Re: SSL 3.0 and older ciphers selected in applications
On Mon, Dec 08, 2014 at 07:42:54PM +0100, Daniel Pocock wrote:
>
> Is it something that is going to happen with Ubuntu releases next year
> (e.g. April 2015)?
>
> If so, it means that the repro package in jessie won't talk to a repro
> package in Ubuntu.
I think there is some misunderstanding.
People have been using methods like SSLv3_* and TLSv1_* while they
should use SSLv23_*. SSLv3_* only support SSL 3.0, TLSv1_* only
support TLS 1.0, it does not support SSL 3.0 or TLS 1.1. SSLv23_*
on the other hand supports all versions supported by library (but
see below). The intention is to drop all methods that only
support 1 protocol version and instead have only methods that
support all versions (SSLv23).
The library in jessie supports TLS 1.0 to TLS 1.2. However the
the SSLv3 methods still exist in jessie so you can still talk SSL
3.0 in jessie. However the SSLv23 methods do not support SSL 3.0
in jessie anymore. They still supports SSL 3.0 in wheezy. That
means if one side uses SSLv3_* and the the verion in jessie or
later use SSLv23_* they will not talk to each other. And there
are packages that have been fixed to stop using the SSLv3_*
methods in jessie and they will not talk to the version in wheezy.
The versie in wheezy really should also get fixed to use the
SSLv23_* method.
The SSLv3_* method has been removed in experimental and the
TLSv1_* method will also be removed post jessie but I have no
timeframe for that. But everybody really should only use the
SSLv23_* methods.
But the removal of the TLSv1_* methods should not cause any issue
if you replace it by the SSLv23_* methods since there currently
are no plans to drop support for TLS 1.0.
Kurt
Reply to: