Message-ID: <1456934348.9485.29.camel@df1844j>
Subject: [alpine-devel] Latest OpenSSL with SSLv2/weak ciphers enabled
From: Leonardo Arena <rnalrd@gmail.com>
To: alpine-devel <alpine-devel@lists.alpinelinux.org>
Date: Wed, 02 Mar 2016 16:59:08 +0100
Content-Type: multipart/signed; micalg="pgp-sha1"; protocol="application/pgp-signature";
	boundary="=-AGu+6rhvWD2GGVSdHtXe"
Precedence: list
Mime-Version: 1.0


--=-AGu+6rhvWD2GGVSdHtXe
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Alpine community,

since we got few questions on the latest OpenSSL commit [1], we'd like
clarify the reasons for re-enabling SSLv2 and weak ciphers.
Essentially we have reverted to the default behavior of OpenSSL 1.0.2f
and 1.0.1r. Disabling SSLv2 and weak ciphers breaks ABI compatibility.

Please note that even enabling SSLv2 and weak ciphers your application
will not use it unless you configure it to do so [2].

We see this as a temporary solution for not breaking current build.
We're looking forward to remove SSLv2/weak ciphers support from OpenSSL
by rebuilding world against OpenSSL or switching to LibreSSL sooner than
later.

Thanks

- leo


[1]
http://git.alpinelinux.org/cgit/aports/commit/?id=3Dad476430906e49fc46d2fac=
75a1ffbbe8466ec70
[2] http://openssl.org/news/secadv/20160301.txt:
Even if "enable-ssl2" is used, users who want to negotiate SSLv2 via the
version-flexible SSLv23_method() will need to explicitly call either of:

   SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2);
   or
   SSL_clear_options(ssl, SSL_OP_NO_SSLv2);

as appropriate.  Even if either of those is used, or the application
explicitly uses the version-specific SSLv2_method() or its client or
server variants, SSLv2 ciphers vulnerable to exhaustive search key
recovery have been removed. Specifically, the SSLv2 40-bit EXPORT
ciphers, and SSLv2 56-bit DES are no longer available.

--=-AGu+6rhvWD2GGVSdHtXe
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAABAgAGBQJW1w3MAAoJELAPckZGG2T6pmoIAINgjF1PLRep7LHXlM8dgQS1
AuOJ0sTjt2VOav2DuCdGnCpEtItRCgAWpqOTaoP2tWmfwGXCYmlCCC+hE8FDS/Hu
nueTlR2oWHr1fp8oYg5aF83KJacFK7uWzeqdPXk9Vn8ln0bgdgcgQSMbWWQ0JTRt
AkV67sb48lnw8WSpAWGIArocp2pKGx5UD6KZoK2lNQIRDPBusC6j4/g8COB9UEn5
lDudBMHR08PY6Z9uot6vgzCXKBBeaXyV1Nl/fIct7g+73dkH5ZLx8X/MGl5o6EYt
kZwTB+OkQLYYblfZw09EsujLm1yuU1EcV6YQAyFfImkCTQEaRYkn1Q8PFW6K7Pc=
=VZKR
-----END PGP SIGNATURE-----

--=-AGu+6rhvWD2GGVSdHtXe--



---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---