Re: [TLS] Deprecating SSLv3

[Hubert Kario <[e-mail]>]

On Monday 24 November 2014 18:06:22 Martin Rex wrote:
> Hubert Kario wrote:
> > Anyway, you should file a complaint to the manufacturer that it haven't
> > addressed the POODLE vulnerability in their product (or that it doesn't
> > implement advertised protocols properly).
> 
> Poodle is a *PURE* Web-Browser and client problem.
> Servers are not vulnerable to Poodle, and this site *REQUIRES*
> TLS client certs for authentication.
> 
> Disabling SSLv3 on servers is only a practical mitigation against
> the stupid "downgrade dance" that so many browsers perform.
> It's difficult for me to understand how someone could implement
> the downgrade dance and *NOT* provide a switch to turn it off after
> addressing the rfc5746 tls renegotiation issue.

To exploit POODLE you need fallback dance *or* support just SSLv3. It's not 
limited to web browsers (and there are some clients that do fallback and are 
not browsers, e.g. curl).

Also, are you saying that an *automated* system won't retry on connection 
failure?

We're talking about average of 128 failed requests per byte decrypted, even if 
we fail just every first connection on a system that queries remote server 
every 5 minutes 24/7 that will require just a month to decrypt 16 byte 
password/authentication string. There have been far more dedicated and longer 
attacks in the wild.

SSLv3 has known security problems, more issues may be discovered in the 
future... or not (as the researchers may decide that it was thus completely 
broken and as such not worth investigating further). So while use of 
certificates may mitigate this problem, we may not ever know if it mitigates 
all problems SSLv3 has. For example, issues like 3-shake won't be fixed in 
SSLv3. In my opinion, continued use of it for security-critical applications 
qualifies for gross negligence.

Do we really need the repeat of the MD5 signatures story or can we learn on 
our own (as in industry) mistakes?
-- 
Regards,
Hubert Kario