mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
105 lines
4.1 KiB
Markdown
105 lines
4.1 KiB
Markdown
---
|
|
name: configuring-tls-1-3-for-secure-communications
|
|
description: TLS 1.3 (RFC 8446) is the latest version of the Transport Layer Security protocol, providing significant improvements
|
|
over TLS 1.2 in both security and performance. It reduces handshake latency to 1-R
|
|
domain: cybersecurity
|
|
subdomain: cryptography
|
|
tags:
|
|
- cryptography
|
|
- tls
|
|
- ssl
|
|
- transport-security
|
|
- network-security
|
|
version: '1.0'
|
|
author: mahipal
|
|
license: Apache-2.0
|
|
nist_csf:
|
|
- PR.DS-01
|
|
- PR.DS-02
|
|
- PR.DS-10
|
|
---
|
|
# Configuring TLS 1.3 for Secure Communications
|
|
|
|
## Overview
|
|
|
|
TLS 1.3 (RFC 8446) is the latest version of the Transport Layer Security protocol, providing significant improvements over TLS 1.2 in both security and performance. It reduces handshake latency to 1-RTT (and 0-RTT for resumed sessions), removes obsolete cipher suites, and mandates perfect forward secrecy. This skill covers configuring TLS 1.3 on servers, validating configurations, and testing for common misconfigurations.
|
|
|
|
|
|
## When to Use
|
|
|
|
- When deploying or configuring configuring tls 1 3 for secure communications capabilities in your environment
|
|
- When establishing security controls aligned to compliance requirements
|
|
- When building or improving security architecture for this domain
|
|
- When conducting security assessments that require this implementation
|
|
|
|
## Prerequisites
|
|
|
|
- Familiarity with cryptography concepts and tools
|
|
- Access to a test or lab environment for safe execution
|
|
- Python 3.8+ with required dependencies installed
|
|
- Appropriate authorization for any testing activities
|
|
|
|
## Objectives
|
|
|
|
- Configure TLS 1.3 on nginx and Apache web servers
|
|
- Implement TLS 1.3 in Python applications using the ssl module
|
|
- Validate TLS configurations with openssl and testssl.sh
|
|
- Understand TLS 1.3 cipher suites and key exchange mechanisms
|
|
- Configure 0-RTT early data with appropriate protections
|
|
- Disable legacy TLS versions (1.0, 1.1) and weak cipher suites
|
|
|
|
## Key Concepts
|
|
|
|
### TLS 1.3 Cipher Suites
|
|
|
|
| Cipher Suite | Key Exchange | Authentication | Encryption | Hash |
|
|
|-------------|-------------|----------------|------------|------|
|
|
| TLS_AES_256_GCM_SHA384 | ECDHE/DHE | Certificate | AES-256-GCM | SHA-384 |
|
|
| TLS_AES_128_GCM_SHA256 | ECDHE/DHE | Certificate | AES-128-GCM | SHA-256 |
|
|
| TLS_CHACHA20_POLY1305_SHA256 | ECDHE/DHE | Certificate | ChaCha20-Poly1305 | SHA-256 |
|
|
|
|
### TLS 1.3 vs 1.2 Improvements
|
|
|
|
- **1-RTT Handshake**: Full handshake completes in one round trip (vs 2 in TLS 1.2)
|
|
- **0-RTT Resumption**: Resumed connections can send data immediately
|
|
- **No RSA Key Exchange**: Only ephemeral Diffie-Hellman (mandatory PFS)
|
|
- **Simplified Cipher Suites**: Removed CBC, RC4, 3DES, static RSA, SHA-1
|
|
- **Encrypted Handshake**: Server certificate is encrypted after ServerHello
|
|
|
|
### Key Exchange Groups
|
|
|
|
- **x25519**: Curve25519 ECDH (preferred, fast)
|
|
- **secp256r1**: NIST P-256 ECDH (widely supported)
|
|
- **secp384r1**: NIST P-384 ECDH (higher security margin)
|
|
- **x448**: Curve448 ECDH (highest security)
|
|
|
|
## Workflow
|
|
|
|
1. Verify OpenSSL version supports TLS 1.3 (1.1.1+)
|
|
2. Generate or obtain TLS certificate and private key
|
|
3. Configure server to use TLS 1.3 cipher suites
|
|
4. Disable TLS 1.0 and 1.1 (optionally keep 1.2 for compatibility)
|
|
5. Set preferred key exchange groups
|
|
6. Enable OCSP stapling for certificate validation
|
|
7. Test configuration with openssl s_client and testssl.sh
|
|
8. Configure HSTS header for HTTP Strict Transport Security
|
|
|
|
## Security Considerations
|
|
|
|
- 0-RTT data is vulnerable to replay attacks; limit to idempotent requests
|
|
- Always include TLS 1.2 fallback if legacy client support is required
|
|
- Use ECDSA certificates for better performance (vs RSA)
|
|
- Enable OCSP stapling to improve client certificate validation
|
|
- Set HSTS header with long max-age and includeSubDomains
|
|
- Monitor for certificate transparency logs
|
|
|
|
## Validation Criteria
|
|
|
|
- [ ] TLS 1.3 handshake completes successfully
|
|
- [ ] Only approved cipher suites are offered
|
|
- [ ] Perfect forward secrecy is enforced
|
|
- [ ] TLS 1.0 and 1.1 are rejected
|
|
- [ ] OCSP stapling is functional
|
|
- [ ] Certificate chain is valid and complete
|
|
- [ ] testssl.sh reports no vulnerabilities
|