3

I'm currently in the process of compiling a Ciphersuite policy to be used on all of our new WS 12 & IIS 8.5 web servers. In the past I've always manually applied the registry keys into SChannel but I've come across the handy tool, IIS Crypto.

I always intended to disable SSLv3 and have been wanting to do this for quite some time. The announcement of POODLE has enabled me to finally push through and get this protocol disabled.

I've read that the vulnerability is apparent with CBC ciphers when used with SSLv3. With this in mind, in the Cipher Suite Order list within IIS Crypto, is it okay to leave cipher suites enabled that do use CBC as long as SSLv3 is disabled in the Protocols list?

Thanks.

3

Yes, it is ok to have CBC ciphersuites in the list as long as SSLv3.0 is disabled. The issue is not the CBC mode itself, but the SSLv3.0 specification for the padding format. The padding format in TLSv1.0 is more restrictive, so the malleability required to mount the POODLE attack no longer exists.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.