Poodle - possible to protocol downgrade if SSLv3 is disabled but still have SSLv3 ciphers enabled?

Question

My title pretty much sums it up. If I have:

A server with the SSLv3 protocol disabled BUT still have SSLv3 ciphers enabled.

Would that mean that a protocol downgrade attack can still occur?

Answer 1

If your server does not support SSLv3, then it does not support SSLv3. "Protocol downgrade attacks" are methods to force a client and server to use a protocol version that they both support even though they both know at least one newer version that they would have wished to use, given the choice.

---

Anecdote: I am French. Back in 2005, I was walking in the streets of New York (5th avenue, I think); I was there for a congress. A few paces ahead of me, I see two tourists speaking together, and they speak in French. Two minutes and three blocks later, one of them notices me, and (crucially) that I was handling a map. So he resolves to ask me a question because they were a bit lost. He then talks to me in English. That's understandable: in New York, English is the "basic language". That guy knew two versions of the protocol (the English one and the French one) and obviously preferred the French one (since that was what he was using with his wife). Fortunately, I leveraged my previous knowledge (that he knew French) and we continued the conversation in French.

So that's it. A protocol downgrade attack is when you arrange for two French people to speak in English by preventing them from realizing that they both know French. However, that can happen only because they both agree to speak English. If one of them disables the "English" protocol (because he refuses to speak English, or simply does not know it, or knows only the utterly unintelligible Texan-accent variant of English), then of course they won't speak English at all, attack or no attack.