The POODLE bites again

#1

Post by deepblueocean » Mon, Dec 08, 2014, 7:51 PM UTC

The POODLE bites again
imperialviolet.org

Re: The POODLE bites again

#2

Post by huxley » Mon, Dec 08, 2014, 11:21 PM UTC

Link didn't work for me, here is the Google Cache text version:

http://webcache.googleusercontent.com/search?q=cache:f01MHrX...

Re: The POODLE bites again

#3

Post by resonantcore » Mon, Dec 08, 2014, 11:26 PM UTC

We look forward to TLS 1.2 support being the norm. (And then, hopefully, the ratification and adoption of TLS 1.3)

A 50% adoption rate is excellent news. Still a long way to go, but that's worth toasting over.

Re: The POODLE bites again

#4

Post by yuhong » Mon, Dec 08, 2014, 11:31 PM UTC

resonantcore wrote: post #3

We look forward to TLS 1.2 support being the norm. (And then, hopefully, the ratification and adoption of TLS 1.3) A 50% adoption rate is excellent news. Still a long way to go, but that's worth toasting over.

What is frustrating is how many such servers have TLS 1.3 intolerance (even PayPal), and often the same servers are also affected by this bug. I wonder what TLS implementation is this.

Re: The POODLE bites again

#5

Post by eyeareque » Mon, Dec 08, 2014, 11:49 PM UTC

Are there any more details than what this write up contains?

Re: The POODLE bites again

#6

Post by feld » Tue, Dec 09, 2014, 3:27 AM UTC

yuhong wrote: post #4

resonantcore wrote: post #3

We look forward to TLS 1.2 support being the norm. (And then, hopefully, the ratification and adoption of TLS 1.3) A 50% adoption rate is excellent news. Still a long way to go, but that's worth toasting over.

What is frustrating is how many such servers have TLS 1.3 intolerance (even PayPal), and often the same servers are also affected by this bug. I wonder what TLS implementation is this.

TLS 1.3 isn't finished yet...

Re: The POODLE bites again

#7

Post by cryptbe » Tue, Dec 09, 2014, 3:33 AM UTC

POODLE worked not only against SSLv3, but also against any TLS implementations that check padding in SSLv3's style (e.g., just checking the last byte, and ignoring the rest of the padding). SSL accelerators from F5 and A10 were vulnerable. Thus, many of the world's largest sites were vulnerable.

Re: The POODLE bites again

#8

Post by yuhong » Tue, Dec 09, 2014, 3:45 AM UTC

feld wrote: post #6

yuhong wrote: post #4

Earlier quoted context omitted.

What is frustrating is how many such servers have TLS 1.3 intolerance (even PayPal), and often the same servers are also affected by this bug. I wonder what TLS implementation is this.

TLS 1.3 isn't finished yet...

I know, the goal is to prepare.

Re: The POODLE bites again

#9

Post by tacoman » Tue, Dec 09, 2014, 4:32 AM UTC

"This seems like a good moment to reiterate that everything less than TLS 1.2 with an AEAD cipher suite is cryptographically broken."

So this means AES-GCM essentially?

Re: The POODLE bites again

#10

Post by colmmacc » Tue, Dec 09, 2014, 6:13 AM UTC

tacoman wrote: post #9

"This seems like a good moment to reiterate that everything less than TLS 1.2 with an AEAD cipher suite is cryptographically broken." So this means AES-GCM essentially?

Well, almost. AES-GCM is also "Cryptographically Broken" if you take into account software implementations using table lookup schemes that are subject to cache timing attacks. But the fundamental AEAD support in TLS1.2 is a much better place to be overall - and GCM tags are much better than the MAC-then-Encrypt HMACs elsewhere in TLS. For practical purposes; AES-GCM is the "least worst", by a long way.