Re: [TLS] Another IRINA bug in TLS

[Hubert Kario <[e-mail]>]

On Monday 25 May 2015 14:27:55 Karthikeyan Bhargavan wrote:
> Argh, percentages revesed:
> 
> Alexa Top 1M:      45 K hosts out of 539K HTTPS hosts (8.4%)

which would align with the "ignored trust bit" (3k difference), as cipherscan 
is using a scanning method which will under-report servers with broken cipher 
selection (intolerance to big client hello's, RC4 ciphers low in order, etc.).

Those broken servers can account for up to 11k or 8.8k hosts (when ignoring 
trust) depending on how you count.

Anyway, I've started a new scan yesterday, we'll see how quickly 
administrators reacted.

My scans are also on https://scans.io (look for Fedora Project), if you're 
interested in raw data.

But AFAIK, Yngve's aren't and those are the ones we were commenting about.

> Browser-trusted : 706K hosts out of 14.3M HTTPS hosts with browser trusted
> certs (4.9%)
> On 25 May 2015, at 14:26, Karthikeyan Bhargavan 
<[e-mail]> wrote:
> > On 25 May 2015, at 14:02, Hubert Kario <[e-mail]> wrote:
> >>> Hubert Kario's latest results on
> >>> https://securitypitfalls.wordpress.com/2015/03/29/march-2015-scan-result
> >>> s/
> >>> show:
> >>> EXP-EDH-RSA-DES-CBC-SHA 22110     4.5043%
> >> 
> >> hmm, that is a bit big difference...
> >> 
> >> If I ignore the "trust" bit in results I'm still getting just:
> >> EXP-EDH-RSA-DES-CBC-SHA 41804     6.2565
> > 
> > At weakdh.org, we use numbers from the ZMap scans (https://scans.io/)
> > 
> > In March 2015, the number of servers supporting for TLS_DHE_*_EXPORT_*
> > were:
> > 
> > Alexa Top 1M:      45 K hosts out of 539K HTTPS hosts (4.9%)
> > Browser-trusted : 706K hosts out of 14.3M HTTPS hosts with browser trusted
> > certs (8.4%)
> > 
> > We think the numbers should have gone down some, partly due to servers
> > turning off *_EXPORT_* in the wake of FREAK (but sadly, not nearly enough
> > servers reacted to FREAK).
> > 
> > Best,
> > Karthik
> > 
> >> From 668168 sample.
> >> 
> >> But then there is something which matches rather well the percentage:
> >> EDH-RSA-DES-CBC-SHA     75939     11.3653
> >> (note the lack of "EXP-")
> > 
> > _______________________________________________
> > TLS mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/tls

-- 
Regards,
Hubert Kario
Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic