Features

Protocol-independent

Algorithms

• public key

• digital signature

• key exchange

• block cipher

• stream cipher

• cryptographic hash

• elliptic-curve

• message authentication code

Parameters

• Diffie-Hellman (finite field)

  • defined by standard

    • RFC 2539 (a.k.a MODP, Oakley Group)

    • RFC 3526 (a.k.a MODP for IKE)

    • RFC 5114

    • RFC 7919 (a.k.a FFDH)

  • software built-in

    • Apache HTTP Server

    • HAProxy

    • Postfix

    • ProFTPD

    • SOcket CAT (socat)

Stores

• Trusted root CA certificate trust stores

  • Apple

  • Google

  • Microsoft

  • Mozilla

• Certificate Transaprency (CT) Logs

  • Cloudflare

  • DigiCert

  • Google

  • Let’s Encrypt

  • Sectigo

  • TrustAsia

  • …

Protocol-dependent

Attributes

• Secure Socket Layer (SSL)

  • cipher kind

• Transport Layer Security (TLS)

  • application-layer protocol name

  • certificate compression algorithm

  • cipher suite

  • compression method

  • elliptic-curve point format

  • extension type

  • fallback SCSV

  • hash and signature algorithm

  • named curve

  • next protocol name

  • psk key exchange mode

  • renegotiation indication

  • token binding paramater

• Secure Shell (SSH)

  • key exchange

  • public key

  • encryption

  • message authentication code

  • compression

  • elliptic curve domain parameter identifier

• Domain Name System

  • DNS resource record (RR) types

  • DNSSEC algorithm types

  • DNSSEC digest types

Client Capabilities

• Transport Layer Security (TLS)

  • Hypertext Transfer Protocol Secure (HTTPS)

    • Chromium

    • Firefox

    • Opera