Subject: Re: [TLS] drop obsolete SSL 2 backwards compatibility from TLS 1.3 draft

From: Peter Gutmann <[email-masked]>
Date: Tue, 30 Dec 2014 08:12:22 +0000

Dave Garrett <[email-masked]> writes:

>The following has been in there for 19 years:
>
>"Warning: The ability to send version 2.0 client hello messages will be
>phased out with all due haste. Implementers should make every effort to move
>forward as quickly as possible."

Another way to look at it is from the truth-in-advertising perspective: change
the text to match actual practice:

  "Warning: SSL 2.0 is an obsolete, insecure protocol from twenty years ago,
  however support for version 2.0 client hello messages will be retained in
  perpetuity in order to deal with an increasingly irrelevant remnant of
  obsolete software that still uses it.  Implementers don't need to make any
  effort to ever move forward."

This is simply the existing text rephrased to match actual practice.

Peter.