Re: [TLS] AES and SSLv3 (was Re: Unfortunate current practices for HTTP

[Martin Rex <[e-mail]>]

Michael D'Errico wrote:
> 
> The SHA-256 cipher suites aren't compatible with SSLv3 since the SSLv3
> spec only shows what to do with MD5 and SHA-1.  But there is nothing
> about AES which is incompatible with SSLv3, and indeed my server is able
> to negotiate non-SHA-256 AES_CBC cipher suites with SSLv3 clients that
> offer them.
> 
> So my question is now:
> 
>      If a client offers AES cipher suites in a ClientHello with a
>      version of 0300, why is it wrong to choose one of them?

I'm not aware of _any_ reason why the ciphersuites defined in rfc-3268.

In fact, if you look at rfc-3268:

Cipher Usage

   The new ciphersuites proposed here are very similar to the following,
   defined in [TLS]:

   TLS_RSA_WITH_3DES_EDE_CBC_SHA
   TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA
   TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA
   TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
   TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
   TLS_DH_anon_WITH_3DES_EDE_CBC_SHA

and then look up these cipher suites in rfc-2246 and then in
SSLv3 draft302.txt, you ought to realize that these "very similar"
cipher suites are really SSLv3 cipher suites.

Using and interoperating AES cipher suites from rfc-3268 with
Firefox and OpenSSL works without any additional thoughts.
(preventing it from working probably require additonal code).

Since AES128 is faster than tripleDES it would be unreasonable
to leave this cipher suite _not_ working with SSLv3.

But I know of at least one TLS implementation shipped by a large vendor
that aborts on the combination of rfc-3268 cipher suites and SSLv3.


-Martin