Disabling TLS protocol in protocol level or in cipher list level: What's the difference?

Question

So, I stumbled into this question: Why doesn't the TLS protocol work without the SSLv3 ciphersuites? In that question OP tried to disable SSLv3 by disabled it at both protocol and cipher list (by adding !SSLv3). The result is his TLSv1 doesn't working so he just need to disable it in protocol level.

Well, I'm confused about those two things, protocol and cipher list of OpenSSL.

• This page stated that these two were important parameter of OpenSSL, but why we need separate those two parameter? Why not use cipher list only?
• What's the difference between disable SSLv3 (or other) in protocol level and cipher list level?
• If the user disable SSLv3 and SSLv2 in his cipher list (adding !SSLv3:!SSLv2) but he doesn't disabled it protocol level, what happened then? Can someone make connection with SSLv2?

Answer 1

The confusion comes from the way OpenSSL words its configuration options.

In the protocol, there are two very distinct things:

• The protocol version. This can be SSL 3.0, TLS 1.0, TLS 1.1 or TLS 1.2 (or something else, not yet defined). Internally, the version is encoded as a 16-bit integer of value 0x0300, 0x0301, 0x0302 or 0x0303, respectively (so TLS 1.0 really is "SSL 3.1" on the wire). (I am not talking about SSL 2.0 here.)

• The cipher suites. These are (on the wire) 16-bit identifiers for the combinations of cryptographic algorithms that the client and server are willing to use. The client sends a list, the server chooses the one which will be used. Most cipher suites work for SSL 3.0, TLS 1.0 and TLS 1.1; a few recent cipher suites work only with TLS 1.2 because they use protocol features that are available only with TLS 1.2.

OpenSSL uses, in its configuration string for specifying a list of cipher suite, some mnemonics such as "SSLv3". In that context, "SSLv3" does not mean "protocol version 0x0300"; it means "the list of cipher suites that can work with SSLv3". When you write "!SSLv3" in the configuration for the list of supported cipher suites, you should read it as "remove all cipher suites that could possibly work with SSL 3.0". But this is NOT: "remove all cipher suites that could possibly work with SSL 3.0 when actually using SSL 3.0". The removal is all-or-nothing; you do not get to remove support conditionally on the protocol version (that would be conceptually feasible, but OpenSSL does not work like that).

So if you remove support for all cipher suites that could possibly work with SSL 3.0, you are also removing the cipher suites for ulterior protocol versions. In particular, since SSL 3.0, TLS 1.0 and TLS 1.1 all use the same cipher suites, the only remaining cipher suites in your list are the ones that are specific to TLS 1.2. In effect, you have just killed TLS 1.0 and 1.1 support as well.

If you use "!SSLv3:!SSLv2" then the server can pretend to still support SSL 2.0, but with an empty list of supported cipher suites, so it won't go far; an actual handshake won't happen. It is like giving the key for your car but removing the wheels.

Answer 2

• Because they are different things, the protocol is about how to handle the handshake and such, the cipher list is about which ciphers you are willing to accept for your connections.
• If you disable the protocol, you won't be able to talk with a server that only support this protocol.
• If you disable the ciphers, you'll be able to start the handshake but you won't find any common cipher to agree on.

(Note that on the question you link, according to the first answer, it's more a naming problem of OpenSSL, TLS should work fine if only the effective SSLv3 ciphers are disabled)