Initial commit - 611 cybersecurity skills across all subdomains

2026-09-03 23:10:50 +03:00 · 2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
@@ -0,0 +1,67 @@
+# Standards and References - TLS 1.3 Configuration
+
+## Primary Standards
+
+### RFC 8446 - The Transport Layer Security (TLS) Protocol Version 1.3
+- **URL**: https://www.rfc-editor.org/rfc/rfc8446
+- **Description**: The core TLS 1.3 specification
+- **Key changes**: 1-RTT handshake, mandatory PFS, removed RSA key transport, encrypted handshake messages
+
+### RFC 8447 - IANA Registry Updates for TLS and DTLS
+- **URL**: https://www.rfc-editor.org/rfc/rfc8447
+- **Description**: Updates IANA registries for TLS cipher suites and extensions
+
+### RFC 8449 - Record Size Limit Extension for TLS
+- **URL**: https://www.rfc-editor.org/rfc/rfc8449
+- **Description**: Allows endpoints to negotiate maximum record size
+
+### RFC 8470 - Using Early Data in HTTP (0-RTT)
+- **URL**: https://www.rfc-editor.org/rfc/rfc8470
+- **Description**: Defines how 0-RTT early data works with HTTP, including replay protections
+
+### RFC 6961 - TLS Multiple Certificate Status Extension (OCSP Stapling)
+- **URL**: https://www.rfc-editor.org/rfc/rfc6961
+- **Description**: Allows servers to provide OCSP responses during handshake
+
+### RFC 6797 - HTTP Strict Transport Security (HSTS)
+- **URL**: https://www.rfc-editor.org/rfc/rfc6797
+- **Description**: Forces browsers to use HTTPS for all connections
+
+## NIST Guidelines
+
+### NIST SP 800-52 Rev. 2 - Guidelines for TLS Implementations
+- **URL**: https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/final
+- **Description**: Federal guidelines for TLS deployment
+- **TLS 1.3**: Recommended for all new deployments
+- **TLS 1.2**: Acceptable with approved cipher suites
+- **TLS 1.0/1.1**: Prohibited
+
+### NIST SP 800-57 Part 3 Rev. 1 - Application-Specific Key Management
+- **URL**: https://csrc.nist.gov/publications/detail/sp/800-57-part-3/rev-1/final
+- **Description**: Key management guidance for TLS
+
+## Testing Tools
+
+### testssl.sh
+- **URL**: https://testssl.sh/
+- **GitHub**: https://github.com/drwetter/testssl.sh
+- **Description**: Command-line tool for checking TLS/SSL configurations
+
+### SSL Labs Server Test
+- **URL**: https://www.ssllabs.com/ssltest/
+- **Description**: Online TLS configuration analyzer (Qualys)
+
+### Mozilla SSL Configuration Generator
+- **URL**: https://ssl-config.mozilla.org/
+- **Description**: Generate recommended TLS configurations for various servers
+
+## Compliance
+
+### PCI DSS v4.0
+- TLS 1.0 and early TLS prohibited since June 2018
+- TLS 1.2+ required; TLS 1.3 recommended
+- Strong cipher suites must be configured
+
+### HIPAA
+- Encryption in transit required for ePHI
+- TLS 1.2+ satisfies the requirement
@@ -0,0 +1,87 @@
+# Workflows - Configuring TLS 1.3
+
+## Workflow 1: TLS 1.3 Handshake (1-RTT)
+
+```
+Client                              Server
+  |                                    |
+  |--- ClientHello ------------------>|
+  |    (supported_versions: TLS 1.3)  |
+  |    (key_share: x25519)            |
+  |    (signature_algorithms)         |
+  |    (cipher_suites)                |
+  |                                    |
+  |<-- ServerHello -------------------|
+  |    (selected cipher suite)        |
+  |    (key_share: x25519)            |
+  |<-- {EncryptedExtensions} ---------|
+  |<-- {Certificate} -----------------|
+  |<-- {CertificateVerify} -----------|
+  |<-- {Finished} --------------------|
+  |                                    |
+  |--- {Finished} ------------------->|
+  |                                    |
+  |<== Application Data ==============>|
+```
+
+## Workflow 2: nginx TLS 1.3 Configuration
+
+```
+1. Check OpenSSL version (>= 1.1.1)
+   $ openssl version
+
+2. Generate ECDSA certificate
+   $ openssl ecparam -genkey -name prime256v1 -out server.key
+   $ openssl req -new -x509 -key server.key -out server.crt -days 365
+
+3. Configure nginx
+   Edit /etc/nginx/nginx.conf
+
+4. Test configuration
+   $ nginx -t
+
+5. Reload nginx
+   $ systemctl reload nginx
+
+6. Verify TLS 1.3
+   $ openssl s_client -connect localhost:443 -tls1_3
+```
+
+## Workflow 3: TLS Configuration Validation
+
+```
+[Server] --> [openssl s_client test]
+                  |
+          [Check protocol version]
+          [Check cipher suite]
+          [Check certificate chain]
+                  |
+          [testssl.sh full scan]
+                  |
+          [Check for vulnerabilities]
+          - BEAST, POODLE, Heartbleed
+          - ROBOT, DROWN, FREAK
+          - Weak ciphers, expired certs
+                  |
+          [SSL Labs grade assessment]
+          Target: A+ rating
+```
+
+## Workflow 4: Certificate Lifecycle
+
+```
+[Generate Key Pair]
+      |
+[Create CSR] --> [Submit to CA]
+                       |
+               [CA Issues Certificate]
+                       |
+               [Install Certificate]
+                       |
+               [Configure OCSP Stapling]
+                       |
+               [Set Up Auto-Renewal]
+               (certbot / ACME)
+                       |
+               [Monitor Expiration]
+```