{"action":"created","issue":{"url":"https://api.github.com/repos/drwetter/testssl.sh/issues/192","labels_url":"https://api.github.com/repos/drwetter/testssl.sh/issues/192/labels{/name}","comments_url":"https://api.github.com/repos/drwetter/testssl.sh/issues/192/comments","events_url":"https://api.github.com/repos/drwetter/testssl.sh/issues/192/events","html_url":"https://github.com/drwetter/testssl.sh/issues/192","id":107194981,"number":192,"title":"Question: Negotiated Cipher yellow ECDHE-RSA-AES256-SHA384, 521 bit ECDH","user":{"login":"logopk","id":14347357,"avatar_url":"https://avatars.githubusercontent.com/u/14347357?v=3","gravatar_id":"","url":"https://api.github.com/users/logopk","html_url":"https://github.com/logopk","followers_url":"https://api.github.com/users/logopk/followers","following_url":"https://api.github.com/users/logopk/following{/other_user}","gists_url":"https://api.github.com/users/logopk/gists{/gist_id}","starred_url":"https://api.github.com/users/logopk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/logopk/subscriptions","organizations_url":"https://api.github.com/users/logopk/orgs","repos_url":"https://api.github.com/users/logopk/repos","events_url":"https://api.github.com/users/logopk/events{/privacy}","received_events_url":"https://api.github.com/users/logopk/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-09-18T12:40:58Z","updated_at":"2015-09-18T20:25:07Z","closed_at":"2015-09-18T19:29:14Z","body":"Hi there,\r\n\r\nI've got yellow \"ECDHE-RSA-AES256-SHA384\" and green \"521 bit ECDH\". The server has TLS1.2.\r\n\r\nThe code shows \"# it's CBC. --> lucky13\". Is yellow in this case correct?\r\n\r\nBest regards.\r\n\r\nPeter\r\n\r\n                pr_bold \" Negotiated cipher            \"\r\n                default_cipher=$(grep -aw \"Cipher\" $TMPFILE | egrep -avw \"New|is\" | sed -e 's/^.*Cipher.*://' -e 's/ //g')\r\n                case \"$default_cipher\" in\r\n                        *NULL*|*EXP*)   pr_red \"$default_cipher\" ;;\r\n                        *RC4*)          pr_litered \"$default_cipher\" ;;\r\n                        *CBC*)          pr_brown \"$default_cipher\" ;;   # FIXME BEAST: We miss some CBC ciphers here, need to work w/ a list\r\n                        *GCM*)          pr_green \"$default_cipher\" ;;   # best ones\r\n                        *CHACHA20*)     pr_green \"$default_cipher\" ;;   # best ones\r\n                        ECDHE*AES*)    pr_yellow \"$default_cipher\" ;;  # it's CBC. --> lucky13\r\n"},"comment":{"url":"https://api.github.com/repos/drwetter/testssl.sh/issues/comments/141557975","html_url":"https://github.com/drwetter/testssl.sh/issues/192#issuecomment-141557975","issue_url":"https://api.github.com/repos/drwetter/testssl.sh/issues/192","id":141557975,"user":{"login":"logopk","id":14347357,"avatar_url":"https://avatars.githubusercontent.com/u/14347357?v=3","gravatar_id":"","url":"https://api.github.com/users/logopk","html_url":"https://github.com/logopk","followers_url":"https://api.github.com/users/logopk/followers","following_url":"https://api.github.com/users/logopk/following{/other_user}","gists_url":"https://api.github.com/users/logopk/gists{/gist_id}","starred_url":"https://api.github.com/users/logopk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/logopk/subscriptions","organizations_url":"https://api.github.com/users/logopk/orgs","repos_url":"https://api.github.com/users/logopk/repos","events_url":"https://api.github.com/users/logopk/events{/privacy}","received_events_url":"https://api.github.com/users/logopk/received_events","type":"User","site_admin":false},"created_at":"2015-09-18T20:25:07Z","updated_at":"2015-09-18T20:25:07Z","body":"Hello Dirk,\n\nThank you for pointing me to the site of Nadhem and Kenny. It reads that openssl was patched in 2013. So in this case it should be OK to use CBC again?\nWould your test of Lucky 13 provide the necessary statement and if possible remove the yellow marking? Or will it just check for CBC and mark the test failed?\n\nThe article of the two only covers CBC in open source TLS stacks. Do you know the status of IIS or Windows SChannel? Can this be checked?\n\nThank you and have a nice weekend.\n\n\nPeter\n\n> Am 18.09.2015 um 21:30 schrieb Dirk Wetter <notifications@github.com>:\n> \n> see #193 <https://github.com/drwetter/testssl.sh/issues/193>. There might be a separate test for lucky 13 potentially vulnerable ciphers\n> \n> —\n> Reply to this email directly or view it on GitHub <https://github.com/drwetter/testssl.sh/issues/192#issuecomment-141545252>.\n> \n\n"}}