1

We've run an audit on our public servers with SSL and had a few warnings for weak ciphers and potential SWEET32 vulnerabilities.

It's our intention to remove every cipher that's secured with 3DES, namely:

TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 

and

TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) 

I understand this will effectively kill support for very old browsers such as IE7/8 running on XP, but are there any other potential negative impacts of this action?

2

Utimately it's down to your client environment. If you're talking about a typical web site, with a typical set of modern clients, then no, you probably won't see any significant issues.

If, however, you serve a large population of users in developing countries using very old mobile devices, or your clients are embedded devices that don't receive updates, you could indeed have issues.

You probably have a good idea already, but if you do have concerns, the way to get a high fidelity estimate of whether disabling 3DES suites will cause your system issues is to monitor for awhile, capturing the client hellos being sent to your system and parsing them to determine what ciphersuites actual clients of your system claim to be able to negotiate.

  • Also a valid point - we have a fair user base across Africa and Middle East - I'll do some more in depth log analysis to look at what kind of devices are in use. – iainpb Jul 12 '17 at 12:55
1

If you solely have current web browsers as clients then removing 3DES is no problem. But if you have some special, old and maybe also embedded clients with minimal SSL/TLS stacks then there might be a problem. Sometimes these minimal clients are restricted to the simplest ciphers, typically RC4 and/or 3DES.

  • Valid point - some of our clients are customised Toughbooks we have sold to end users, I will investigate these. – iainpb Jul 12 '17 at 12:54
0

I searched on the internet and at least ibm and microsoft are removing 3des, I guess that's the future and there should be no more problem BUT I'm not an expert so I would advise you to hear more opinions before doing it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.