Timeline for POODLE and TLS...not SSL
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 5, 2015 at 14:27 | comment | added | Matt Nordhoff | @Polynomial This is off-topic, but an encrypt-then-MAC extension for TLS was published... six months ago. | |
| Mar 5, 2015 at 13:50 | vote | accept | lara400 | ||
| Mar 5, 2015 at 13:17 | comment | added | lara400 | Thanks a lot for this - answers all the information I needed to know. Appreciate it a lot! | |
| Mar 5, 2015 at 12:13 | comment | added | Polynomial | Oh, joy. Time to go update our standard recommendations then! Maybe we'll get a sensible TLS spec by 2035. | |
| Mar 5, 2015 at 12:12 | comment | added | Thomas Pornin | In any case, even the best designed protocol can always be translated into vulnerable implementations if the developer chooses not to follow the specification. There is very little protocol designers can do against that. | |
| Mar 5, 2015 at 12:11 | comment | added | Thomas Pornin | Prolonged use of MAC-then-encrypt was for "backward compatibility". I suppose that the people who designed TLS 1.1 and 1.2 assumed that there was 0% probability of adoption of the new versions by existing libraries if they asked for too large a change of the protocol... Anyway, TLS 1.1 and 1.2 are also vulnerable to POODLE if they are poorly implemented. The TLS 1.0, 1.1 and 1.2 specification all say explicitly that the client MUST check all padding bytes; if someone disregards that "MUST" for TLS 1.0 implementation, he can conceptually disregard it when doing TLS 1.1 and 1.2 as well. | |
| Mar 5, 2015 at 12:02 | history | edited | Polynomial | CC BY-SA 3.0 |
added 78 characters in body
|
| Mar 5, 2015 at 12:00 | comment | added | Polynomial | My bad - I honestly thought it was encrypt-then-MAC. Why are we still using that crappy construction!? shakes head ... Also, does that mean I'm wrong then? POODLE can still work against TLS1.1/1.2 if they do the padding badly? | |
| Mar 5, 2015 at 11:56 | comment | added | Thomas Pornin | TLS 1.1 and 1.2 still use MAC-then-encrypt. TLS 1.2 optionally supports cipher suites that use a better method (GCM) but in many case, MAC-then-encrypt (with CBC) is still used. However, people who do a sloppy job at implementing TLS 1.0 rarely implement 1.1 and 1.2 at all. What TLS 1.1+ provides is a per-record IV that protects against exploitation of some of the CBC issues (BEAST...) but it does nothing against the issue leveraged by POODLE. | |
| Mar 5, 2015 at 11:11 | history | answered | Polynomial | CC BY-SA 3.0 |