Re: [TLS] Deprecating SSLv3

[[e-mail] (Martin Rex)]

Hubert Kario wrote:
> 
> I've extended the scanner to try more fallbacks when testing (retry with a 
> much smaller client hello) and the stats for this month look like this:
> 
> Supported Protocols       Count     Percent
> -------------------------+---------+-------
> SSL2                      38835     8.7934
> SSL2 Only                 100       0.0226
> SSL3                      204062    46.2059
> SSL3 Only                 2195      0.497
> SSL3 or TLS1 Only         108575    24.5847
> SSL3 or lower Only        2293      0.5192
> TLS1                      438481    99.2856
> TLS1 Only                 46428     10.5127
> TLS1 or lower Only        143729    32.5447
> TLS1.1                    281522    63.7453
> TLS1.1 Only               25        0.0057
> TLS1.1 or up Only         443       0.1003
> TLS1.2                    292517    66.2349
> TLS1.2 Only               337       0.0763
> TLS1.2, 1.0 but not 1.1   13585     3.0761

How do TLS extension support fit into your picture?

Just a few days ago I was working on a customer message about interop
problems with a Business-2-Business scenario, and the Server that is used
seems to be an extensions-intolerant TLSv1.0 server.  The server is OK
with ClientHello.client_version = { 3, 3 }, but when ClientHello includes
any TLS extensions, it will abort with a fatal unexpected_message(10) alert.

 (the Website is http://www.elemica.com,
   the service(s) are on https://preprod.connect.elemica.com:5443
                     and https://connect.elemica.com:5443
   authentication is by TLS client certificate, but you'll see the
   TLS extensions intolerance by the fatal alert response to ClientHello.


> 
> I think we can safely banish a protocol that only 0.5% of servers require for
> interoperability.

Maybe you can, but I can not.  The support load would still be prohibitive.



> 
> Regarding the SSLv3 MUST NOT: we have to remember that we're talking about a 
> security protocol *used* for security. In such context SSLv3 should not be 
> used.
> 
> Just like MD5 use for digital signatures is completely broken but is 
> completely fine to use it as a checksum to verify proper download of a file 
> over internet (people use CRC32 for that!), use of SSLv3 for interop is fine, 
> but not if it is used for confidentiality.

You might not be aware of it, but there is only one TLS protocol version
that allows digital signatures with md5WithRsaEncryption, and that is TLSv1.2.


-Martin