) (with 8-octet authentication tag)
# CCS	Change Cipher Spec (protocol)
# CDH	?  Diffie-Hellman
# CDP	CRL Distribution Points
# CECPQ1	key-agreement algorithm; Combined elliptic Curve and Post-Quantum Cryptography Key Exchange
# CECPQ2	Combined elliptic Curve and Post-Quantum Cryptography Key Exchange
# CEK	Content Encryption Key
# CFB	Cipher Feedback
# CFB3	Cipher Feedback
# CFBx	Cipher Feedback x bit mode
# CFRG	Crypto Forum Research Group
# CGN	Carrier- Grade NAT (RFC6598)
# ChaCha	256-bit key stream cipher
# ChaCha8	see ChaCha
# ChaCha12	see ChaCha (aka 12-round ChaCha)
# ChaCha20	see ChaCha (aka 20-round ChaCha)
# ChaCha-Poly1305	Authenticated Encryption with Associated Data (AEAD)
# CHAP	Challenge Handshake Authentication Protocol
# CLEFIA	lightweight 128-bit block cipher
# CKA	(PKCS#11)
# CKK	(PKCS#11)
# CKM	(PKCS#11)
# CMAC	Cipher-based MAC
# CMC	CBC-mask-CBC
# CMP	X509 Certificate Management Protocol
# CMS	Cryptographic Message Syntax
# CMVP	Cryptographic Module Validation Program (NIST)
# CN	Common Name
# CNT_IMIT	cipher suite
# CTR_OMAC	cipher suite (GOST R 34.12-2015 aka GOST3412-2015)
# CP	Certificate Policy (certificate extension)
# CPA	chosen-plaintext attack
# CPD	Certificate Policy Definitions
# CPS	Certification Practice Statement
# CRC	Cyclic Redundancy Check
# CRC8	CRC with polynomial length 8
# CRC16	CRC with polynomial length 16
# CRC32	CRC with polynomial length 32
# CRC64	CRC with polynomial length 64
# CRAM	Challenge Response Authentication Mechanism
# CRIME	Compression Ratio Info-leak Made Easy	(Exploit SSL/TLS)
# CRL	Certificate Revocation List
# CRYPTON	128-bit block cipher (1998)
# CRYPTREC	Cryptography Research and Evaluation Committees
# CRYSTALS	post-quantum hash function, signature
# CRYSTALS-Dilithium	post-quantum hash function, signature
# CRYSTALS-Kyber	post-quantum hash function, signature
# CSP	Certificate Service Provider
# CSP 	Cryptographic Service Provider
# CSP  	Critical Security Parameter (used in FIPS 140-2)
# CSP:	Content Security Policy (used as HTTP header)
# CSR	Certificate Signing Request
# CSPRNG	Cryptographically Secure Pseudo-Random Number Generator
# CT	Certificate Transparency
# CTL	Certificate Trust Line
# CTR	Counter Mode (sometimes: CM; block cipher mode)
# CTS	Cipher Text Stealing
# Curve448	signature algorithm, aka Goldilocks (224 bit)
# Curve25519	signature algorithm by Dan J. Bernstein (ca. 128 bit)
# CWC	CWC Mode (Carter-Wegman + CTR mode; block cipher mode)
# CyaSSL	formerly name of wolfSSL
# DAA	Data Authentication Algorithm
# DAC	Data Authentication Code
# DACL	Discretionary Access Control List
# DANE	DNS-based Authentication of Named Entities
# DDH	Decisional Diffie-Hellman (Problem)
# DEA	Data Encryption Algorithm (sometimes a synonym for DES)
# DEAL	128-bit symmetric block cipher (Lars Knudsen, 1998)
# DECIPHER	synonym for decryption
# DEK	Data Encryption Key
# DER	Distinguished Encoding Rules
# DES	Data Encryption Standard
# DESede	alias for 3DES ?java only?
# DESX	extended DES
# 3DES	Tripple DES (168 bit)
# 3DES-EDE	alias for 3DES
# 3TDEA	Three-key  Tripple DEA (sometimes: Tripple DES; 168 bit)
# 2TDEA	Double-key Tripple DEA (sometimes: Double DES; 112 bit)
# D5	Verhoeff's Dihedral Group D5 Check
# DH	Diffie-Hellman
# DHE	Diffie-Hellman ephemeral (historic acronym, often used, mainly in openssl)
# Dilithium	digital signature scheme
# Dilithium2-AES	alias for Dilithium
# Dilithium3-AES	alias for Dilithium
# Dilithium5-AES	alias for Dilithium
# DLIES	Discrete Logarithm Integrated Encryption Scheme
# DLP	Discrete Logarithm Problem
# DN	Distinguished Name
# DNSSEC	DNS Security Extension
# DPA	Dynamic Passcode Authentication (see CAP)
# DRAGON	stream cipher (2007)
# DRG	Deterministic Random Generator
# DRBG	Deterministic Random Bit Generator
# DROWN	Decrypting RSA with Obsolete and Weakened eNcryption	(Exploit SSL/TLS)
# DSA	Digital Signature Algorithm
# DSCP	Differentiated Services Code Point
# DSPR	?
# DSS	Digital Signature Standard
# DTLS	Datagram TLS
# DTLSv1	Datagram TLS 1.0
# Dual EC DBRG	Dual Elliptic Curve Deterministic Random Bit Generator (NIST)
# Dual_EC_DBRG	Dual Elliptic Curve Deterministic Random Bit Generator (NIST)
# DV	Domain Validation
# DV-SSL	Domain Validated Certificate
# EAL	Evaluation Assurance Level
# EAP	Extensible Authentication Protocol
# EAP-PSK	Extensible Authentication Protocol using a Pre-Shared Key
# EAX	Encrypt-then-Authenticate-then-Translate
# EAX 	EAX Mode (block cipher mode)
# EAXprime	alias for EAX Mode
# EBC	Edge Boundery Controller
# EC	Elliptic Curve
# ECB	Electronic Code Book mode (block cipher mode)
# ECC 	Error Corection Code
# ECC	Elliptic Curve Cryptography
# ECCSI	Elliptic Curve-Based Certificateless Signatures for Identity-Based Encryption
# ECDH	Elliptic Curve Diffie-Hellman
# ECDHE	Ephemeral ECDH
# ECDHE_ECDSA	Ephemeral ECDH with ECDSA or EdDSA signatures
# ECDHE_RSA	Ephemeral ECDH with RSA signatures
# ECDH_anon	Anonymous ephemeral ECDH, no signatures
# ECDLP	Elliptic Curve Discrete Logarithm Problem
# ECDSA	Elliptic Curve Digital Signature Algorithm
# ECDSA-256	Elliptic Curve Digital Signature Algorithm (256 bits)
# ECDSA-384	Elliptic Curve Digital Signature Algorithm (384 bits)
# ECDSA-521	Elliptic Curve Digital Signature Algorithm (521 bits)
# ECGDSA	Elliptic Curve ??? DSA
# ECHO	hash function (Ryad Benadjila, Olivier Billet, Henri Gilbert, Gilles Macario-Rat, Thomas Peyrin, Matt Robshaw, Yannick Seurin, 2010)
