Subject: Re: [TLS] Prohibiting SSL 3.0

From: Peter Gutmann <[email-masked]>
Date: Wed, 29 Oct 2014 10:51:39 +0000

Hubert Kario <[email-masked]> writes:

>Even the TLS 1.3 draft says that a client SHOULD NOT send a SSLv2 compatible
>client hello with server support being stated as MAY. 

Good grief, it's still allowing SSLv2 after nearly *twenty years*?  This
should have been MUST NOT for both client and server years ago, and at an
absolute minimum SHOULD NOT SSLv3 as well.

Peter.

---

From: Ilari Liusvaara <[email-masked]>
Date: Wed, 29 Oct 2014 13:18:59 +0200

> absolute minimum SHOULD NOT SSLv3 as well.

Also, one can't even use SSLv2 compatible ClientHello for TLS v1.3 because
TLS v1.3 backward compatiblity mode requires extensions, and SSLv2 can't
pass those.

Checking SSL pulse (which I think scans global Internet, not all kinds of
odd internal sites nobody cares about) gives ~19% for SSLv2 (this isn't
the compatiblity hello, this the whole protocol!), which is scary.

-Ilari

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 29 Oct 2014 05:50:58 -0700

> absolute minimum SHOULD NOT SSLv3 as well.

I haven't gotten around to rewriting this section yet, but it's on my list

-Ekr

>
> Peter.
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 29 Oct 2014 09:06:59 -0400

> have been MUST NOT for both client and server years ago, and at an

Agree.

--  
Principal Security Engineer, Akamai Technologies
IM: [email-masked] Twitter: RichSalz

---

From: Hubert Kario <[email-masked]>
Date: Wed, 29 Oct 2014 14:25:02 +0100

On Wednesday 29 October 2014 13:18:59 Ilari Liusvaara wrote:
> > >Even the TLS 1.3 draft says that a client SHOULD NOT send a SSLv2
> > >compatible client hello with server support being stated as MAY.
> > 

In my scans (a bit bigger set than SSL Pulse), I see over 1% of servers that 
don't support anything but SSLv2!

I also see a bit smaller set of SSLv2 protocol compatible servers, at ~10%. 
The difference may come from the fact that my test is counting only those that 
have SSLv2 ciphers configured, while Ivan Ristic scanner detects SSLv2 
enabled, but no ciphers set, I'd guess it may count those towards the ~19% 
total.
-- 
Regards,
Hubert Kario

---

From: Yoav Nir <[email-masked]>
Date: Wed, 29 Oct 2014 17:06:51 +0200

> On Oct 29, 2014, at 3:25 PM, Hubert Kario <[email-masked]> wrote:
> 

I think that shows that there is an issue with the scan. A server that offers only SSLv2 is not on the web. No modern browser can connect to it. Are your scans going by the most popular HTTP sites that also answer on port 443?  Or are these really HTTPS sites that are accessed as such?

Yoav

---

From: Hubert Kario <[email-masked]>
Date: Wed, 29 Oct 2014 16:33:58 +0100

On Wednesday 29 October 2014 17:06:51 Yoav Nir wrote:
> > In my scans (a bit bigger set than SSL Pulse), I see over 1% of servers
> > that don't support anything but SSLv2!
> 
> I think that shows that there is an issue with the scan. A server that
> offers only SSLv2 is not on the web. No modern browser can connect to it.
> Are your scans going by the most popular HTTP sites that also answer on
> port 443?  Or are these really HTTPS sites that are accessed as such?

they are very much on the web for IE 6 users

I'm using Alexa top 1 million sites

but I'm not checking if the sites use redirect to https (as the redirect may 
be just for login page, only for admins, etc.) so it may not be actually 
visible for regular visitors

I also don't check for CN mismatch (as some clients don't check CNs too...)

That being said, I didn't verify how reliable are the scan results for SSL2 
Only sites, so yes, it may be even less than 1%.

-- 
Regards,
Hubert Kario

---

From: Yoav Nir <[email-masked]>
Date: Wed, 29 Oct 2014 17:43:42 +0200

> On Oct 29, 2014, at 5:33 PM, Hubert Kario <[email-masked]> wrote:
> 

Right. So it’s not like they expect everyone to visit their site. They’re either responding to programmatic clients or they have their small group of users who keep using IE6 on XP especially for accessing those sites.

> I also don't check for CN mismatch (as some clients don't check CNs too…)

Are you validating certificates?  Could some of these sites be showing the Apache default page with a self-signed certificate?

---

From: Hubert Kario <[email-masked]>
Date: Wed, 29 Oct 2014 16:47:38 +0100

On Wednesday 29 October 2014 17:43:42 Yoav Nir wrote:
> Are you validating certificates?  Could some of these sites be showing the
> Apache default page with a self-signed certificate?

Yes, I'm validating them against the Mozilla set of CA certificates. No, the 
stats exclude sites that serve either self signed or corporate signed 
certificates.

-- 
Regards,
Hubert Kario