Re: [TLS] TLS and KCI vulnerable handshakes

[Viktor Dukhovni <[e-mail]>]

On Mon, Aug 17, 2015 at 03:53:59PM +0000, Peter Gutmann wrote:
> Viktor Dukhovni <[e-mail]> writes:
> 
> >I can't answer why, but I know what and when:
> 
> I was trying to avoid finger-pointing so I didn't go through the changelog to
> see whodunnit, I was more interested in the motivation.  Same for Apple, why
> would you implement something that pretty much no-one else (at the time)
> supported, and for good reason?
> 
> Having said that though:
> 
> DH-DSS-CAMELLIA256-SHA  SSLv3 Kx=DH/DSS   Au=DH   Enc=Camellia(256) Mac=SHA1
> DH-DSS-CAMELLIA128-SHA  SSLv3 Kx=DH/DSS   Au=DH   Enc=Camellia(128) Mac=SHA1
> DH-DSS-SEED-SHA         SSLv3 Kx=DH/DSS   Au=DH   Enc=SEED(128) Mac=SHA1
> DH-DSS-DES-CBC-SHA      SSLv3 Kx=DH/DSS   Au=DH   Enc=DES(56)   Mac=SHA1
> DH-RSA-DES-CBC-SHA      SSLv3 Kx=DH/RSA   Au=DH   Enc=DES(56)   Mac=SHA1
> 
> that sort of stuff just compounds the WTF.  Static DH + DSA + single DES, added in 2012.
> W. T. F.

The mechanics of how it happened are simple enough.  The ciphers
were there all along for around a decade or so, but they were all
disabled because the key exchage method was not implemented.

What happened in 2012 is that the key exchange got implemented, so
presto-magic a new single-DES fixed-DH cipher.

I'd like to see more attention paid to changes that explicitly or
implicitly introduce new ciphers that fall into the WTF category.

I hope we'll be able to exercise more discretion going forward.

That said, has https://tools.ietf.org/html/rfc5469 been sufficiently
well publicized?  I've seen a lot of discussion around the deprecation
of RC4, but DES and IDEA seem to have lingered on...

--
	Viktor.