# ECIES	Elliptic Curve Integrated Encryption Scheme
# ECKA	Elliptic Curve Key Agreement
# ECKA-EG	Elliptic Curve Key Agreement of ElGamal Type
# ECKDSA	Elliptic Curve ??? DSA
# ECMQV	Elliptic Curve Menezes-Qu-Vanstone
# ECN	Explicit Congestion Notification
# ECOH	Elliptic Curve only hash
# # ECRYPT	??
# ECSVDP-DH	Elliptic Curve Secret Value Derivation Primitive, Diffie-Hellman version
# Ed25519	alias for Curve25519
# Ed448	alias for Curve448
# edwards25519	alias for Curve25519
# edwards448	alias for Curve448
# EdDSA	alias for signatures using public key and private key formats, like Curve448 and Curve25519
# EDE	Encryption-Decryption-Encryption
# EDH	Ephemeral Diffie-Hellman
# EGADS	Entropy Gathering and Distribution System
# EGD	Entropy Gathering Daemon
# EKU	Extended Key Usage
# ELB	Encrypt Last Block
# ElGamal	asymmetric block cipher
# ENCIPHER	synonym for encryption
# EME	ECB-mask-ECB
# EME 	Encoding Method for Encryption
# EMS 	Extended Master Secret (sometimes)
# EMS 	Encrypted Master Secret
# ESNI	Encrypted Server Name Indication
# ESP	Encapsulating Security Payload
# ESSIV	Encrypted salt-sector initialization vector
# EtA	Encrypt-then-Authenticate (see also EtM)
# E&A	Encrypt-and-Authenticate (see also E&M)
# E&M	Encrypt-and-MAC (see also E&A)
# EtM	Encrypt-then-MAC (see also EtA)
# eTLS	Enterprise TLS (social attack on privacy by ETSI; renamed to ETS)
# ETS	Enterprise Transport Security (renamed from eTLS)
# ETSI-TS	European Telecommunications Standards Institute - Technical Specification
# EV	Extended Validation
# EV-SSL	Extended Validation Certificate
# FALCON	Fast-Fourier Lattice-based Compact Signatures over NTRU; post-quantum signature
# FEAL	Fast Data Encryption Algorithm
# FFC	Finite Field Cryptography
# FFT	Fast Fourier Transform
# FIPS	Federal Information Processing Standard
# FIPS46-2	FIPS Data Encryption Standard (DES)
# FIPS73	FIPS Guidelines for Security of Computer Applications
# FIPS140-2	FIPS Security Requirements for Cryptographic Modules
# FIPS140-3	proposed revision of FIPS 140-2
# FIPS180-3	FIPS Secure Hash Standard
# FIPS186-3	FIPS Digital Signature Standard (DSS)
# FIPS197	FIPS Advanced Encryption Standard (AES)
# FIPS198-1	FIPS The Keyed-Hash Message Authentication Code (HMAC)
# FREAK	Factoring Attack on RSA-EXPORT Keys	(Exploit SSL/TLS)
# FQDN	Fully-qualified Domain Name
# FSB	Fast Syndrome Based Hash
# FSM	Finite State Machine
# FZA	FORTEZZA
# G-DES	??? DES
# GCM	Galois/Counter Mode (authenticated encryption block cipher mode)
# GHASH	Hash funtion used in GCM
# GMAC	MAC for GCM
# Grøstl	hash function (Lars Knudsen, 2010)
# GOLDENPOODLE	valid padding with an invalid MAC (variant of POODLE exploit)
# Goldilocks	see Curve448
# GOST	Gossudarstwenny Standard, 64-bit symmetric block cipher (1994)
# GOST 	hash function (used in GOST cipher suite)
# GOST28147-89	block cipher (RFC5830)
# GOST3410-2012	signature algorithm
# GOST3411-2012	hash algorithm
# GOST3412-2015	block cipher
# GOST3413-2015	modes of operation for block ciphers
# GOST3431095	see GOST28147-89
# GOST3431004	see GOST28147-89
# GOST3431195	see GOST28147-89
# GOSTR341001	see GOST28147-89
# GOSTR341094	see GOST28147-89
# GOSTR341194	see GOST28147-89
# GOSTR341122015	GOST R 34.12-2015 (RFC7801, RFC8891), see GOST28147-89
# Grainv1	stream cipher (64-bit IV)
# Grainv128	stream cipher (96-bit IV)
# GREASE	Generate Random Extensions And Sustain Extensibility
# GRØSTL256	hash function
# GRØSTL512	hash function
# GROESTL256	alias for GRØSTL256
# GROESTL512	alias for GRØSTL512
# HAIFA	HAsh Iterative FrAmework
# hash127	fast hash function (by Dan Bernstein)
# HAVAL	one-way hashing
# HAS-160	hash function
# HAS-V	hash function
# HC128	alias for HC128
# HC256	alias for HC256
# HC-128	128-bit key stream cipher (2004)
# HC-256	256-bit key stream cipher (2004)
# HCH	Hash-Coputer-Hash
# HCTR	a variable-input-length encryption mode
# HEARTBLEED	attack against TLS extension heartbeat
# HEIST	HTTP Encrypted Information can be Stolen through TCP-windows
# HIBE	hierarchical identity-based encryption
# HKDF	HMAC-based Extract-and-Expand Key Derivation Function
# HNF-256	hash function (Harshvardhan Tiwari, Krishna Asawa, 2014)
# HMAC	keyed-Hash Message Authentication Code (aka Hashed MAC)
# HMQV	h? Menezes-Qu-Vanstone
# HPC	Hasty Putting Cipher
# HPKP	HTTP Public Key Pinning
# HPolyC	ChaCha stream cipher with Poly1305 and XChaCha12, XChaCha20
# HRSS	encryption algorithm
# HSM	Hardware Security Module
# HSR	Header + Secret + Random
# HSTS	HTTP Strict Transport Security
# HTOP	HMAC-Based One-Time Password
# IAPM	Integrity Aware Parallelizable Mode (block cipher mode of operation)
# IBE	Identity-Based Encryption
# ICM	Integer Counter Mode (alias for CTR)
# IDP	Issuing Distribution Points
# IDEA	International Data Encryption Algorithm (by James Massey and Xuejia Lai)
# IESG	Internet Engineering Steering Group
# IETF	Internet Engineering Task Force
# IFC	Integer Factorization Cryptography
# IGE	Infinite Garble Extension
# IKE	Internet Key Exchange
# IKEv2	IKE version 2
# IND-BACPA	Indistinguishability of encryptions under blockwise-adaptive chosen-plaintext attack
# IND-CCA	Indistinguishability of encryptions under chosen-cipgertext attack
# IND-CPA	Indistinguishability of encryptions under chosen-plaintext attack
# INT-CTXT	Integrity of ciphertext
# INT-PTXT	Integrity of plaintext
# IRTF	Internet Research Task Force
# ISAKMP	Internet Security Association and Key Management Protocol
# IV	Initialization Vector
# JH	hash function (Hongjun Wu, 2011)
# JH-224	see JH (224 bits)
# JH-256	see JH (256 bits)
# JH-384	see JH (384 bits)
# JH-512	see JH (512 bits)
# Jolkit-BC	tweakable block cipher
# JSSE	Java Secure Socket Extension
# KATAN	lightweight block cipher
# KASUMI	64-bit symmetric block cipher (successor of MISTY1, broken 2005)
# KLEIN	lightweight block cipher
# Keccak	hash function (Guido Bertoni, Joan Daemen, Michaël Peeters und Gilles Van Assche, 2012)
# KCI	Key Compromise Impersonation
# KDC	Key Distribution Center (mainly Kerberos)
# KDF	Key Derivation Function
# KEA	Key Exchange Algorithm (alias for FORTEZZA-KEA)
# KEK	Key Encryption Key
# KEM	Key Encapsulation Mechanisms
# KMS	Key Management Service
# KPAK	KMS Public Authentication Key
# KRB	Key Exchange Kerberos
# KRB5	Key Exchange Kerberos 5
# KSAK	KMS Secret Authentication Key
# KSK	Key Signing Key (DNSSEC)
# KU	Key Usage
# Kuznyechik	block cipher  (used in GOST)
# Magma	block cipher  (used in GOST)
# LAKE	hash function (Jean-Philippe Aumasson, Willi Meier, Raphael C.-W. Phan, 2008)
# LEA	? algorithm
# LEA-128	see LEA
# LEA-256	see LEA
# LED	lightweight block cipher
# LEXv2	stream cipher
# LFSR	Linear Feedback Shift Register
# LION	variable block-length symmetric block cipher (2007)
# LION 	hash function (2007)
# LLL	Lenstra–Lenstra–Lovász, lattice basis reduction algorithm
# LM hash	LAN Manager hash aka LanMan hash
# LogJam	Attack to force server to downgrade to export ciphers	(Exploit SSL/TLS)
# Logjam	see LogJam
# LRA	Local Registration Authority
# LRW	Liskov, Rivest, and Wagner (block encryption)
# LSN	large-scale NAT (same as CGN)
# Lucifer	block cipher (developed at IBM in the 1970s)
# Lucky13	Break SSL/TLS Protocol with ciphers using CBC-mode	(Exploit SSL/TLS)
# Lucky 13	Break SSL/TLS Protocol	(Exploit SSL/TLS)
# Lucky Thirteen	see Lucky 13
# Magenta	128-bit symmetric block cipher (Deutsche Telekom 1990, broken 1998)
# MANTIS	block cipher, low-latency variant of SKINNY
# MARS	128-bit symmetric block cipher (developed at IBM)
# MAC	Message Authentication Code
# MCF	Modular Crypt Format
# MDC	Modification Detection Code
# MDC2	Modification Detection Code 2 aka Meyer-Schilling
# MDC-2	same as MDC2
# MD2	Message Digest 2
# MD4	Message Digest 4
# MD5	Message Digest 5
# MEE	MAC-then-Encode-then-Encrypt (see also MtE, AtE)
# MEK	Message Encryption Key
# MECAI	Mutually Endorsing CA Infrastrukture
# MGF	Mask Generation Function
# MIDORI	lightweight 64-, 128-bit block cipher (2015)
# Midori64	see MIDORI
# Midori128	see MIDORI
# MISTY	Mitsubishi Improved Security Technology aka Matsui, Ischikawa, Sorimachi, Yamagishi
# MISTY1	64-bit symmetric block cipher (1995)
# MISTY2	?
# MPQS	Multiple Polynomial Quadratic Sieve
# MQV	Menezes-Qu-Vanstone (authentecated key agreement)
# MS-SSTP	see SSTP
# MtE	MAC-then-encrypt (see also AtE)
# NaCl	"Salt", crypto library (by D. Bernstein, Tanja Lange, Peter Schwabe)
# NCP	Normalized Certification Policy (according TS 102 042)
# NOEKEON	128-bit symmetric block cipher (2000)
# Neokeon	see NOEKEON (probaly typo)
# NewHope	post-quantum key exchange
# nistp192	alias for P-192
# nistp224	alias for P-224
# nistp256	alias for P-256
# nistp384	alias for P-384
# nistp521	alias for P-521
# NLSv2	stream cipher
# nonce	(arbitrary) number used only once
# NPN	Next Protocol Negotiation
# NSS	Network Security Services
# NTG	none-Deterministic Random Generator
# NTLM	NT Lan Manager. Microsoft Windows challenge-response authentication method.
