Re: [TLS] Deprecating SSLv3

[[e-mail] (Martin Rex)]

Hubert Kario wrote:
> Martin Rex wrote:
>> Hubert Kario wrote:
>>> I've extended the scanner to try more fallbacks when testing (retry with a
>>> much smaller client hello) and the stats for this month look like this:
>>> 
>>> Supported Protocols       Count     Percent
>>> -------------------------+---------+-------
>>> SSL2                      38835     8.7934
>>> SSL2 Only                 100       0.0226
>>> SSL3                      204062    46.2059
>>> SSL3 Only                 2195      0.497
>>> SSL3 or TLS1 Only         108575    24.5847
>>> SSL3 or lower Only        2293      0.5192
>>> TLS1                      438481    99.2856
>>> TLS1 Only                 46428     10.5127
>>> TLS1 or lower Only        143729    32.5447
>>> TLS1.1                    281522    63.7453
>>> TLS1.1 Only               25        0.0057
>>> TLS1.1 or up Only         443       0.1003
>>> TLS1.2                    292517    66.2349
>>> TLS1.2 Only               337       0.0763
>>> TLS1.2, 1.0 but not 1.1   13585     3.0761
>> 
>> How do TLS extension support fit into your picture?
> 
> I don't know.
> 
> That is: I'm using openssl command line binary (albeit with few changes, 
> modifications and additions compared to upstream) and as such I don't believe 
> I can send TLS1.0/1.1/1.2 Client Hello without extensions.
> 
> In other words, all those servers that report TLS1.0 as supported mean also 
> support for typical extensions (server_name, curves, signature_algorithms, 
> etc.). The amount of servers which are TLS extension intolerant and either 
> have SSLv3 disabled or are V2 client hello compatible is under 0.1%.


When I tested with https://preprod.connect.elemica.com:5443/
I realized that the openssl s_client tool has become somewhat unusable,
because it includes a lot of TLS extensions in client hello without
being asked to do so and also without a command line option to have it stop
doing this.

openssl-0.9.8y with "openssl s_client -no_ticket" seems to be able to
produce an extension-free TLSv1.0 ClientHello.


> 
> Anyway, you should file a complaint to the manufacturer that it haven't 
> addressed the POODLE vulnerability in their product (or that it doesn't 
> implement advertised protocols properly).

What are you talking about?

Poodle is a *PURE* Web-Browser and client problem.
Servers are not vulnerable to Poodle, and this site *REQUIRES*
TLS client certs for authentication.

Disabling SSLv3 on servers is only a practical mitigation against
the stupid "downgrade dance" that so many browsers perform.
It's difficult for me to understand how someone could implement
the downgrade dance and *NOT* provide a switch to turn it off after
addressing the rfc5746 tls renegotiation issue.


-Martin