4 ms·

It is actually possible to achieve 100%, but you have to run only TLS 1.2, IIRC. But that would also make your web site inaccessible to most users. But don't b

by ivanr 13y ago

It is actually possible to achieve 100%, but you have to run only TLS 1.2, IIRC. But that would also make your web site inaccessible to most users. But don't blame us, that's just the current situation with SSL/TLS. We're only reporting it. BTW, we used to show scores in the result, but too many people were trying to game the system (rather than be reasonable). As a result, we're showing only the grades now. In the future, the numerical scoring will be probably removed completely (switching to rule-based scoring). As for BEAST, our test tests SSL 3.0 and TLS 1.0 specifically, but not TLS 1.1+. So, the way to go with BEAST is to force RC4 with TLS 1.0 and earlier, some CBC suite with TLS 1.1, and GCM suites with TLS 1.2.

jmillikin 13y ago
> So, the way to go with BEAST is to force RC4 with TLS > 1.0 and earlier, some CBC suite with TLS 1.1, and GCM > suites with TLS 1.2. Since most browsers now include mitigations for BEAST, don't you think that the proven insecurity of RC4 is more dangerous to users than BEAST?
- ivanr 13y ago
  Both (BEAST and RC4) are proven to be real. The only question is which is worse, and if the attacks are practical. In my view, both are equally unlikely to be a threat for an average web site. I'd love to get rid of the BEAST penalty, but there are no good (high-volume) stats on what percentage of "all" users is vulnerable to the BEAST attack. Because Apple is not yet deploying 1/n-1 in their browsers, the vulnerable BEAST percentage is still quite high. On SSL Labs, about 15%. Given that attacks against RC4 are not very practical (yet), one possible direction is to focus on supporting TLS 1.2 (without RC4, obviously), at which point both RC4 and BEAST attacks will become irrelevant.
  - nknighthb 13y ago
    > I'd love to get rid of the BEAST penalty Please don't. The more attention is paid to it, the more ammo I have in pressuring the manufacturers of certain embedded systems I'm stuck dealing with to upgrade their ancient browser codebases.
    - tetrep 13y ago
      What's wrong with IE6?
      - nknighthb 13y ago
        Believe it or not, IE6 would actually be a major @#!%ing improvement in one or two cases. At least we'd already know how to work around much of its braindamage.
taproot 13y ago
> But that would also make your web site inaccessible to most users. I call this a feature and part of the sad state of the web. In other words i think that is a point they would like to illustrate. I dont think a 100% score should be possible if it isnt technically correct. Poor compatibility on the browser end isnt really their problem and certinly shouldn't limit scoring.
hiroprot 13y ago
"So, the way to go with BEAST is to force RC4 with TLS 1.0 and earlier, some CBC suite with TLS 1.1, and GCM suites with TLS 1.2." Is it possible to configure nginx like this? From what I can tell, there is no way to select a cipher based on the protocol.
- ivanr 13y ago
  Yes, it's possible. OpenSSL does not allow for per-protocol tuning, but there are some tricks you can use to achieve the same effect. In particular, GCM suites and SHA256/SHA384 suites work only in TLS 1.2, so if you put those first you are effectively prioritizing them on per protocol-basis. Try this: AESGCM:SHA384:SHA256:RC4:AES !aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!kEDH:!PSK:!SRP:!kECDH This is from an example that's not related to PFS, so some tuning may be needed. The example is from my (free) OpenSSL Cookbook, which you can get from here: https://www.feistyduck.com/books/bulletproof-ssl-tls-and-pki/ https://www.feistyduck.com/books/bulletproof-ssl-tls-and-pki... You are required to register in order to get the book (because the book is not just the PDF). If you don't want to receive any email from me, after you log in, go to the Settings section and unsubscribe from the marketing list.
  - hiroprot 13y ago
    Thanks, this is helpful. Which CBC suites work in TLS 1.1, but not 1.0? These are my test results: https://www.ssllabs.com/ssltest/analyze.html?d=forkly.com https://www.ssllabs.com/ssltest/analyze.html?d=forkly.com
    - ivanr 13y ago
      In general, I don't think the protocol specifications call for some suites to be allowed with certain protocol and some not to. (There are some exceptions, when weak suites need to be deprecated.) In practice, it comes down to how library developers have implemented them. For example, in OpenSSL, you have SSL v2 suites, TLS 1.2 suites, and >= SSL v3 suites. I don't think there are any TLS 1.1-only suites.
      - 13y ago