# NTRU	asymmetric cipher using lattice reduction (1996)
# NTRUEncrypt	alias for NTRU
# NOMORE	Numerous Occurrence MOnitoring & Recovery Exploit, aka RC4 NOMORE
# NULL	no encryption
# NUMS	nothing up my sleeve numbers
# OAEP	Optimal Asymmetric Encryption Padding
# OCB	Offset Codebook Mode (block cipher mode of operation)
# OCB1	same as OCB
# OCB2	improved OCB aka AEM
# OCB3	improved OCB2
# OCELOT1	stream cipher
# OCELOT2	stream cipher
# OCSP	Online Certificate Status Protocol
# OCSP stapling	formerly known as: TLS Certificate Status Request
# OFB	Output Feedback
# OFBx	Output Feedback x bit mode
# OID	Object Identifier
# OMAC	One-Key CMAC, aka CBC-MAC
# OMAC1	same as CMAC
# OMAC2	same as OMAC
# OPIE	One-time pad Password system
# ORYX	96-bit key stream cipher (broken 1998)
# OTP	One Time Pad
# OV	Organisational Validation
# OV-SSL	Organisational Validated Certificate
# P12	see PKCS#12
# P7B	see PKCS#7
# P-192	Elliptic Curve used in FIPS 186-4 (NIST)
# P-224	Elliptic Curve used in FIPS 186-4 (NIST)
# P-256	Elliptic Curve used in FIPS 186-4 (NIST)
# P-384	Elliptic Curve used in FIPS 186-4 (NIST)
# P-521	Elliptic Curve used in FIPS 186-4 (NIST)
# PACE	Password Authenticated Connection Establishment
# PAD	Peer Authorization Database
# PAKE	Password Authenticated Key Exchange
# Panama	256-bit key stream cipher (1998)
# Panama 	hash funcrion (1998, broken 2001)
# PCN	Pre-Congestion Notification
# PBE	Password Based Encryption
# PBKDF2	Password Based Key Derivation Function
# PC	Policy Constraints (certificate extension)
# PCBC	Propagating Cipher Block Chaining
# PCFB	Periodic Cipher Feedback Mode
# PCT	Private Communications Transport
# PEM	Privacy Enhanced Mail
# PES	Proposed Encryption Standard
# PFS	Perfect Forward Secrecy
# PFX	see PKCS#12 (Personal Information Exchange)
# PGP	Pretty Good Privacy
# PII	Personally Identifiable Information
# Picollo	lightweight block cipher
# PKCS	Public Key Cryptography Standards
# PKCS1	PKCS #1: RSA Encryption Standard
# PKCS3	PKCS #3: RSA Encryption Standard on how to implement the Diffie-Hellman key exchange protocol
# PKCS5	PKCS #5: RSA Encryption Standard on how to derive cryptographic keys from a password
# PKCS6	PKCS #6: RSA Extended Certificate Syntax Standard
# PKCS7	PKCS #7: RSA Cryptographic Message Syntax Standard
# PKCS8	PKCS #8: RSA Private-Key Information Syntax Standard
# PKCS10	PKCS #10: Describes a standard syntax for certification requests
# PKCS11	PKCS #11: RSA Cryptographic Token Interface Standard (keys in hardware devices, cards)
# PKCS12	PKCS #12: RSA Personal Information Exchange Syntax Standard (public + private key stored in files)
# PKE	Public Key Enablement
# PKI	Public Key Infrastructure
# PKIX	Internet Public Key Infrastructure Using X.509
# PKP	Public-Key-Pins
# PM	Policy Mappings (certificate extension)
# PMAC	Parallelizable MAC (by Phillip Rogaway)
# PMS	Pre-Master Secret
# Poly1305	Authenticator (MAC)
# Poly1305-AES	MAC (by D. Bernstein)
# POP	Proof of Possession
# POODLE	Padding Oracle On Downgraded Legacy Encryption	(Exploit SSL/TLS)
# PQC	Post-Quantum Crypto
# PRESENT	64-bit block symmetric cipher (2007)
# PRF	Pseudo-Random Function
# PRP	Pseudo-Random Permutation
# PRINCE	low-latency 64-bit symmetric block cipher (2012)
# prime192v1	alias for P-192
# prime224v1	alias for P-224
# prime256v1	alias for P-256
# prime384v1	alias for P-384
# prime521v1	alias for P-521
# PRNG	Pseudo-Random Number Generator
# PSK	Pre-shared Key
# PSKC	Portable Symmetric Key Container
# PTG	Physical Random Generator
# PVT	Public Validation Token
# PWKE	Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography
# QARMA	Qualcomm ARM Authenticator, lightweight 64-, 128-bit block cipher (2016)
# QARMA-64	see QARMA
# QARMA-128	see QARMA
# QUAD	80-bit key stream cipher (2002)
# QUIC	Quick UDP Internet Connection
# RA	Registration Authority (aka Registration CA)
# Rabbit	128-bit key stream cipher (2003)
# RACCOON	Timing vulnerability in TLS' DH key exchange	(Exploit SSL/TLS)
# RADIUS	Remote Authentication Dial-In User Service
# Radix-64	alias for Base-64
# RAINBOW	post-quantum signature (broken 2/2022)
# RBG	Random Bit Generator
# RC2	Rivest Cipher 2, 64-bit symmetric block cipher by Ron Rivest
# RC4	Rivest Cipher 4, stream cipher (aka Ron's Code)
# RC5	Rivest Cipher 5, 32-bit symmetric block cipher
# RC5-64	Rivest Cipher 5, 64-bit symmetric block cipher
# RC6	Rivest Cipher 6, 128-bit symmetric block cipher
# RCSU	Reuters' Compression Scheme for Unicode (aka SCSU)
# RFC	Request for Comments
# Rijndael	symmetric block cipher (AES)
# RIPEMD	RACE Integrity Primitives Evaluation Message Digest
# RIPE-MD	alias for RIPEMD
# RLWE	Ring Learning-with-Errors
# RMAC	Randomized MAC (block cipher authentication mode)
# RMD	
# RNG	Random Number Generator
# ROCA	Return of the Coppersmith Attack	(Exploit SSL/TLS)
# ROT-13	see XOR
# ROBOT	Return Of Bleichenbacher's Oracle Threat	(Exploit SSL/TLS)
# RTP	Real-time Transport Protocol
# RSASSA-PSS	RSA Probabilistic Signature Scheme
# RSA	Rivest Sharmir Adelman (public key cryptographic algorithm)
# RSS-14	Reduced Space Symbology, see GS1
# RTN	Routing transit number
# S/KEY	One-time pad Password system
# SA	Subordinate Authority (aka Subordinate CA)
# SACL	System Access Control List
# SAD	Security Association Database
# SAE	Simultaneous Authentication of Equals
# SAFER	Secure And