IETF Logo Mail Archive

Re: [TLS] Deprecating SSLv3

Nikos Mavrogiannopoulos <nmav@redhat.com> Mon, 24 November 2014 08:16 UTC

Return-Path: <nmav@redhat.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BAEAB1A1BF9 for <tls@ietfa.amsl.com>; Mon, 24 Nov 2014 00:16:34 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.211
X-Spam-Level:
X-Spam-Status: No, score=-4.211 tagged_above=-999 required=5 tests=[BAYES_50=0.8, RCVD_IN_DNSWL_HI=-5, SPF_HELO_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3MoH20DzjnuJ for <tls@ietfa.amsl.com>; Mon, 24 Nov 2014 00:16:33 -0800 (PST)
Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 621771A1BE3 for <tls@ietf.org>; Mon, 24 Nov 2014 00:16:33 -0800 (PST)
Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id sAO8GWnV016853 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Mon, 24 Nov 2014 03:16:32 -0500
Received: from [10.34.2.127] (dhcp-2-127.brq.redhat.com [10.34.2.127]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id sAO8GTeQ023470 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NO); Mon, 24 Nov 2014 03:16:31 -0500
Message-ID: <1416816989.2533.7.camel@dhcp-2-127.brq.redhat.com>
From: Nikos Mavrogiannopoulos <nmav@redhat.com>
To: Kurt Roeckx <kurt@roeckx.be>
Date: Mon, 24 Nov 2014 09:16:29 +0100
In-Reply-To: <20141122105659.GA26446@roeckx.be>
References: <CABkgnnWw9zsrqQzHVU0vXLJM+HBK3QYxJAZE+0kgGkEQEzwS=w@mail.gmail.com> <5462714E.5020201@polarssl.org> <CABkgnnUm=6TriH9UU-Uv8_rWt_CEvW1Xy8P_955ryFCvn3mWOA@mail.gmail.com> <1193984696.9333579.1416162106243.JavaMail.zimbra@redhat.com> <CALR0uiLfH-p9EbGF_=J8XMEuMczMsZJMfECKDt5E0Q9BBEpDOQ@mail.gmail.com> <1416584605.18312.21.camel@dhcp-2-127.brq.redhat.com> <CALR0ui+1e8pm+67Pn3LV_Pw2Ma1K7c2egWf=m7amDck9fAn62A@mail.gmail.com> <CABkgnnUsOh=4FFiahH4__SGj8ke39g2x0DJBTRruuNFgNHqY5Q@mail.gmail.com> <1052358743.2229177.1416652827952.JavaMail.zimbra@redhat.com> <20141122105659.GA26446@roeckx.be>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Scanned-By: MIMEDefang 2.68 on 10.5.11.24
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/Rdh1TGljNNTfye3GAretIzltNlQ
Cc: tls@ietf.org
Subject: Re: [TLS] Deprecating SSLv3
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 24 Nov 2014 08:16:34 -0000

On Sat, 2014-11-22 at 11:56 +0100, Kurt Roeckx wrote:
> On Sat, Nov 22, 2014 at 05:40:27AM -0500, Nikos Mavrogiannopoulos wrote:
> > That highlights the main difference 
> > with SSL 2.0 and rfc6176; there were no SSL 2.0-only services when it was published.
> 
> There still are SSLv2 only services on the internet.  Hubert Kario
> last scan results
> (https://lists.fedoraproject.org/pipermail/security/2014-October/001989.html)
> said:
> Supported Protocols       Count     Percent
> -------------------------+---------+-------
> SSL2                      44800     10.2755
> SSL2 Only                 5536      1.2698

I believe that this shows more about issues with the sample of the test
rather than functioning SSLv2 only servers. Given that there is no way
to connect to them anyway, they could be misconfigured non functional
servers or honeypots. 

regards,
Nikos

v2.14.0 | Report a Bug | By Email