by ivanr 13y ago

jmillikin 13y ago

> So, the way to go with BEAST is to force RC4 with TLS > 1.0 and earlier, some CBC suite with TLS 1.1, and GCM > suites with TLS 1.2. Since most browsers now include mitigations for BEAST, don't you think that the proven insecurity of RC4 is more dangerous to users than BEAST?

ivanr 13y ago
Both (BEAST and RC4) are proven to be real. The only question is which is worse, and if the attacks are practical. In my view, both are equally unlikely to be a threat for an average web site. I'd love to get rid of the BEAST penalty, but there are no good (high-volume) stats on what percentage of "all" users is vulnerable to the BEAST attack. Because Apple is not yet deploying 1/n-1 in their browsers, the vulnerable BEAST percentage is still quite high. On SSL Labs, about 15%. Given that attacks against RC4 are not very practical (yet), one possible direction is to focus on supporting TLS 1.2 (without RC4, obviously), at which point both RC4 and BEAST attacks will become irrelevant.
- nknighthb 13y ago
  > I'd love to get rid of the BEAST penalty Please don't. The more attention is paid to it, the more ammo I have in pressuring the manufacturers of certain embedded systems I'm stuck dealing with to upgrade their ancient browser codebases.
  - tetrep 13y ago
    What's wrong with IE6?
    - nknighthb 13y ago
      Believe it or not, IE6 would actually be a major @#!%ing improvement in one or two cases. At least we'd already know how to work around much of its braindamage.

taproot 13y ago

> But that would also make your web site inaccessible to most users. I call this a feature and part of the sad state of the web. In other words i think that is a point they would like to illustrate. I dont think a 100% score should be possible if it isnt technically correct. Poor compatibility on the browser end isnt really their problem and certinly shouldn't limit scoring.

hiroprot 13y ago

"So, the way to go with BEAST is to force RC4 with TLS 1.0 and earlier, some CBC suite with TLS 1.1, and GCM suites with TLS 1.2." Is it possible to configure nginx like this? From what I can tell, there is no way to select a cipher based on the protocol.

ivanr 13y ago
Yes, it's possible. OpenSSL does not allow for per-protocol tuning, but there are some tricks you can use to achieve the same effect. In particular, GCM suites and SHA256/SHA384 suites work only in TLS 1.2, so if you put those first you are effectively prioritizing them on per protocol-basis. Try this: AESGCM:SHA384:SHA256:RC4:AES !aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!kEDH:!PSK:!SRP:!kECDH This is from an example that's not related to PFS, so some tuning may be needed. The example is from my (free) OpenSSL Cookbook, which you can get from here: https://www.feistyduck.com/books/bulletproof-ssl-tls-and-pki/ https://www.feistyduck.com/books/bulletproof-ssl-tls-and-pki... You are required to register in order to get the book (because the book is not just the PDF). If you don't want to receive any email from me, after you log in, go to the Settings section and unsubscribe from the marketing list.
- hiroprot 13y ago
  Thanks, this is helpful. Which CBC suites work in TLS 1.1, but not 1.0? These are my test results: https://www.ssllabs.com/ssltest/analyze.html?d=forkly.com https://www.ssllabs.com/ssltest/analyze.html?d=forkly.com
  - ivanr 13y ago
    In general, I don't think the protocol specifications call for some suites to be allowed with certain protocol and some not to. (There are some exceptions, when weak suites need to be deprecated.) In practice, it comes down to how library developers have implemented them. For example, in OpenSSL, you have SSL v2 suites, TLS 1.2 suites, and >= SSL v3 suites. I don't think there are any TLS 1.1-only suites.
    - 13y ago