I have been reading a fair bit on OpenSSL vulnerabilities and the various SSL protocols' strengths. As far as I understand it any protocols older than TLS 1.0 are to be avoided at all cost (some would argue that TLS 1.0 should be avoided too since it's only an "upgrade" from SSL 3.0). I also understand that this is due to weaknesses in the protocol and that this would affect any implementation.

To be able to make use of TLS 1.1 and newer protocols, you have to upgrade OpenSSL to at least the 1.0.1 suite. It seems that lately, the security community has done some amazing work in picking holes in the newer implementation of OpenSSL. It looks like every 2-3 months a new vulnerability is discovered and patched.

The way I see there are 3 options:

  • either you stay with a weak protocol but a fairly stable software implementation
  • or you upgrade to a less stable software (OpenSSL) implementation and risk that the protocols are not implemented correctly
  • or you look at different software other than OpenSSL and risk more implementation holes

What do people think of that assessment?

I guess what I'm asking is what is the least bad of the two evils?

1 Answer 1


If I understood correctly, you think that older versions of OpenSSL are more secure than to newer ones. This is simply not true.

Since the Heartbleed vulnerability the project got a lot of attention and that results in a larger number of discoveries / fixes, but those are present in older version as you can see.

All versions of the TLS protocol is vulnerable to the so-called Padding oracle attack, because it uses the MAC-then-Encrypt scheme. Newer TLS versions generally make a lot harder to exploit this vulnerability. The fix to this problem was introduced with TLS 1.2 as new ciphersuites that use authenticated encryption (AES-GCM). Using these cipher suits makes the exploitation of the padding oracle attack practically impossible. This issue is well-understood among experts so TLS 1.3 will remove support for all ciphersuites that doesn't use authenticated encryption. Because of this some experts even say that any TLS solution without AES-GCM support is broken. The important thing is that using TLS 1.2 is not enough, you also have to use an AES-GCM ciphersuite.

All in all, my advice is to use the latest available OpenSSL with modern ciphersuites and update often.

  • Don't forgot the Diffie-Hellman algorithms... They are a must too.
    – Freedo
    Commented Jul 8, 2015 at 13:34
  • 1
    Yes, forward secrecy is extremely important too. However, the question was more about differences in protocol versions - even TLSv1 supports DH.
    – KovBal
    Commented Jul 8, 2015 at 13:53
  • Do TLS 1.0 implement DH with sufficiently enough bits to be secure ? I don't know either
    – Freedo
    Commented Jul 8, 2015 at 15:13
  • DH groups (hence number of bits) are independent from TLS versions as far as I know.
    – KovBal
    Commented Jul 9, 2015 at 7:40
  • Hey @KovBal thanks for the answer, and I completely get your point. From the outside it looks like two evils, but it is good that OpenSSL is being scrutinised and patched.
    – rafrafUk
    Commented Jul 9, 2015 at 17:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .