Subject: [Uta] POODLE

From: Watson Ladd <[email-masked]>
Date: Tue, 14 Oct 2014 15:55:24 -0700

Dear all,

SSLv3 is busted once again. We need to fully disable it. The issue is an
enhanced padding oracle attack discovered at Google. This is not timing
based: there is no cure. Reconciliation with the result on MAC then encrypt
security is left as an exercise to the reader.

Sincerely,
Watson Ladd

---

From: Aaron Zauner <[email-masked]>
Date: Wed, 15 Oct 2014 00:58:24 +0200

> security is left as an exercise to the reader.

+1. (Obviously from previous discussions today on this list)

Aaron

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 14 Oct 2014 19:00:21 -0400

It’s pretty simple: There are no longer any secure SSLv3 ciphers.

They only thing to do with SSLv3 is MUST NOT USE.
--
Principal Security Engineer, Akamai Technologies
IM: [email-masked]<mailto:[email-masked]> Twitter: RichSal

---

From: Leif Johansson <[email-masked]>
Date: Wed, 15 Oct 2014 01:01:59 +0200

On 2014-10-15 00:55, Watson Ladd wrote:
> based: there is no cure. Reconciliation with the result on MAC then
> encrypt security is left as an exercise to the reader.
> 
> Sincerely,
> Watson Ladd
> 

so long windows XP ...