drwetter/testssl.sh

[Feature request] Client Simulation for Java8 u341 or higher - to include TLS 1.3

kai-bcn opened this issue · 1 comments

Which version are you referring to
3.2rc3

Describe your feature request (if it's a technical feature)
testssl.sh's client simulation is awesome, yet having only one single line entry for Java 8u161 is not ideal anymore, because back then (January 2018) Java8 was still stuck with just TLSv1.2.

This enhancement request seeks that testssl.sh gets improved to reflect on newer JDK 8 clients with TLS 1.3 compatibility. This should be an additional client, rather than replacing the existing Java 8u161 client.

The following releases were the key milestones for JDK8 and TLS1.3:

In Java 8u261 (2020-07-14) TLS 1.3 / RFC 8446 was added:
Release Notes.
In Java 8u311 (2021-10-19) the default priority order of its cipher suites had been adjusted:
Release notes.
In Java 8u341 (2022-07-19) TLS 1.3 was enabled as default for Client Roles:
Release Notes.
Additional Information.
Some other (minor) changes are detailedl on the Java Crypto Roadmap page, and took affect in Java / OpenJDK 8u351, u371 and u391.

If your feature request otherwise is related to a usage problem, please describe it
Using testssl.sh 3.2rc3 doesn't reflect how current Java 8 clients would connect to the tested server.

Describe the solution you'd like
In the client simulations section I'd love to see additional Java8 variants, that include TLS 1.3 compatibility.

Thanks for the heads up. Sounds reasonable to update the handshake.

In any case we should implement the ClientHello latest and greatest Java 8 version as a default (current+=(true)), assuming everobody should run the latest bugs free version.

We can also add a lower version though (current+=(false)). Java 21 also a thing we shouldn´t forget.

I can need a hand here. It's easy for Java, see etc/client-simulation.wiresharked.md using etc/SSLSocketClient.java