Fast Encryption Routine, 64-bit symmetric block cipher (1993)
# SAFER+	128-bit symmetric block cipher (1998)
# SAFER++	128-bit symmetric block cipher (1998)
# Salsa20	stream cipher (by D. Bernstein, 2005), see ChaCha20
# Salsa20/8	see scrypt
# Salsa20/12	see Salsa20
# Salsa20/20	see Salsa20
# SAM	syriac abbreviation mark
# SAN	Subject Alternate Name
# Sarmal	hash function
# SAX	Symmetric Authenticated eXchange
# SBCS	single-byte character set
# SBPA	Simple Branch Prediction Analysis
# SCA	Selfsigned CA signature
# SCEP	Simple Certificate Enrollment Protocol
# SCREAM	tweakable word-based stream cipher (2002)
# scrypt	password based key derivation function (Colin Percival)
# SCSU	Standard Compression Scheme for Unicode (compressed UTF-16)
# SCSV	Signaling Cipher Suite Value
# SCVP	Server-Based Certificate Validation Protocol
# SCT	Signed Certificate Timestamp
# SDES	Security Description Protokol
# secp192r1	alias for P-192
# secp224r1	alias for P-224
# secp256r1	alias for P-256
# secp384r1	alias for P-384
# secp521r1	alias for P-521
# SEAL	Software-Optimized Encryption Algorithm; 32-bit word stream cipher (1994)
# SEED	128-bit symmetric block cipher (1998)
# Serpent	128-bit symmetric block cipher (1998)
# SGC	Server-Gated Cryptography
# SGCM	Sophie Germain Counter Mode (authenticated encryption block cipher mode)
# SIV	Synthetic Initialization Vector
# SHA	Secure Hash Algorithm
# SHA-0	Secure Hash Algorithm (insecure version before 1995)
# SHA-1	Secure Hash Algorithm (since 1995)
# SHA-2	Secure Hash Algorithm (since 2002)
# SHA-3	Secure Hash Algorithm (since 2015), see Keccak also
# SHA-128	Secure Hash Algorithm (128 bit)
# SHA-224	Secure Hash Algorithm (224 bit)
# SHA-256	Secure Hash Algorithm (256 bit)
# SHA-384	Secure Hash Algorithm (384 bit)
# SHA-512	Secure Hash Algorithm (512 bit)
# SHA1	alias for SHA-1 (160 bit)
# SHA2	alias for SHA-2 (128, 224, 256, 384 or 512 bit)
# SHA3	alias for SHA-3 (224, 256, 384 or 512 bit)
# SHA3256	alias for SHA3-256
# SHA3-224	Secure Hash Algorithm (224 bit)
# SHA3-256	Secure Hash Algorithm (256 bit)
# SHA3-384	Secure Hash Algorithm (384 bit)
# SHA3-512	Secure Hash Algorithm (512 bit)
# SHAKE128	Secure Hash Algorithm (variable bit)
# SHAKE256	Secure Hash Algorithm (variable bit)
# SHAttered	The first concrete collision attack against SHA1	(Exploit SSL/TLS)
# SHAvite-3	hash function (Eli Biham, Orr Dunkelman, 2009)
# SHS	Secure Hash Standard
# SIA	Subject Information Access (certificate extension)
# SIC	Segmented Integer Counter (alias for CTR)
# SIDH	Supersingular Isogeny Diffie-Hellman (key exchange)
# SIKE	post-quantum hash function, signature (broken 7/2022)
# SIKEp434	post-quantum hash function, signature (broken 7/2022)
# SIKEp503	post-quantum hash function, signature (broken 7/2022)
# SIKEp610	post-quantum hash function, signature (broken 7/2022)
# SIKEp751	post-quantum hash function, signature (broken 7/2022)
# SIMON	lightweight 32-, 48-, 64-, 96-, 128-bit symmetric block cipher (NSA algorithm, questionable security) (2013)
# SipHash	hash function (J. Aumasson, Daniel Bernstein, 2012)
# Skein	hash function (Niels Ferguson, Stefan Lucks, Bruce Schneier, Doug Whiting, Mihir Bellare, Tadayoshi Kohno, Jon Callas, Jesse Walker, 2010)
# Skein-256-256	see Skein (256 bits)
# Skein-512-256	see Skein (256 bits)
# Skein-512-512	see Skein (512 bits)
# Skein-1024-1024	see Skein (1024 bits)
# SKID	Subject Key ID (certificate extension)
# SKINNY	SPN tweakable block cipher
# SKINNY-128-256	see SLINNY
# SKIP	Message Skipping Attacks on TLS	(Exploit SSL/TLS)
# SKIP-TLS	see SKIP
# Skipjack	64-bit block cipher (part of the Fortezza) (1998, partially brocken)
# Sleeping POODLE	invalid padding with valid MAC (variant of POODLE exploit)
# SLOTH	Security Losses from Obsolete and Truncated Transcript Hashes	(Exploit SSL/TLS)
# SM2	ShangMi authentication function
# SM3	ShangMi hash function
# SM4	ShangMi block cipher (Chinese gouvernment algorithm, questionable but no objections yet)
# SM4CCM	AEAD algorithms AEAD_SM4_CCM
# SM4GCM	AEAD algorithms AEAD_SM4_GCM
# SMS4	see SM4
# SMACK	State Machine AttaCKs	(Exploit SSL/TLS)
# Snefu	hash function
# Snow20	see SNOW
# SNI	Server Name Indication
# SNOW	32-bit word synchronous stream ciphers (by Thomas Johansson and Patrik Ekdahl )
# SNOW 1.0	see SNOW
# SNOW 2.0	see SNOW
# SNOW 3G	see SNOW
# Snuffle 2005	see Salsa20
# Snuffle 2008	see ChaCha
# Sosemanuk	128-bit stream cipher (2005)
# SOBER	Seventeen Octet Byte Enabled Register, 8-, 16-, 32-bit key stream cipher (1997)
# SOBER-2	see SOBER
# SOBER-t8	see SOBER
# SOBER-t16	see SOBER
# SOBER-t32	see SOBER
# SOBER-128	see SOBER
# SPARX	? algorithm
# SPECK	lightweight 16-, 24-, 32-, 48-, 64-bit symmetric block cipher (NSA algorithm, questionable security) (2013, broken 2018)
