SSLv3 POODLE mitigation recommendations

In our previous post, we discussed POODLE and legacy SSLv3 clients.

The best solution to POODLE is to disable SSLv3.
However, SSLv3 often can’t be disabled because legacy clients only speak SSLv3.

F5’s security teams have done some investigation, and we believe that using the RC4 can be used as POODLE mitigation for those legacy clients. RC4 is a stream cipher and is not vulnerable to the POODLE attack.

RC4 does have a known weakness. After hundreds of millions of messages, an attacker could recover the plaintext.

POODLE can recover information after only tens of thousands of attacks.

So even though RC4 is not recommended as a cipher, it remains more secure to use in SSLv3 sessions than AES-CBC.

If you cannot disable SSLv3, you may enable RC4-SHA only for use in SSLv3 sessions until you are able to replace all the legacy clients.

To configure your virtual server to only allow SSLv3 RC4-SHA, use a cipher string like the following:
"default:-RC4:-SSLv3:SSLv3+RC4-SHA"

“Default” sets the default ciphers, “-RC4" removes any ciphers that contain RC4 (this is optional). "-SSLv3” removes any SSLv3 ciphers, but “SSLv3+RC4-SHA” re-enables only the RC4-SHA cipher from SSLv3. Any client connecting via SSL3 will be forced to use RC4 rather than a CBC cipher that is vulnerable to POODLE.

See SOL 13171 for information on setting your cipher string.

There are known attacks against RC4 that are better than brute-force. But given POODLE, RC4 is the most secure SSLv3 cipher.
It is still recommended to disable SSLv3 and RC4 once you are able to remove all legacy clients.