Re: PTF MF64534 for ROBOT TLS Vulnerability...

1: What in "THIS PTF CAN BE APPLIED IMMEDIATE OR DELAYED." makes you
think you need to IPL? Did you pick an option to set them all as delayed
or did it bring down a coreq or prereq which requires an IPL?
2: The cover letter makes one think that they patched the cipher to not
be susceptible to such an attack and that the "circumvention" (or
workaround) is to remove certain ciphers from the system value; not both.
Therefore I do not think that applying this PTF will automatically remove
those ciphers.
3: Not sure if the presence of these ciphers, patched or not, will still
be considered a ding on your audits. Most security scans simply test for
the presences of the cipher, not if the cipher is susceptible to the
attack. Since some of these ciphers are only open to attack under large
scale bombardment such a test in itself could be construed as a DOS
attack.

sndptford mf64534
INSPTF LICPGM((5770999)) DEV(*SERVICE) INSTYP(*IMMDLY)
PTF 5770999-MF64534 V7R3M0 temporarily applied to library QGPL.
DSPSYSVAL SYSVAL(QSSLCSL) OUTPUT(*PRINT)

Current Shipped
value value
*ECDHE_ECDSA_AES_128_GCM_SHA25 *ECDHE_ECDSA_AES_128_GCM_SHA25
6 6
*ECDHE_ECDSA_AES_256_GCM_SHA38 *ECDHE_ECDSA_AES_256_GCM_SHA38
4 4
*ECDHE_RSA_AES_128_GCM_SHA256 *ECDHE_RSA_AES_128_GCM_SHA256
*ECDHE_RSA_AES_256_GCM_SHA384 *ECDHE_RSA_AES_256_GCM_SHA384
*RSA_AES_128_GCM_SHA256 *RSA_AES_128_GCM_SHA256
*RSA_AES_256_GCM_SHA384 *RSA_AES_256_GCM_SHA384
*ECDHE_ECDSA_AES_128_CBC_SHA25 *ECDHE_ECDSA_AES_128_CBC_SHA25
6 6
*ECDHE_ECDSA_AES_256_CBC_SHA38 *ECDHE_ECDSA_AES_256_CBC_SHA38
4 4
*ECDHE_RSA_AES_128_CBC_SHA256 *ECDHE_RSA_AES_128_CBC_SHA256
*ECDHE_RSA_AES_256_CBC_SHA384 *ECDHE_RSA_AES_256_CBC_SHA384
*RSA_AES_128_CBC_SHA256 *RSA_AES_128_CBC_SHA256
*RSA_AES_128_CBC_SHA *RSA_AES_128_CBC_SHA
*RSA_AES_256_CBC_SHA256 *RSA_AES_256_CBC_SHA256
*RSA_AES_256_CBC_SHA *RSA_AES_256_CBC_SHA
*ECDHE_ECDSA_3DES_EDE_CBC_SHA *ECDHE_ECDSA_3DES_EDE_CBC_SHA
*ECDHE_RSA_3DES_EDE_CBC_SHA *ECDHE_RSA_3DES_EDE_CBC_SHA
*RSA_3DES_EDE_CBC_SHA *RSA_3DES_EDE_CBC_SHA


Rob Berendt