IETF Logo Mail Archive

Re: [TLS] Deprecating SSLv3

Ronald del Rosario <rrosario@five9.com> Fri, 21 November 2014 16:22 UTC

Return-Path: <rrosario@five9.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44FAF1A1A7D for <tls@ietfa.amsl.com>; Fri, 21 Nov 2014 08:22:10 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.002
X-Spam-Level:
X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, GB_I_LETTER=-2, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2VgCPIkot2v2 for <tls@ietfa.amsl.com>; Fri, 21 Nov 2014 08:22:07 -0800 (PST)
Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2on0105.outbound.protection.outlook.com [65.55.169.105]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9FD551A0AFE for <tls@ietf.org>; Fri, 21 Nov 2014 08:22:06 -0800 (PST)
Received: from BY2FFO11FD060.protection.gbl (10.1.14.33) by BY2FFO11HUB051.protection.gbl (10.1.15.229) with Microsoft SMTP Server (TLS) id 15.1.6.13; Fri, 21 Nov 2014 16:22:03 +0000
Received: from mx02.five9.com (198.105.204.3) by BY2FFO11FD060.mail.protection.outlook.com (10.1.15.184) with Microsoft SMTP Server (TLS) id 15.1.6.13 via Frontend Transport; Fri, 21 Nov 2014 16:22:03 +0000
Received: from MB01.five9.com (10.7.8.141) by mx02.five9.com (10.7.15.112) with Microsoft SMTP Server (TLS) id 14.3.158.1; Fri, 21 Nov 2014 08:21:28 -0800
Received: from MB02.five9.com ([fe80::ede6:8312:5207:4046]) by mb01.five9.com ([fe80::ddc6:159a:f53:8ee7%15]) with mapi id 14.03.0158.001; Fri, 21 Nov 2014 08:22:01 -0800
From: Ronald del Rosario <rrosario@five9.com>
To: Nikos Mavrogiannopoulos <nmav@redhat.com>, Alfredo Pironti <alfredo@pironti.eu>
Thread-Topic: [TLS] Deprecating SSLv3
Thread-Index: AQHQAco2e4qtTz+EvUazdX0Ck5kotZxkWiWAgAdsKID//4SnAA==
Date: Fri, 21 Nov 2014 16:22:01 +0000
Message-ID: <D094A690.18053%rrosario@five9.com>
References: <CABkgnnWw9zsrqQzHVU0vXLJM+HBK3QYxJAZE+0kgGkEQEzwS=w@mail.gmail.com> <5462714E.5020201@polarssl.org> <CABkgnnUm=6TriH9UU-Uv8_rWt_CEvW1Xy8P_955ryFCvn3mWOA@mail.gmail.com> <1193984696.9333579.1416162106243.JavaMail.zimbra@redhat.com> <CALR0uiLfH-p9EbGF_=J8XMEuMczMsZJMfECKDt5E0Q9BBEpDOQ@mail.gmail.com> <1416584605.18312.21.camel@dhcp-2-127.brq.redhat.com>
In-Reply-To: <1416584605.18312.21.camel@dhcp-2-127.brq.redhat.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/14.4.6.141106
x-originating-ip: [10.7.8.112]
Content-Type: multipart/related; boundary="_004_D094A69018053rrosariofive9com_"; type="multipart/alternative"
MIME-Version: 1.0
X-EOPAttributedMessage: 0
X-Forefront-Antispam-Report: CIP:198.105.204.3; CTRY:US; IPV:NLI; EFV:NLI; SFV:NSPM; SFS:(10019020)(979002)(438002)(24454002)(199003)(189002)(377424004)(377454003)(30436002)(66926002)(19580405001)(95666004)(84326002)(83506001)(15975445006)(6806004)(107046002)(106116001)(31966008)(20776003)(53416004)(16236675004)(19580395003)(36756003)(64706001)(2656002)(17760045003)(67866002)(87936001)(4396001)(50986999)(92566001)(92726001)(21056001)(99936001)(76176999)(86362001)(93886004)(46102003)(77156002)(77096003)(180100001)(18206015028)(512954002)(71186001)(44976005)(120916001)(62966003)(99396003)(54356999)(106466001)(19627595001)(19617315012)(7099021)(85436002)(969003)(989001)(999001)(1009001)(1019001); DIR:OUT; SFP:1102; SCL:1; SRVR:BY2FFO11HUB051; H:mx02.five9.com; FPR:; MLV:ovrnspm; PTR:mx02.five9.com; A:1; MX:1; LANG:en;
X-Microsoft-Antispam: UriScan:;
X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:;SRVR:BY2FFO11HUB051;
X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(1)(2); SRVR:BY2FFO11HUB051;
X-Forefront-PRVS: 0402872DA1
Received-SPF: Pass (protection.outlook.com: domain of five9.com designates 198.105.204.3 as permitted sender) receiver=protection.outlook.com; client-ip=198.105.204.3; helo=mx02.five9.com;
Authentication-Results: spf=pass (sender IP is 198.105.204.3) smtp.mailfrom=rrosario@five9.com;
X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:;SRVR:BY2FFO11HUB051;
X-OriginatorOrg: five9.com
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/A7sEdEcUrrBRfG-cT0vgvtwyQSo
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Deprecating SSLv3
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 21 Nov 2014 16:22:10 -0000

3. The document doesn't provide any instructions for clients that have
no other way to communicate with a server that only supports SSL 3.0.
MUST NOT is nice in theory, but can only be enforced on the systems one
has control on, and if the advise is followed to the letter legacy
systems (not talking of web) will be only be accessible in plaintext.
I'd expect prohibiting the fallback dance instead, and requiring that
SSL 3.0 is negotiated only if TLS 1.0 or later are advertised in the
clientHello.

+1

Ron F. del Rosario
Information Security Officer

[cid:C1FFC277-777B-42EE-B330-35D87AA7FD50]

Five9, Inc.
Cloud Contact Center Software

From: Nikos Mavrogiannopoulos <nmav@redhat.com<mailto:nmav@redhat.com>>
Date: Friday, November 21, 2014 at 7:43 AM
To: Alfredo Pironti <alfredo@pironti.eu<mailto:alfredo@pironti.eu>>
Cc: "tls@ietf.org<mailto:tls@ietf.org>" <tls@ietf.org<mailto:tls@ietf.org>>
Subject: Re: [TLS] Deprecating SSLv3

On Sun, 2014-11-16 at 23:22 +0100, Alfredo Pironti wrote:


Yes, I agree this is a fair point. I'll complete the wording tomorrow
in the pending PR, and these ideas will get into the updated version.

Some additional comments:
1. It has quite awkward structure. The main body of the document is at
the introduction section.

2. The text "Negotiation of SSLv3 from any version of TLS MUST NOT be
permitted."
Not sure I understand what it means. Does it mean that fallback to SSL
3.0 from any version of TLS MUST NOT be permitted?

3. The document doesn't provide any instructions for clients that have
no other way to communicate with a server that only supports SSL 3.0.
MUST NOT is nice in theory, but can only be enforced on the systems one
has control on, and if the advise is followed to the letter legacy
systems (not talking of web) will be only be accessible in plaintext.
I'd expect prohibiting the fallback dance instead, and requiring that
SSL 3.0 is negotiated only if TLS 1.0 or later are advertised in the
clientHello.

regards,
Nikos



_______________________________________________
TLS mailing list
TLS@ietf.org<mailto:TLS@ietf.org>
https://www.ietf.org/mailman/listinfo/tls


________________________________

CONFIDENTIALITY NOTICE: This e-mail and any files attached may contain confidential information of Five9 and/or its affiliated entities. Access by the intended recipient only is authorized. Any liability arising from any party acting, or refraining from acting, on any information contained in this e-mail is hereby excluded. If you are not the intended recipient, please notify the sender immediately, destroy the original transmission and its attachments and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Copyright in this e-mail and any attachments belongs to Five9 and/or its affiliated entities.

v2.14.0 | Report a Bug | By Email