TLS 1.2: The New Hotness for Load Balancers
October 12, 2011 8 Comments
Aright implementors of services that utilize TLS/SSL, shit just got real. TLS 1.0/SSL 3.0? Old and busted. TLS 1.2? New hotness.
We config together, we die together. Bad admins for life.
There’s an exploit for SSL and TLS, and it’s called BEAST. It takes advantage of a previously known (but though to be too impractical to exploit) weakness in CBC. Only BEAST was able to exploit that weakness in a previously unconsidered way, making it much more than a theoretical problem. (If you’re keeping track, that’s preciously the moment that shit got real).
The cure is an update to the TLS/SSL standard called TLS 1.2, and it’s been around since 2008 (TLS 1.1 also fixes it, and has been available since 2006, but we’re talking about new hotness here).
So no problem, right? Just TLS 1.2 all the things.
Well, virtually no one uses it. It’s a chicken and egg problem. Clients haven’t supported it, so servers haven’t. Servers didn’t support it, so why would clients put the effort in? Plus, there wasn’t any reason to. The CBC weakness had been known, but it was thought to be too impractical to exploit.
But now we’re in a state of shit-is-real, so it’s time to TLS up.
So every browser and server platform running SSL is going to need to be updated to support TLS 1.2. On the client side, Google Chrome, Apple Safari, Firefox, IE (although IE 9 supports TLS 1.1, but previous version will need to be back ported) will need to be updated.
On the server side, it might be a bit simpler than we think. Most of the time when we connect to a website that utilizes SSL (HTTPS), the client isn’t actually talking SSL to the server, instead they’re talking to a load balancer that terminates the SSL connection.
Since most of the world’s websites have a load balancer terminate the SSL, we can update the load balancers with TLS 1.2 and take care of a major portion of the servers on the Internet.
Right now, most of the load balancing vendors don’t support TLS 1.2. If asked, they’ll likely say that there’s been no demand for it since clients don’t support it, which was fine until now. Now is the time for the various vendors to upgrade to 1.2, and if you’re a vendor and you’re not sure if it’s worth the effort, listen to Yoda:
Right now the only vendor I know of that supports TLS 1.2 is the market leader F5 Networks with their version 11 of their LTM, for which they should be commended. However, that’s not good enough, they need to backport version 10 (which has a huge install base). Vendors like Cisco, A10 Networks, Radware, KEMP Technologies, etc., need to also update their software to TLS 1.2. We can no longer use the excuse “because browsers don’t support it”. Because of BEAST, they will soon, and so do they.
In the meantime, if you’re running a load balancer that terminates SSL, you may want to change your cipher settings to prefer RC4-SHA instead of AES (which uses CBC). It’s cryptographically weaker, but is immune to the CBC issue. In the next few days, I’ll be putting together a page on how to prefer RC4 for the various vendors.
Rembmer, TLS 1.0/SSL 3.0: Old and busted. TLS 1.2? New hotness.
The Data Center Overlords 
Got word from the f5 support that they are about to include TLS1.2 compatibility in the upcoming BigIP Version 10.2.3 as well.
That’s great news. I’ve been talking to a few other vendors, looks like others are on board as well.
Pingback: BPDU the next incrementation | Router Jockey
Nevermind that the attack was well known, and if anyone paid attention to openssl dev years ago would know that for several years openssl has not been vulnerable using CBC and SSLv3/TLS 1.0
The CBC weakness had been known for a while, although it was thought to be too impractical to exploit. The work that Duong et al did was to find a new way to exploit it, hence the new urgency.
This is what happens when hipsters try to write tech articles.
I think that may be my favorite comment EVAR.
Be very careful about using RC4 only. The Spangenberg patent says they own the right to combine SSL with RC4. They invented neither one. NewEgg was sued for using RC4 and lost 2.3 million. But don’t worry, NewEgg is appealing these fools.