Re: [TLS] Another IRINA bug in TLS

Karthikeyan Bhargavan <karthik.bhargavan@gmail.com> Mon, 25 May 2015 12:28 UTC

Return-Path: <karthik.bhargavan@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E58B61A8955 for <tls@ietfa.amsl.com>; Mon, 25 May 2015 05:28:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.982
X-Spam-Level:
X-Spam-Status: No, score=-4.982 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_ADSP_CUSTOM_MED=0.001, FREEMAIL_FROM=0.001, HELO_EQ_FR=0.35, HTML_MESSAGE=0.001, NML_ADSP_CUSTOM_MED=0.9, RCVD_IN_DNSWL_HI=-5, SPF_SOFTFAIL=0.665] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HPQPN_MCihB3 for <tls@ietfa.amsl.com>; Mon, 25 May 2015 05:27:57 -0700 (PDT)
Received: from mail2-relais-roc.national.inria.fr (mail2-relais-roc.national.inria.fr [192.134.164.83]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5565D1A896C for <tls@ietf.org>; Mon, 25 May 2015 05:27:57 -0700 (PDT)
X-IronPort-AV: E=Sophos;i="5.13,491,1427752800"; d="scan'208,217";a="154008358"
Received: from wifi-auth-191208.inria.fr ([128.93.191.208]) by mail2-relais-roc.national.inria.fr with ESMTP/TLS/AES128-SHA; 25 May 2015 14:27:55 +0200
Content-Type: multipart/alternative; boundary="Apple-Mail=_A06D62C0-63C1-41EA-AE00-EBDED33A797E"
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
From: Karthikeyan Bhargavan <karthik.bhargavan@gmail.com>
In-Reply-To: <61EBC3C9-0C0E-499E-9108-2432D9201FDB@gmail.com>
Date: Mon, 25 May 2015 14:27:55 +0200
Message-Id: <3B25BA9D-BC3C-4F7E-9C39-341738CF8BE3@gmail.com>
References: <CACsn0ckaML0M_Foq9FXs5LA2dRb1jz+JDX7DUej_ZbuSkUB=tQ@mail.gmail.com> <op.xyzc65g63dfyax@killashandra.invalid.invalid> <20150523101609.GA9409@roeckx.be> <2255850.hidEDnQLjj@pintsize.usersys.redhat.com> <61EBC3C9-0C0E-499E-9108-2432D9201FDB@gmail.com>
To: Karthikeyan Bhargavan <karthik.bhargavan@gmail.com>
X-Mailer: Apple Mail (2.1878.6)
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/5go2njod84fBQgyx_Cx4Rq2Q-u4>
Cc: tls@ietf.org
Subject: Re: [TLS] Another IRINA bug in TLS
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 25 May 2015 12:28:02 -0000

Argh, percentages revesed:

Alexa Top 1M:      45 K hosts out of 539K HTTPS hosts (8.4%)
Browser-trusted : 706K hosts out of 14.3M HTTPS hosts with browser trusted certs (4.9%)

On 25 May 2015, at 14:26, Karthikeyan Bhargavan <karthik.bhargavan@gmail.com> wrote:

> 
> On 25 May 2015, at 14:02, Hubert Kario <hkario@redhat.com> wrote:
> 
>>> Hubert Kario's latest results on
>>> https://securitypitfalls.wordpress.com/2015/03/29/march-2015-scan-results/
>>> show:
>>> EXP-EDH-RSA-DES-CBC-SHA 22110     4.5043%
>> 
>> hmm, that is a bit big difference...
>> 
>> If I ignore the "trust" bit in results I'm still getting just:
>> EXP-EDH-RSA-DES-CBC-SHA 41804     6.2565
> 
> At weakdh.org, we use numbers from the ZMap scans (https://scans.io/)
> 
> In March 2015, the number of servers supporting for TLS_DHE_*_EXPORT_* were:
> 
> Alexa Top 1M:      45 K hosts out of 539K HTTPS hosts (4.9%)
> Browser-trusted : 706K hosts out of 14.3M HTTPS hosts with browser trusted certs (8.4%)
> 
> We think the numbers should have gone down some, partly due to servers turning off *_EXPORT_*
> in the wake of FREAK (but sadly, not nearly enough servers reacted to FREAK).
> 
> Best,
> Karthik
> 
> 
> 
> 
> 
> 
>> 
>> From 668168 sample.
>> 
>> But then there is something which matches rather well the percentage:
>> EDH-RSA-DES-CBC-SHA     75939     11.3653
>> (note the lack of "EXP-")
>> -- 
>> Regards,
>> Hubert Kario
>> Quality Engineer, QE BaseOS Security team
>> Web: www.cz.redhat.com
>> Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic_______________________________________________
>> TLS mailing list
>> TLS@ietf.org
>> https://www.ietf.org/mailman/listinfo/tls
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls