Subject: Re: IETF mail server and SSLv3

From: Russ Housley <[email-masked]>
Date: Wed, 2 Mar 2016 23:34:04 -0500

> If not, isn't there a chance that disabling SSLv3 will cause *SOME* email to fallback to non-encrypted?

http://arstechnica.com/security/2016/03/more-than-13-million-https-websites-imperiled-by-new-decryption-attack/

"DROWN shows that sometimes, bad crypto is even worse than no crypto," Graham Steel, cofounder and CEO of crypto software provider Cryptosense, told Ars. "Hopefully, DROWN will strengthen the general movement to eliminate weak crypto all over the Internet."

---

From: Randy Bush <[email-masked]>
Date: Thu, 03 Mar 2016 15:33:09 +0900

> "DROWN shows that sometimes, bad crypto is even worse than no crypto,"
> Graham Steel, cofounder and CEO of crypto software provider
> Cryptosense, told Ars. "Hopefully, DROWN will strengthen the general
> movement to eliminate weak crypto all over the Internet."

i expect that, at least for the rest of my career, there will always be
stronger and weaker crypto.  and we will repeatedly go through the pain
of purging the [then] weak, with folk screaming about compatibility with
doors 2005.

randy, who just had to hack an ietf meeting smtp server not to do 
       export grade crypto

---

From: Viktor Dukhovni <[email-masked]>
Date: Thu, 3 Mar 2016 02:11:46 -0500

> On Mar 3, 2016, at 1:33 AM, Randy Bush <[email-masked]> wrote:
> 

The way I see it for opportunistic TLS in general, and Postfix specifically,
is that the sensible approach is to prune the deadwood once it is no longer
useful for interoperability except with a theoretical, but in practice negligible
to non-existent minority of peers.  That is, once removing obsolete 
and week crypto has no practical negative consequences, we should just do it.

What makes this possible is widespread adoption of better alternatives, at
which point algorithm agility (often derided in some circles) makes it
possible to move on.

At this point SSLv2, SSLv3, EXPORT ciphers and single DES are disabled in
Postfix by default.  It is sensible for ietf.org to apply similar settings.

-- 
	Viktor.

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 3 Mar 2016 11:03:25 +0000

> and week crypto has no practical negative consequences, we should just do it.

This was something we debated during the processing of
RFC7435. I do think the OS approach is a fine thing, but
I'd be much more for ditching weak crypto than you.

DROWN, LOGJAM and other attacks demonstrate that keeping
weak crypto code around does have negative consequences,
and with DROWN those are pretty impressively negative.

Cheers,
S.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 3 Mar 2016 08:32:59 -0500

> and with DROWN those are pretty impressively negative.

This is also an argument for multi-layer security.

Transport Layer Security isn't a panacea, it has limitations. Back in
1995 we had to choose the one place we applied encryption because
machines were slow. Today we can and should have multi-level security.

We need message layer security in addition to transport. And we need
an infrastructure for deploying client side key material.

---

From: Viktor Dukhovni <[email-masked]>
Date: Thu, 3 Mar 2016 18:47:12 +0000

> I'd be much more for ditching weak crypto than you.

We're not in significant disagreement.

I'm not advocating keeping weak crypto around, in fact the opposite.

Rather I drawing advocating some attention to balancing interoperability
needs in the timing of the removal.  For opportunistic security,
breaking interoperability *in practice* (not just in theory) is to
be avoided in the early phase of deprecation when better alternatives
are not sufficiently widely deployed.  If or once better alternatives
are almost universally deployed, out it goes.

-- 
	Viktor.

---

From: Doug Barton <[email-masked]>
Date: Sat, 5 Mar 2016 20:00:26 -0800

> "DROWN shows that sometimes, bad crypto is even worse than no crypto," Graham Steel, cofounder and CEO of crypto software provider Cryptosense, told Ars. "Hopefully, DROWN will strengthen the gener…

If you believe that keeping SSLv3 around for interoperability reasons is 
a good idea you really need to learn more about the DROWN bug.

Thanks for posting this Russ.

Doug

---

From: "Christian Huitema" <[email-masked]>
Date: Sun, 6 Mar 2016 08:46:16 -0800

On Saturday, March 5, 2016 8:00 PM, Doug Barton wrote: 
> > http://arstechnica.com/security/2016/03/more-than-13-million-https-
> websites-imperiled-by-new-decryption-attack/
> >
> Graham Steel, cofounder and CEO of crypto software provider Cryptosense,
> told Ars. "Hopefully, DROWN will strengthen the general movement to
> eliminate weak crypto all over the Internet."
> 

To sum up: the argument for keeping old crypto like SSLv3 around is that it will provide some security to users of old systems that are not updated. The argument against it is that it keeping the old stuff installed makes everybody else less safe. On balance, "security for most" ought to win. The users of old systems have many options such as updating their server, moving to a different server, or simply working in clear text. It is a case where the security of the many trumps the comfort of a few.

-- Christian Huitema