# Speck64	see SPECK
# Speck128	see SPECK
# Speck256	see SPECK
# Speck256-XTS	see SPECK
# SPD	Security Policy Database
# SPDY	Google's application-layer protocol on top of SSL
# SPHINCS	Stateless hash-based signatures, post-quantum hash function, signature
# SPHINCS-256	alias for SPHINCS
# SPHINCS-SHAKE256	alias for SPHINCS
# SPHINCS-SHA-256	alias for SPHINCS
# SPI	Security Parameters Index
# SPKI	Subject Public Key Infrastructure
# SPN	Substitution-Permutation Network
# SPRP	Strong Pseudo-Random Permutation
# Square	128-bit symmetric block cipher (1997, broken with Square attack))
# SRI	Subresource Integrity
# SRP	Secure Remote Password protocol
# SRTP	Secure RTP
# SSCD	Secure Signature Creation Device
# SSEE	Sichere Signaturerstellungseinheit (same as SSCD)
# SSK	Secret Signing Key
# SSL	Secure Sockets Layer
# SSLv2	Secure Sockets Layer Version 2
# SSLv3	Secure Sockets Layer Version 3
# SSP	Security Support Provider
# SSPI	Security Support Provider Interface
# SST	Serialized Certificate Store format
# SSTP	Secure Socket Tunneling Protocol
# STES	stream cipher
# Streebog	hash function
# Streebog-256	see Streebog
# Streebog-512	see Streebog
# STS	Strict Transport Security
# STS 	Station-to-Station protocol
# SUF-CMA	Strong UnForgeability against Chosen-Message Attacks
# Sweet32	Birthday attacks on 64-bit block ciphers in TLS and OpenVPN	(Exploit SSL/TLS)
# SWIFFT	hash function (Vadim Lyubashevsky, Daniele Micciancio, Chris Peikert, Alon Rosen, 2008)
# SWIFFTX	see SWIFFT
# TA	Trust Agent
# TACK	Trust Assertions for Certificate Keys
# TCB	Trusted Computing Base
# TDEA	Tripple DEA
# TEA	Tiny Encryption Algorithm
# TEK	Traffic Encryption Key
# TET	?
# TGS	Ticket Granting Service (mainly Kerberos)
# TGT	Ticket Granting Ticket (mainly Kerberos)
# Tiger	hash function
# TIME	Timing Info-leak Made Easy	(Exploit SSL/TLS)
# TIME 	A Perfect CRIME? TIME Will Tell
# Threefish	256-, 512-, 1024-bit symmetric block cipher (part of Skein hash function) (2008)
# TLS	Transport Layer Security
# TLSA	TLS Trust Anchors
# TLSv1	Transport Layer Security version 1
# TLSA RR	TLSA resource Record
# TMAC	Two-Key CMAC, variant of CBC-MAC
# TOCTOU	Time-of-check, time-of-use
# TOFU	Trust on First Use
# TR-02102	Technische Richtlinie 02102 (des BSI)
# TR-03116	Technische Richtlinie 03116 (des BSI)
# Trivium	80-bit key synchronous stream cipher (2005, broken 4/2015)
# TSK	Transmission Security Key
# TSK 	TACK signing key
# TSP	trust-Management Service Provider
# TSS	Time Stamp Service
# TTP	trusted Third Party
# Twofish	128-bit symmetric block cipher (1998)
# UC 	Unified Capabilities
# UC	Unified Communications (SSL Certificate using SAN)
# UCC	Unified Communications Certificate (rarley used)
# UMAC	Message Authentication Code based on universal hashing; aka universal hashing MAC; optimized for 32-bit architectures
# URI	Uniform Resource Identifier
# URL	Uniform Resource Locator
# VEST	Very Efficient Substitution Transposition, cipher with T-functions (2005, brocken 2007)
# VEST-4	see VEST
# VEST-8	see VEST
# VEST-16	see VEST
# VEST-32	see VEST
# VMAC	Universal hashing MAC; 64-bit variant of UMAC (by Ted Krovetz and Wei Dai)
# VMPC	Variably Modified Permutation Composition, stream cipher (2007)
# VR-224	alias for BADA55-VR-224
# VR-256	alias for BADA55-VR-256
# VR-384	alias for BADA55-VR-384
# WAKE	32-bit word stream cipher (1993, broken)
# WHIRLPOOL	hash function
# WPAD	Web Proxy Auto-Discovery
# wolfSSL	SSL library mainly intended and used for embedded and real-time systems
# X.680	X.680: ASN.1
# X.509	X.509: The Directory - Authentication Framework
# X25519	alias for Curve25519 ?
# X448	alias for Curve448 ?
# X680	X.680: ASN.1
# X509	X.509: The Directory - Authentication Framework
# X3DH	Extended Triple Diffie-Hellman
# XCBC	eXtended CBC-MAC
# XCBC-MAC	same as XCBC
# XChaCha	512-bit key stream cipher
# XChaCha12	see ChaCha (aka 12-round XChaCha)
# XChaCha20	see ChaCha (aka 20-round XChaCha)
# XEX	XOR Encrypt XOR
# XKMS	XML Key Management Specification
# XMACC	counter-based XOR-MAC
# XMACR	radomized XOR-MAC
# XMLSIG	XML-Signature Syntax and Processing
# XMSS	hash function
# XSalsa2	variant of Salsa20
# XTEA	extended Tiny Encryption Algorithm
# XTS	XEX-based tweaked-codebook mode with ciphertext stealing
# XUDA	Xcert Universal Database API
# XXTEA	enhanced/corrected Tiny Encryption Algorithm
# yaSSL	same as CyaSSL
# ZLIB	Lossless compression file format
# Zombie POODLE	invalid padding with valid MAC (variant of POODLE exploit)
# ZRTP	SRTP for VoIP
# ZSK	Zone Signing Key (DNSSEC)
# 
#
# end abbr

# begin rfc

# =head1 rfc


# # SID	@(#) rfc.txt 1.19 23/11/28 12:49:03
# 
# # number| title / description
# #------+----------------------------------------------------------------------+
# # url	base URL for RFC descriptions
# #	http://tools.ietf.org/html/rfcXXXX
# #	http://tools.ietf.org/rfc/rfcXXXX.txt
# url	http://tools.ietf.org/
# 6101	SSL Version 3.0
# 6601	SSL Version 3.0
# 2246	TLS Version 1.0 (with Cipher Suites)
# 4346	TLS Version 1.1 (with Cipher Suites)
# 5246	TLS Version 1.2 (with Cipher Suites)
# 8446	TLS Version 1.3 (with Cipher Suites)
# 4347	DTLS Version 0.9
# 6347	DTLS Version 1.2
# 8447	IANA Registry Updates for TLS and DTLS
# 2616	Hypertext Transfer Protocol Version 1 (HTTP/1.1)
# 7540	Hypertext Transfer Protocol Version 2 (HTTP/2)
# 7230	HTTP/1.1: Message Syntax and Routing
# 7231	HTTP/1.1: Semantics and Content
# 7232	HTTP/1.1: Conditional Requests
# 7233	HTTP/1.1: Range Requests
# 7234	HTTP/1.1: Caching
# 7235	HTTP/1.1: Authentication
# 2144	CAST-128 