SSL 3.0

~ the obituary ~

The internet I learned on had almost no encryption in it. In a Turkish internet cafe in 2003 you checked your mail over a plain connection, typed your password into a form that sent it as text across every machine between you and the server, and nobody thought about it for a second. The padlock was for the small number of pages that took a credit card, and in Turkey at that point there were not many of those. Encryption was a special case. It took another fifteen years for the default to flip.

SSL 3.0 is the protocol that carried the special case. Netscape published it in November 1996, designed with the cryptographer Paul Kocher, after SSL 2.0 turned out to have serious problems and SSL 1.0 was never released at all. It was good work under commercial deadline pressure, and it was good enough that the IETF took it, renamed it TLS 1.0 in January 1999, and changed remarkably little.

Which means SSL 3.0 did not really live for nineteen years as a protocol people chose. It lived that long as a fallback nobody removed.

~ the case file ~

~ the padding ~

Block ciphers work on fixed size chunks, so a message that does not fill the last chunk gets padded. SSL 3.0 computed its message authentication code over the plaintext and then padded, which left the padding bytes themselves unauthenticated. TLS 1.0 tightened how that padding had to look. SSL 3.0 never did, and by the time anyone cared it was frozen.

On 14 October 2014, Bodo Möller, Thai Duong and Krzysztof Kotowicz at Google published the consequence. POODLE, short for Padding Oracle On Downgraded Legacy Encryption, worked like this: get a browser to make many requests to a site, force the connection down to SSL 3.0 by breaking the handshakes above it, and use the server's reaction to modified padding as a one bit answer. About 256 requests per byte, and you have the session cookie. The victim's browser does the work for you.

~ the long death ~

The downgrade is the part worth sitting with. Nobody in 2014 wanted SSL 3.0. Browsers and servers both preferred TLS, and would have negotiated it happily. They kept SSL 3.0 in the list purely so that nothing old would break, and the fallback logic that made that work was exactly what let an attacker choose the broken protocol on the user's behalf. Compatibility was the vulnerability.

Firefox 34 turned it off in December 2014. Chrome disabled it by default in version 40 in January 2015, then removed it. RFC 7568 arrived in June 2015 with a title that reads like a death certificate, "Deprecating Secure Sockets Layer Version 3.0", and the sentence that mattered: SSLv3 must not be used. The long tail was the payments industry, where PCI DSS gave everybody until 30 June 2018 to stop, which tells you how many terminals and bank back ends were still speaking it.

~ what carried over ~

The protocol died and the name did not. People still say SSL when they mean TLS, still buy SSL certificates that are TLS certificates, and still call the padlock the SSL padlock. It has been the wrong word for over twenty years and it is not going anywhere.

The other inheritance is the practice. POODLE is the reason security work stopped treating the removal of old versions as optional politeness toward old clients. Every deprecation since has followed the same script: publish the attack, watch the browsers turn it off within weeks, let the standards body write it down afterward. The RFC did not kill SSL 3.0. Two browser releases did, and the RFC came along in June to put a date on the stone.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »