[Exim] Strange TLS AUTH problem with DES-CBC3-SHA

Hi,

we just setup Exim 4 with RADIUS Authentication. We allow this via TLS or
SSL. Most things work like a charm. I have

accept encrypted =
EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DES-CBC3-MD5:DHE-DSS-
RC4-SHA:RC4-SHA:RC4-MD5:RC2-CBC-MD5:RC4-MD5

in the corresponding acl to narrow connections down to strong ciphers. Now I
started testing and still everything worked until I told my Opera to use
3DES only. Suddenly I got RADIUS timeouts. A debug run showed the following:

92322 SSL_accept was successful
92322 Cipher: TLSv1:DES-CBC3-SHA:168
92322 Shared ciphers: DES-CBC3-SHA

92322 Calling SSL_read(81ac400, 81b2000, 4096)
92322 SMTP<< AUTH LOGIN
92322 using ACL "acl_check_auth"
92322 processing "accept"

92322 check encrypted =
EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DES-CBC3-MD5:DHE-DSS-
RC4-SHA:RC4-SHA:RC4-MD5:RC2-CBC-MD5:RC4-MD5
92322 DES-CBC3-SHA in
"EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DES-CBC3-MD5:DHE-DSS
-RC4-SHA:RC4-SHA:RC4-MD5:RC2-CBC-MD5:RC4-MD5"? yes (matched "DES-CBC3-SHA")
92322 accept: condition test succeeded

92322 SMTP>> 334 XXXXXXXXXXXX
92322 tls_do_write(818e000, 18)
92322 SSL_write(SSL, 818e000, 18)
92322 outbytes=18 error=0
92322 Calling SSL_read(81ac400, 81b2000, 4096)
92322 Got SSL error 5
92322 SMTP>> 334 XXXXXXXXXXXX
92322 tls_do_write(818e000, 18)
92322 SSL_write(SSL, 818e000, 18)
92322 outbytes=18 error=0
92322 Calling SSL_read(81ac400, 81b2000, 4096)
92322 Got SSL error 5
92322 Running RADIUS authentication for user "" and ""

Paranoid as I am I changed the 334 output/input to XXX so don't worry. :-)
But the interesting part is, that exim is obviously not able to decipher
username and password. Once I run this over SSL instead of TLS everything is
ok. Now for the funny part: I do not have this problem with Mozilla or
Mulberry. Mozilla and Mulberry use AUTH PLAIN by the way and not AUTH LOGIN
so this might have something to do with it. (Why the heck is Opera using
AUTH LOGIN in the first place... I though this was a decent piece of
software...)

Using other ciphers (RC4-MD5) works like a charm. What am I missing? Is this
a bug in Opera or in exim or in openssl? Here is the config of my
authenticators:

begin authenticators

plain:
driver = plaintext
public_name = PLAIN
server_condition = ${if radius{$2:$3}{yes}{no}}
server_set_id = $2

login:
driver = plaintext
public_name = LOGIN
server_prompts = Username:: : Password::
server_condition = ${if radius{$1:$2}{1}{0}}
server_set_id = $1


Any ideas?

Regards,
Jan-Peter