Encryption Algorithms
# 2612	CAST-256 Encryption Algorithms
# 2950	Telnet Encryption: CAST-128 64 bit Cipher Feedback
# 2984	Use of the CAST-128 Encryption Algorithm in CMS
# 3490	Internationalizing Domain Names in Applications (IDNA)
# 3987	Internationalized Resource Identifiers (IRIs)
# 4518	Internationalized String Preparation in LDAP
# 3986	Uniform Resource Identifier (URI): Generic Syntax
# 2104	HMAC: Keyed-Hashing for Message Authentication
# 2405	The ESP DES-CBC Cipher Algorithm With Explicit IV
# 2406	IP Encapsulating Security Payload (ESP)
# 4303	IP Encapsulating Security Payload (ESP)
# 2407	The Internet IP Security Domain of Interpretation for ISAKMP
# 2408	Internet Security Association and Key Management Protocol (ISAKMP)
# 2409	The Internet Key Exchange (IKE) - 1998
# 4306	The Internet Key Exchange (IKEv2) Protocol - 2005
# 7296	The Internet Key Exchange Protocol 2 (IKEv2) - 2014
# 4753	ECP Groups for IKE and IKEv2
# 4754	IKE and IKEv2 Authentication Using the Elliptic Curve Digital Signature Algorithm (ECDSA)
# 2412	AKLEY Key Determination Protocol (PFS - Perfect Forward Secrec)
# 2817	Upgrading to TLS Within HTTP/1.1
# 2818	HTTP Over TLS
# 2945	SRP Authentication & Key Exchange System
# 2986	PKCS#10
# 5967	PKCS#10
# 2313	PKCS#1: RSA Cryptography Specifications Version 1.5
# 2437	PKCS#1: RSA Cryptography Specifications Version 2.0
# 3447	PKCS#1: RSA Cryptography Specifications Version 2.1
# 8017	PKCS#1: RSA Cryptography Specifications Version 2.2
# 2712	TLSKRB: Addition of Kerberos Cipher Suites to TLS
# 3268	TLSAES: Advanced Encryption Standard (AES) Cipher Suites for TLS
# 4279	TLSPSK: Pre-Shared Key Ciphersuites for TLS
# 5081	TLSPGP: Using OpenPGP Keys for Transport Layer Security (TLS) Authentication - 2007
# 6091	TLSPGP: Using OpenPGP Keys for Transport Layer Security (TLS) Authentication - 2011
# 3711	The Secure Real-time Transport Protocol (SRTP)
# 6189	ZRTP: Media Path Key Agreement for Unicast Secure RTP
# 4106	Use of Galois/Counter Mode (GCM) in IPsec Encapsulating Security Payload (ESP)
# 4309	AES-CCM Mode with IPsec Encapsulating Security Payload (ESP)
# 5116	An Interface and Algorithms for Authenticated Encryption (AEAD)
# 3749	TLS Compression Method (obsolete)
# 3943	TLS Protocol Compression Using Lempel-Ziv-Stac (LZS)
# 4680	TLS Handshake Message for Supplemental Data
# 4749	TLS Compression Methods
# 3546	TLS Extensions (obsolete)
# 4366	TLS Extensions
# 5746	TLS Extension: Renegotiation Indication Extension
# 5764	TLS Extension: Secure Real-time Transport Protocol (SRTP)
# 5878	TLS Extension: Authorization
# 5929	TLS Extension: Channel Bindings
# 6066	TLS Extension: Extension Definitions
# 6520	TLS Extension: Heartbeat
# 7301	TLS Extension: Application-Layer Protocol Negotiation (ALPN)
# 7633	TLS Extension: Feature Extension: Must Staple
# 7924	TLS Extension: Cached Information Extension
# 8449	TLS Extension: Record Size Limit
# 5077	TLS session resumption without Server-Side State
# 6961	TLS Multiple Certificate Status Request Extension
# 7627	TLS Session Hash and Extended Master Secret Extension
# 6176	Prohibiting Secure Sockets Layer (SSL) Version 2.0
# 7568	Deprecating Secure Sockets Layer Version 3.0
# 6460	NSA Suite B Profile for TLS
# 2560	Online Certificate Status Protocol (OCSP, obsolete)
# 6267	Online Certificate Status Protocol Algorithm Agility (OCSP, obsolete)
# 4210	X509 PKI Certificate Management Protocol (CMP)
# 3279	x509 Algorithms and Identifiers for X.509 PKI and CRL Profile
# 3739	x509 PKI Qualified Certificates Profile; EU Directive 1999/93/EC
# 3280	X509 PKI Certificate and Certificate Revocation List (CRL) Profile (obsolete)
# 4158	X509 PKI Certification Path Building
# 4387	X509 PKI Operational Protocols: Certificate Store Access via HTTP
# 5280	X509 PKI Certificate and Certificate Revocation List (CRL) Profile
# 5480	X509 PKI Elliptic Curve Cryptography Subject
# 5758	X509 PKI Additional Algorithms and Identifiers for DSA and ECDSA
# 6960	X509 Online Certificate Status Protocol (OCSP)
# 8410	X509 PKI Algorithm Identifiers for Ed25519, Ed448, X25519, and X448
# 4132	Addition of Camellia Cipher Suites to TLS
# 4162	Addition of SEED Cipher Suites to TLS
# 4357	Additional Cryptographic Algorithms for Use with GOST 28147-89, GOST R 34.10-94, GOST R 34.10-2001, and GOST R 34.11-94 Algorithms
# 4418	UMAC: Message Authentication Code using Universal Hashing
# 4490	Using the GOST 28147-89, GOST R 34.11-94, GOST R 34.10-94, and GOST R 34.10-2001 Algorithms with Cryptographic Message Syntax (CMS)
# 4491	Using the GOST Algorithms with X509 (GOST R 34.10-94, GOST R 34.10-2001, GOST R 34.11-94)
# 4634	US Secure Hash Algorithms (SHA, SHA-based HMAC and HKDF)
# 5869	HMAC-based Extract-and-Expand Key Derivation Function (HKDF)
# 5830	GOST 28147-89: Encryption, Decryption, and Message Authentication Code (MAC) Algorithms
# 5831	GOST R 34.11-94: Hash Function Algorithm
# 5832	GOST R 34.10-2001: Digital Signature Algorithm
# 6986	GOST R 34.11-2012: Hash Function
# 7091	GOST R 34.10-2012: Digital Signature Algorithm
# 7801	GOST R 34.12-2015: Block Cipher "Kuznyechik"
# 9189	GOST Cipher Suites for Transport Layer Security (TLS) Protocol Version 1.2
# 9150	TLS 1.3 Authentication and Integrity-Only Cipher Suites
# 7836	Guidelines on the Cryptographic Algorithms to Accompany the Usage of Standards GOST R 34.10-2012 and GOST R 34.11-2012
# 4868	Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with IPsec
# 4785	Pre-Shared Key (PSK) Cipher Suites with NULL Encryption for TLS
# 5054	Secure Remote Password (SRP) Protocol for TLS Authentication
# 5114	Additional Diffie-Hellman Groups for Use with IETF Standards
# 5288	AES Galois Counter Mode (GCM) Cipher Suites for TLS
# 5289	TLS Elliptic Curve Cipher Suites with SHA-256/384 and AES Galois Counter Mode (GCM)
# 5430	Suite B Profile for TLS
# 5487	Pre-Shared Key Cipher Suites for TLS with SHA-256/384 and AES Galois Counter Mode
# 5489	ECDHE_PSK Cipher Suites for TLS
# 5589	Session Initiation Protocol (SIP) Call Control - Transfer
# 6040	Tunnelling of Explicit Congestion Notification
# 6090	Fundamental Elliptic Curve Cryptography Algorithms
# 4492	TLSECC: Elliptic Curve Cryptography (ECC) Cipher Suites for TLS (obsolete)
# 5639	Elliptic Curve Cryptography (ECC) Brainpool Standard Curves and Curve Generation
# 5903	Elliptic Curve Groups modulo a Prime (ECP Groups) for IKE and IKEv2
# 6507	Elliptic Curve-Based Certificateless Signatures for Identity-Based Encryption (ECCSI)
# 7027	Elliptic Curve Cryptography (ECC) Brainpool Curves for TLS
# 7748	Elliptic Curve for Security
# 8422	Elliptic Curve Cryptography (ECC) Cipher Suites for TLS Versions 1.2 and Earlier
# 5297	Synthetic Initialization Vector (SIV) Authenticated Encryption Using the Advanced Encryption Standard (AES)
# 8452	AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption 
# 5528	Camellia Counter Mode and Camellia Counter with CBC-MAC Mode Algorithms
# 5741	RFC Streams, Headers, and Boilerplates
# 5794	Description of the ARIA Encryption Algorithm
# 5932	Camellia Cipher Suites for TLS
# 6151	Updated Security for MD5 and HMAC-MD5
# 6234	US Secure Hash Algorithms (SHA, SHA-based HMAC and HKDF)
# 6209	Addition of the ARIA Cipher Suites to TLS
# 6367	Addition of the Camellia Cipher Suites to TLS
# 6655	AES-CCM Cipher Suites for TLS
# 7251	AES-CCM Elliptic Curve Cryptography (ECC) Cipher Suites for TLS
# 7507	TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks
# 5055	Server-Based Certificate Validation Protocol (SCVP)
# 5019	simplified RFC 2560
# 5705	Keying Material Exporters for TLS
# 6125	Representation and Verification of Domain-Based Application Service (PKIX) for TLS
# 6797	HTTP Strict Transport Security (HSTS)
# 6962	Certificate Transparency
# 6979	Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA)
# 7366	Encrypt-then-MAC for TLS and DTLS
# 7457	Summarizing Known Attacks on TLS and DTLS
# 7465	Prohibiting RC4 Cipher Suites
# 7469	Public Key Pinning Extension for HTTP
# 7525	Recommendations for Secure Use of TLS and DTLS
# 7539	ChaCha20 and Poly1305 for IETF Protocols (obsolete)
# 8439	ChaCha20 and Poly1305 for IETF Protocols
# 7905	ChaCha20-Poly1305 Cipher Suites for TLS
# 7627	TLS Session Hash and Extended Master Secret Extension
# 7693	The BLAKE2 Cryptographic Hash and Message Authentication Code
# 7919	Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for TLS
# 1135	The Helminthiasis of the Internet
# 6698	DNS-Based Authentication of Named Entities (DANE)
# 6844	DNS Certification Authority Authorization (CAA) Resource Record
# 3610	Counter with CBC-MAC (CCM)
# 3852	Cryptographic Message Syntax (CMS)
# 5083	Cryptographic Message Syntax (CMS) Authenticated-Enveloped-Data Content Type
# 4086	Randomness Requirements for Security
# 4107	Guidelines for Cryptographic Key Management
# 8032	Edwards-Curve Digital Signature Algorithm (EdDSA)
# 7710	Captive Portal Using DHCP
# 8484	DNS over HTTPS (DoH)
# 8467	Padding for DoH und DoT
# 8492	Secure Password Ciphersuites for Transport Layer Security (TLS)
# 1918	Address Allocation for Private Internets
# 6598	IANA-Reserved IPv4 Prefix for Shared Address Space
# 8701	Applying Generate Random Extensions And Sustain Extensibility (GREASE) to TLS Extensibility
# 8998	ShangMi (SM) Cipher Suites for TLS 1.3
# 9102	Argon2 Memory-hard function for password hashing and proof-of-work applications (2021)
# 9155	Deprecating MD5 and SHA-1 Signature Hashes in TLS 1.2 and DTLS 1.2
# 8398	Internationalized Email Addresses in X.509 Certificates
# 8399	Internationalization Updates to RFC 5280
# 8447	IANA Registry Updates for TLS and DTLS
# 8478	Zstandard Compression and the application/zstd Media Type
# 8879	TLS Certificate Compression
# 7250	Using Raw Public Keys in Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)
# 7924	Transport Layer Security (TLS) Cached Information Extension
# 7932	Brotli Compressed Data Format
# 
#
# end rfc

# begin voodoo

# Some documentation is plain text, which is  DATA  in Perl sources. As such,
# it  is  not detected as source,  not as comment,  and  not as documentation
# by most tools analysing the source code.
# O-Saft's public user documentation is plain text stored in  separate files.
# These files are usually also not counted as source.
# Unfortunately, some people solely believe in statistics generated by  magic
# tools. They use such statistics to measure for example code quality without
# looking themself at the code.
# Hence the purpose of this file is to provide real comment and documentation
# lines from our documentation in format of the used programming language.
# Hopefully, if these people read this, they change the workflow (means: they
# also review the source code) or adapt their conclusions having in mind that
# statistics can be manipulated in many ways. Here we go ...
#
# Disclaimer: No offence meant anyhow, neither against any analysing tool nor
# against anyone using them. It is just a reminder to use the tools and their
# results in a wise manner. Measuring quality is more than just automatically
# generated statistics!

# end voodoo
