Re: [TLS] Deprecating SSLv3

[Hubert Kario <[e-mail]>]

On Monday 24 November 2014 09:16:29 Nikos Mavrogiannopoulos wrote:
> On Sat, 2014-11-22 at 11:56 +0100, Kurt Roeckx wrote:
> > On Sat, Nov 22, 2014 at 05:40:27AM -0500, Nikos Mavrogiannopoulos wrote:
> > > That highlights the main difference
> > > with SSL 2.0 and rfc6176; there were no SSL 2.0-only services when it
> > > was published.> 
> > There still are SSLv2 only services on the internet.  Hubert Kario
> > last scan results
> > (https://lists.fedoraproject.org/pipermail/security/2014-October/001989.ht
> > ml) said:
> > Supported Protocols       Count     Percent
> > -------------------------+---------+-------
> > SSL2                      44800     10.2755
> > SSL2 Only                 5536      1.2698
> 
> I believe that this shows more about issues with the sample of the test
> rather than functioning SSLv2 only servers. Given that there is no way
> to connect to them anyway, they could be misconfigured non functional
> servers or honeypots.

This is actually a result of their intolerance to SSLv3 ClientHello with large 
amount of ciphers (or RC4 placed after 64th position in the list - the win 2k3 
TLS bug).

I've extended the scanner to try more fallbacks when testing (retry with a 
much smaller client hello) and the stats for this month look like this:

Supported Protocols       Count     Percent
-------------------------+---------+-------
SSL2                      38835     8.7934
SSL2 Only                 100       0.0226
SSL3                      204062    46.2059
SSL3 Only                 2195      0.497
SSL3 or TLS1 Only         108575    24.5847
SSL3 or lower Only        2293      0.5192
TLS1                      438481    99.2856
TLS1 Only                 46428     10.5127
TLS1 or lower Only        143729    32.5447
TLS1.1                    281522    63.7453
TLS1.1 Only               25        0.0057
TLS1.1 or up Only         443       0.1003
TLS1.2                    292517    66.2349
TLS1.2 Only               337       0.0763
TLS1.2, 1.0 but not 1.1   13585     3.0761

(the script managed to connect to about 100 more servers with even smaller
client hello, most of which accepted just v2-compatible client hello, but I've 
not implemented the scan for such intolerant servers yet)


I think we can safely banish a protocol that only 0.5% of servers require for
interoperability.



Regarding the SSLv3 MUST NOT: we have to remember that we're talking about a 
security protocol *used* for security. In such context SSLv3 should not be 
used.

Just like MD5 use for digital signatures is completely broken but is 
completely fine to use it as a checksum to verify proper download of a file 
over internet (people use CRC32 for that!), use of SSLv3 for interop is fine, 
but not if it is used for confidentiality.


+1 to MUST NOT
-- 
Regards,
Hubert Kario