Determining if Server/Client's TLS configuration is Vulnerable to SLOTH

Question

In the context of SSL/TLS protocol and SLOTH vulnerability. I want to find out if certain websites(webservers) or applications that use TLS are vulnerable. I need some guidance for this.

My idea is to develop/find a tool(maybe openssl) that connects to the servers and in the client hello asks for RSA-MD5 SignatureAndHashAlgorithm to test if the server sends the corresponding certificate under this configuration and conclude that the server is vulnerable.

Likewise for the client certificates, I want to ask for client certificates signed by RSA-MD5 and if the client sends its certificates under this setup I'll conclude that the client is vulnerable to SLOTH.

First, is my approach right? or am I off the road?

Second, what types of tools do I need to use? Is openssl capable of producing such requests and responses?

Answer 1

It doesn't seem that openssl is capable of doing this itself, especially against servers that don't advertise RSA-MD5 support but will still accept it (e.g. OpenSSL pre-1.0.1e).

But see https://securitypitfalls.wordpress.com/2016/01/06/testing-for-sloth/ which appears to provide a handcrafted TLS1.2 client that will test for the broken behaviour. I haven't tested it personally yet, but it looks like exactly the sort of tool that I was looking for to perform exactly the testing you describe.

Thus, to test properly if a server is vulnerable against this attack, we need a client that is misbehaving.

For easy writing of such test cases I have been working on the tlsfuzzer. Just released version of it was extended to be able test servers for vulnerability against the SLOTH attack (to be more precise, just the client impersonation attack – the most severe of the described ones).