1

Would prefer open source. Open to commercial recommendations if you can explain why there is no other good option.

Looking for software that can more or less black box test for strength and vulnerabilities of diffie-helman exchanges and Elliptical Curve Crypto signed keys. Working on a embedded product with hardware-enabled AES crypto along with 3rd-party libraries to help manage security key&cert creation and exchanges.

I know there's a lot of material out there for creating these sorts of things (keys&certs to be used with either scheme), but I'm specifically looking for something for testing them. As a minimal example, would want to verify our implementation does not effectively generate "snake oil" certs/keys.

Related links

security.SE: Logjam attack vulnerability

crypto.SE: check if an ECC is secure

Any modern OS would be acceptable provided it's not too obtuse, although a good answer could specify the required OS and comment on it as an advantage/disadvantage. It's a commercial project, so price should be reasonable but not a limiting factor. That's part of why I prefaced my post with Would prefer open source. Open to commercial recommendations if you can explain why there is no other good option. As far as I'm concerned, Kali linux would not be obtuse, if it had the best option(s). If Windows, there may be higher buy-in to adopt the tool(s).

  • I don't think you can get away with one tool. Maybe one testing environment if you're lucky. Randomness tests, logical tests, timing attacks, IO validation etc. etc. etc. – Maarten Bodewes Jun 21 '17 at 0:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.