Il 17/10/2014 01:11, Salz, Rich ha scritto:
That will not work. You can do this:
#ifdef SSL_MODE_SEND_FALLBACK_SCSV
SSL_CTX_set_mode(ctx, SSL_MODE_SEND_FALLBACK_SCSV)
#endif
But that is not the same thing.
You cannot just slip SCSV into an application without code changes to the
On 10/17/2014 01:24 AM, Salz, Rich wrote:
It does not matter who you talk to. With a POODLE attack, your content
can be decrypted. Cookies, etc., were just used as an example.
If OpenSSL talks to OpenSSL, and both ends have been set up with the
SSLv23_method, and SSL_CTX_set_options has not
On 10/16/2014 10:42 PM, Nou Dadoun wrote:
A few short (simple) questions about the use of TLS_FALLBACK_SCSV since
we’re currently upgrading to the latest openssl releases.
We don’t establish sessions with any other products than our own clients
and servers.
We’ve already disabled the use of
Salz, Rich rs...@akamai.com:
Disabling ssl3 is a good thing. But set the fallback because silently
dropping from tls 1.2 to tls 1.1 is bad.
All this assumes that your client application *does* explicitly fall back
from TLS 1.2 to TLS 1.1, instead of just relying on automatic protocol
version
On 10/17/2014 10:10 AM, Giuseppe D'Angelo wrote:
Yep, and the problem is that I control the application, not which
OpenSSL version is installed. Therefore I wanted to future-proof my
application, so when OpenSSL gets upgraded to a version which supports
SSL_MODE_SEND_FALLBACK_SCSV, everything
On Thu, 16 Oct 2014 16:33:28 +0200, Frank Schmirler wrote
I get the following segfault when trying to send an SSLv3 request to
the reverse proxy pound, running on openssl-1.0.1j with SSLv2/3 disabled:
Program received signal SIGSEGV, Segmentation fault.
0xb77498fa in ssl_ctrl (b=0xb7001010,
Hello,
We use the below attached C-code (I stripped away any error handlings
etc.) to establish a connection to an IPv6 server, send/read some data
and shutdown the connection again. My question is if the *_free() calls
at the end are enough or if we have some memory leak not freeing enough
SSL_set_mode(ssl, SSL_MODE_SEND_FALLBACK_SCSV)
You might care about fallback from TLS 1.2 (which has PFS) to TLS 1.1 (which
doesn't).
I recommend that you always set that flag.
Two clarifications: TLS 1.2 (with AEAD) to TLS 1.1 (doesn't). Or TLS 1.1 (PFS)
to TLS 1.0.
And by always,
Dear Devs,
Here is the blogpost of the HTTPS breakdown:
http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html
From what I understand, the Client hello is the first part of the ssl
handshake that is not encrypted/HMAC’d
According to https://www.openssl.org/~bodo/ssl-poodle.pdf
The new SSL_MODE_SEND_FALLBACK_SCSV option is badly documented in
the wiki and man pages, which is going to cause a lot of problems
when people everywhere rush to incorporate the security fixes into
their code.
In particular, I find the following to be fully undocumented (except
by trying to
Here is the blogpost of the HTTPS breakdown:
http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html
From what I understand, the Client hello is the first part of the ssl
handshake that is not encrypted/HMAC’d
No. Re-read the prepare to be encrypted section again. All
On 17/10/2014 16:37, dol o wrote:
Dear Devs,
Here is the blogpost of the HTTPS breakdown:
http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html
From what I understand, the Client hello is the first part of the ssl
handshake that is not encrypted/HMAC’d
According to
The code/script which generates
http://wiki.openssl.org/index.php/Documentation_Index
from the manpages looks like it contains two bugs:
1. If a manpage lists another function under see also, that other
function is listed as a subitem of that first manpage, causing
lotsof duplicate entries
Thanks for the help guys, I appreciate it. Have a good weekend!
On Fri, Oct 17, 2014 at 10:05 AM, Jakob Bohm jb-open...@wisemo.com wrote:
On 17/10/2014 16:37, dol o wrote:
Dear Devs,
Here is the blogpost of the HTTPS breakdown:
On 17 October 2014 16:13, Jakob Bohm jb-open...@wisemo.com wrote:
The code/script which generates
http://wiki.openssl.org/index.php/Documentation_Index
from the manpages looks like it contains two bugs:
1. If a manpage lists another function under see also, that other
function is listed as
Since this is the users list (as opposed to the dev list) I’m a little confused
about point 2 there; my understanding from the sketchy descriptions I’ve read
is that the fallback to a lower version is automatically done by openssl on
connect failure as opposed to something similar to the code
Thank you, Bodo.
This is a crucial point that was not clear to me when I was investigating the
use of TLS_FALLBACK_SCSV the first time.
If my application uses SSLv23_method() when constructing the SSL context, and
then explicitly disables SSLv2 and SSLv3 using SSL_CTX_set_options(), then
Yes, I think that's a reasonable solution. The new test was added together
with the bugfix as a regression test. Disabling it would bring you back to
the earlier state without any further regression.
Cheers,
Emilia
On Thu, Oct 16, 2014 at 5:37 PM, Russell Selph rse...@tibco.com wrote:
Thanks.
Hi,
I am using below code to get domain name/server name from IP address on Mac
OS X. But SSL_get_peer_certificateis returning empty certificate for
twitter and some of the https sites.
This problem I am facing from Yesterday. After Yosemite release.
Log:
Il 17/10/2014 11:05, Florian Weimer ha scritto:
Do you downgrade the support protocols on handshake failures, like web
browsers do?
Not explicitely. I think it's my fault at understanding the issue -- I
somehow that that could be the case when using
SSL_CTX_new(SSLv23_client_method())
Thanks for the patch.
Is there a way to compile without the patch? I think I would rather
'config no=ssl3' and omit the additional complexity. Its additional
protocol complexity and heartbleed is still fresh in my mind.
Also, are there any test cases that accompany the patch? I'm trying to
21 matches
Mail list logo
