Re: [TLS] The risk of misconfiguration

[Viktor Dukhovni <[e-mail]>]

On Tue, May 06, 2014 at 10:48:46PM +0000, Andrei Popov wrote:

> I have nothing to say in support of the EXPORT ciphers:)

Yes, and throw in LOW as well:

    EDH-RSA-DES-CBC-SHA     SSLv3 Kx=DH       Au=RSA  Enc=DES(56)   Mac=SHA1
    EDH-DSS-DES-CBC-SHA     SSLv3 Kx=DH       Au=DSS  Enc=DES(56)   Mac=SHA1
    ADH-DES-CBC-SHA         SSLv3 Kx=DH       Au=None Enc=DES(56)   Mac=SHA1
    DES-CBC-SHA             SSLv3 Kx=RSA      Au=RSA  Enc=DES(56)   Mac=SHA1

These (EXPORT and LOW) fortunately seem to have some time ago
outlived their useful life.  They can I think be disabled, rather
than offered at the bottom of the client cipherlist, without
degrading even opportunistic security where handshake-failure leads
to cleartext fallback.

This would leave OpenSSL with eNULL, MEDIUM and HIGH.  HIGH includes
3DES, presumably in part because this is a historical MUST implement
for interoperability cipher-suite.  In practice that role was and
to some extent still is actually played by RC4.

-- 
	Viktor.