Re: [TLS] Prohibiting SSL 3.0

[Hubert Kario <[e-mail]>]

On Wednesday 29 October 2014 13:18:59 Ilari Liusvaara wrote:
> On Wed, Oct 29, 2014 at 10:51:39AM +0000, Peter Gutmann wrote:
> > Hubert Kario <[e-mail]> writes:
> > >Even the TLS 1.3 draft says that a client SHOULD NOT send a SSLv2
> > >compatible client hello with server support being stated as MAY.
> > 
> > Good grief, it's still allowing SSLv2 after nearly *twenty years*?  This
> > should have been MUST NOT for both client and server years ago, and at an
> > absolute minimum SHOULD NOT SSLv3 as well.
> 
> Also, one can't even use SSLv2 compatible ClientHello for TLS v1.3 because
> TLS v1.3 backward compatiblity mode requires extensions, and SSLv2 can't
> pass those.
> 
> Checking SSL pulse (which I think scans global Internet, not all kinds of
> odd internal sites nobody cares about) gives ~19% for SSLv2 (this isn't
> the compatiblity hello, this the whole protocol!), which is scary.

In my scans (a bit bigger set than SSL Pulse), I see over 1% of servers that 
don't support anything but SSLv2!

I also see a bit smaller set of SSLv2 protocol compatible servers, at ~10%. 
The difference may come from the fact that my test is counting only those that 
have SSLv2 ciphers configured, while Ivan Ristic scanner detects SSLv2 
enabled, but no ciphers set, I'd guess it may count those towards the ~19% 
total.
-- 
Regards,
Hubert Kario