Comments on: POODLE and the TLS_FALLBACK_SCSV Remedy

By: Jerome

Jerome — Thu, 13 Aug 2015 08:53:23 +0000

Before any data is sent, the client and server negotiate which cipher suite to use (as well as other parameters) before exchanging key material in such a way that they both end up with the same set of symmetric secrets, which a network man-in-the-middle can’t determine. At this point, the two endpoints check to see that the handshake hasn’t been tampered with by essentially hashing the previous Handshake* messages, which has encryption and integrity checking applied. Both the client and the server does this so, using their newly derived secrets, they can verify these Finished messages from each other, and thus they can be confident that the handshake has been negotiated without any funny business. In this way the handshake is protected.

* there is a specific set of Handshake messages (consult the RFC): other non-handshake messages may have been transmitted but won’t be included in the making of the Finished message. The most “famous” exception is the ChangeCipherSpec (CCS) message, which precedes the Finished message. This is why the OpenSSL CCS vulnerability (CVE-2014-0224) could be exploited, as the attacker’s CCS messages are not included in the handshake verification.

By: alex

alex — Sat, 08 Aug 2015 21:51:33 +0000

> Remember, the attacker can’t remove the TLS_FALLBACK_SCSV from the Client Hello because the handshake is cryptographically protected

Could you explain by what means it is protected? There is now signature over Cipher Suites in Client Hello.

By: Jerome

Jerome — Sun, 30 Nov 2014 22:36:10 +0000

Organisations might well have disabled SSLv3 (and v2) but IE8 supports TLSv1.0 by default so there's no obvious reason why that browser wouldn't connect. Test the domain you're trying to connect to at SSL Labs and see which protocols it supports. Also check the "handshake simulation" section and see what it reports for IE8 under XP.

By: Rich

Rich — Tue, 25 Nov 2014 02:33:42 +0000

Hi I am trying to open my cragslist account and I cant access the page. I would like to know If I should play with my ssl2 and3 settings or if I should get windows 8 ? I`m running xp home sp2 ie8 seems like the poodle problem thanks for any feed back richardpelzer@netzero.net

By: Darren Sandford

Darren Sandford — Wed, 22 Oct 2014 13:54:48 +0000

Thanks! This is the clearest description of how TLS_FALLBACK_SCSV works, and more importantly it’s intention! Much appreciated!

By: What is POODLE and how to detect it | serializethoughts

What is POODLE and how to detect it | serializethoughts — Sun, 19 Oct 2014 04:19:02 +0000

[…] then this attack can be carried out. To further read about TLS_FALLBACK_SCSV, you can visit here and RFC […]