Re: [TLS] Working Group Last Call for draft-ietf-tls-sslv3-diediedie-00

[Hubert Kario <[e-mail]>]

On Thursday 29 January 2015 19:18:50 Kurt Roeckx wrote:
> On Thu, Jan 29, 2015 at 11:18:44AM +0100, Hubert Kario wrote:
> > > For
> > > some reason 1.2 actually seems to better support than 1.1.  There
> > > are a strange set of servers out there that support 1.0 and 1.2
> > > but not 1.1.
> > 
> > bug in openssl, SSL_OP_ALL from OpenSSL 1.0.0 did include
> > SSL_OP_NO_TLSv1_1
> > when run against OpenSSL 1.0.1:
> > https://rt.openssl.org/Ticket/Display.html?id=2802&user=guest&pass=guest
> > 
> > which you should know, given that you have submitted the above bug report
> > ;)
> I do know about that bug report.  The only people that should have
> been affected by it were those that compiled against 1.0.1 and not
> against ealier or later releases like any 1.0.0* or 1.0.1[a-l].
> 
> The sites that have this behaviour are also larger sites that
> probably use some kind of accelator hardware, 

well, one thing doesn't exclude the other - especially given the support for 
`engine` in OpenSSL

> and I suspect it's
> that hardware that doesn't do TLS 1.1.  At least 1 site I know
> about that doesn't know TLS 1.1 but does TLS 1.2 is also
> vulnerable to poodle in TLS, so they can't be using openssl.

interesting...
-- 
Regards,
Hubert Kario