0

All,

Iam in process of fixing a security vulnerability issue(see below link) in code. http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html

At places we have used the below ssl context to make secure communications

SSLContext.getInstance("TLS")(package: javax.net.ssl).

  1. I know getInstance takes a protocol string value, but question is what does "TLS" means by value, i.e., is it same as TLS1.0? Similarly what does "SSL" means by value, is it same as "SSLv3"?

  2. Is there a way to mention "TLS_FALLBACK_SCSV" while creating the context to fix this vulnerability? One way we are thinking is to disable ssl and use only TLS1.2, but to make it back ward compatible, is there a way to specify fall back option as mentioned in article, this option if any can be passed to api calls while creating ssl context?

Thanks! Santhosh

  • See the documentation. – user207421 Oct 21 '14 at 7:33
  • Doc says "Supports some version of SSL; may support other versions", its little confusing. – Santhosh Oct 21 '14 at 8:56
1

I've been working on the same issue. In short, SSLContext.getInstance("TLS") does not exclude SSLv3 from the list of supported protocols. You must use the setEnabledProtocols() method on SSLServerSocket or SSLSocket (whichever is appropriate to your usecase).

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.