This POODLE bites: exploiting the SSL 3.0 fallback

Re:This POODLE bites: exploiting the SSL 3.0 fallback by jerf on Tuesday October 14, 2014 @10:06PM (#8456850)

Check me on this: The TLS_FALLBACK_SCSV will prevent downgrade attacks, yes. However, any "real" SSLv3 connections will still be SSLv3 and still fully vulnerable to the described attack. Downgrading is not a necessary component of the attack, it just increases the number of vulnerable client/server combinations to include those that would normally not be vulnerable due to negotiating TLS1.0+. Therefore, if you are in a position where you truly care about security and the fact the SSLv3 has such an enormous hole in it is unacceptable, you should still be looking at simply turning off SSLv3 as the only acceptable mitigation, even if that does cut some clients off.

Yes?

(Except please note for the purposes of this question I'm assuming as a given that cutting off SSLv3 is considered preferable by the entity in question to a very weak SSL negotiation. Whether or not any given entity should have that opinion is a different question; I politely ask that you get into that question elsewhere.)

[ Parent | on HN ]

Re:This POODLE bites: exploiting the SSL 3.0 fallback by gsnedders on Tuesday October 14, 2014 @10:14PM (#8456871)

The end of https://www.imperialviolet.org/2014/10/14/poodle.html talks about this better than the several paragraphs I just wrote in a draft comment. So go read that.

tl;dr: practically, yes, we want to move away from SSLv3 ASAP, though it isn't totally broken yet.

[ Parent | on HN ]

Re:This POODLE bites: exploiting the SSL 3.0 fallback by jerf on Tuesday October 14, 2014 @10:37PM (#8456930)

Thanks. I wanted to check because there's a common pattern in these sorts of security incidents where some suggestion for possible mitigation gets made (note how I weakened that phrase) and by the time the game of security telephone is played out over a few panicky hours it turns into "just do X and the problem is solved!". For instance, "just switch to RC4!" was not exactly the most solid of advice for BEAST, if one actually thought about it, but it was frequently presented as The Solution (TM). (Not necessarily by knowledgeable people, of course, but by enough people.)

TLS_FALLBACK_SCSV has the danger of becoming that, but in the short term it doesn't seem like it actually does much in a world where, AFAIK, not very many SSL connections support it.

[ Parent | on HN ]

Re:This POODLE bites: exploiting the SSL 3.0 fallback by paulannesley on Tuesday October 14, 2014 @10:16PM (#8456877)

Sounds right, and I think that's covered by this:

> Disabling SSL 3.0 support, or CBC-mode ciphers with SSL 3.0, is sufficient to mitigate this issue, but presents significant compatibility problems, even today.

[ Parent | on HN ]

Re:This POODLE bites: exploiting the SSL 3.0 fallback by krakensden on Tuesday October 14, 2014 @11:37PM (#8457062)

> The TLS_FALLBACK_SCSV will prevent downgrade attacks

And it's only implemented by boringssl, ie, Google Chrome and Google's web servers?

[ Parent | on HN ]

Re:This POODLE bites: exploiting the SSL 3.0 fallback by brians on Wednesday October 15, 2014 @12:10AM (#8457119)

It's independently in others servers as well. No idea on clients yet.

[ Parent | on HN ]

Re:This POODLE bites: exploiting the SSL 3.0 fallback by wonsler on Wednesday October 15, 2014 @12:31AM (#8457181)

See https://github.com/yahoo/cnet for a client that uses BoringSSL

[ Parent | on HN ]