IETF Logo Mail Archive

Re: IETF mail server and SSLv3

Viktor Dukhovni <ietf-dane@dukhovni.org> Fri, 05 February 2016 22:46 UTC

Return-Path: <ietf-dane@dukhovni.org>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F14D61B2E58 for <ietf@ietfa.amsl.com>; Fri, 5 Feb 2016 14:46:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X43KccY9_Q6q for <ietf@ietfa.amsl.com>; Fri, 5 Feb 2016 14:46:16 -0800 (PST)
Received: from mournblade.imrryr.org (mournblade.imrryr.org [38.117.134.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9FE641B2E64 for <ietf@ietf.org>; Fri, 5 Feb 2016 14:46:11 -0800 (PST)
Received: from [192.168.0.10] (cpe-74-67-215-75.twcny.res.rr.com [74.67.215.75]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mournblade.imrryr.org (Postfix) with ESMTPSA id E2C20284D9C for <ietf@ietf.org>; Fri, 5 Feb 2016 22:46:10 +0000 (UTC) (envelope-from ietf-dane@dukhovni.org)
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3112\))
Subject: Re: IETF mail server and SSLv3
From: Viktor Dukhovni <ietf-dane@dukhovni.org>
In-Reply-To: <CAMm+LwiSEvLLEXn=+sXzhN_X1hWFqhd1HhmfU3TiSauL=JOnRA@mail.gmail.com>
Date: Fri, 05 Feb 2016 16:48:07 -0500
Content-Transfer-Encoding: quoted-printable
Message-Id: <6FC25506-7791-45A8-9A30-F0A2660A0450@dukhovni.org>
References: <01PWBMOLI82000008P@mauve.mrochek.com> <20160205211042.74052.qmail@ary.lan> <CAMm+LwiSEvLLEXn=+sXzhN_X1hWFqhd1HhmfU3TiSauL=JOnRA@mail.gmail.com>
To: ietf@ietf.org
X-Mailer: Apple Mail (2.3112)
Archived-At: <http://mailarchive.ietf.org/arch/msg/ietf/MoXpIhabNiF4-zonbt1s1DqXPg8>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: ietf@ietf.org
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 05 Feb 2016 22:46:23 -0000

> On Feb 5, 2016, at 4:40 PM, Phillip Hallam-Baker <phill@hallambaker.com> wrote:
> 
> I would be surprised by any legitimate SSL3 mail because the STARTTLS
> spec came long after TLS 1.0 was settled.

Surprise!

http://www.engardelinux.org/modules/index/list_archives.cgi?list=postfix-users&page=0279.html&month=2013-09

But that was in 2013, and my response was:

  As I mentioned, at this time, deprecating SSLv3 is most likely 
  counter-productive. I am hoping that in a couple of years it will 
  be a practical default for the SMTP client only, where you can 
  define exceptions for problem destinations via smtp_tls_policy_maps. 

  A polite note to their postmaster linking to this thread may 
  encourage them to start making plans to upgrade to inbound systems 
  that can support TLSv1 and up (strictly speaking the STARTTLS EHLO 
  response in SMTP promises support of TLS an IETF standard, not SSLv3).

The timeline for SSLv3 deprecation turned a bit better than I expected,
(for various reasons that were hard to predict in 2013), so at this point
"no SSLv2/SSLv3" is a good choice for both SMTP clients and servers.

-- 
	Viktor.

v2.23.0 | Report a Bug | By Email