Subject: Re: [TLS] Confirming consensus: TLS1.3->TLS*

From: Tony Arcieri <[email-masked]>
Date: Thu, 1 Dec 2016 18:16:21 -0800

On Wed, Nov 30, 2016 at 8:43 PM, Viktor Dukhovni <[email-masked]>
wrote:

> > I actually completely agree with Timothy Jackson's recent posting:
> >
> >   After 15 years, everyone but us still calls it SSL. We need to
> >   admit that we lost the marketing battle and plan for a world where
> >   everyone calls “TLS X” “SSL X”. Even “new” implementations call
> >   themselves “LibreSSL” and “BoringSSL” rather than “LibreTLS” or
> >   “BoringTLS”.
>
> I'll drink to that!

I will also +1 this and add that if the goal is to reduce confusion, a last
minute renaming of TLS 1.3 to something else probably won't accomplish
that, but will rather create more confusion. There's already ample material
out there (papers, presentations, mailing list discussions, etc) which
talks about "TLS 1.3". Rebranding it now would add an additional bit of
errata everyone needs to learn if they ever encountered the "TLS 1.3"
version in any of these materials. And I think the whole SSL/TLS thing is
errata enough.

-- 
Tony Arcieri

---

From: Watson Ladd <[email-masked]>
Date: Thu, 1 Dec 2016 18:47:48 -0800

On Thu, Dec 1, 2016 at 6:16 PM, Tony Arcieri <[email-masked]> wrote:
> minute renaming of TLS 1.3 to something else probably won't accomplish that,
> but will rather create more confusion. There's already ample material out
> there (papers, presentations, mailing list discussions, etc) which talks
> about "TLS 1.3". Rebranding it now would add an additional bit of errata
> everyone needs to learn if they ever encountered the "TLS 1.3" version in
> any of these materials. And I think the whole SSL/TLS thing is errata
> enough.

So what should X be in above email? Clearly it should be \geq 4.

>
> --
> Tony Arcieri
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.

---

From: Peter Gutmann <[email-masked]>
Date: Fri, 2 Dec 2016 03:12:41 +0000

Tony Arcieri <[email-masked]> writes:

>There's already ample material out there (papers, presentations, mailing list
>discussions, etc) which talks about "TLS 1.3".

In other words, the TLS WG and a small number of people who interact with it
call it TLS 1.3.  That's hardly a strong argument when most of the rest of the
world doesn't even call it TLS.

In fact that's something that's come up repeatedly in the bikeshedding so far,
there are some really good, sound arguments for calling it TLS/SSL 4 or
TLS/SSL 2017, while pretty much the only reasons I've seen for TLS 1.3 are
inertia, "we've always called it that"/"I don't want to change"/etc.

Peter.

---

From: David Benjamin <[email-masked]>
Date: Fri, 02 Dec 2016 03:35:00 +0000

> inertia, "we've always called it that"/"I don't want to change"/etc.

I think TLS 4 makes everything worse, not better.

In hindsight, renaming SSL 3.1 was a terrible mistake. But TLS 1.2 is going
to exist for a long time. If we call the next one 4, we have to explain a
gap in the versioning (1.0, 1.1, 1.2, 4?) and placing 2.0 and 3.0 after 1.2
becomes even more inviting.

Short of a time machine so we can call this SSL 3.4, the best fix is to let
SSL 3.0 fall away. This is already semi-plausible (it's out of all
browsers) and is only going to become more realistic over time. Certainly
it will be faster than TLS 1.2 going away and undoing TLS 4's version gap
problem. (TLS 1.3 even places SSL 3.0 as a MUST NOT, for what little teeth
that has.)

Once SSL 3.0 falls away, we'll be left with 1.0, 1.1, 1.2, and 1.3, which
is a plausible numbering progression. There'll still be the mess with SSL
being the informal name for the protocol family, but that isn't a numbering
problem.

David

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 2 Dec 2016 04:43:03 +0000

> In other words, the TLS WG and a small number of people who interact with
> it call it TLS 1.3.  That's hardly a strong argument when most of the rest of the

Strongly agreed

> pretty much the only reasons I've seen for TLS 1.3 are

Yes.

Think outside the community.  The world calls it SSL.  Many of the vendors in this industry also call it SSL.

SSL 4 or greater.

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 2 Dec 2016 04:48:05 +0000

> If we call the next one 4, we have to explain a gap in the versioning (1.0, 1.1, 1.2, 4?) and placing 2.0 and 3.0 after 1.2 becomes even more inviting.

No we don't have to explain it.  Most of the world isn't OCD types like those of us in this field.

> Once SSL 3.0 falls away, we'll be left with 1.0, 1.1, 1.2, and 1.3, which is a plausible numbering progression. There'll still be the mess with SSL being the informal name for the protocol family, but that isn't a numbering problem.

Once SSL 3.0 falls away, the industry will still be calling the protocol SSL.  Except now the common name and the real name have no relationship.

And also, the world will not care about a gap in numbering.  Nobody cared that there was no Windows 9.

---

From: Bill Frantz <[email-masked]>
Date: Thu, 1 Dec 2016 20:56:13 -0800

>And also, the world will not care about a gap in numbering.  Nobody cared that there was no Windows 9.

If we go with 2017, we can tell the world that by using the year 
the standard was approved, instead of a confusing set of names 
and numbers, we are eliminating any confusion about which 
version is the most recent.

Cheers - Bill

-----------------------------------------------------------------------
Bill Frantz        | gets() remains as a monument | Periwinkle
(408)356-8506      | to C's continuing support of | 16345 
Englewood Ave
www.pwpconsult.com | buffer overruns.             | Los Gatos, 
CA 95032

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 2 Dec 2016 08:27:00 +0000

On 02/12/16 03:35, David Benjamin wrote:
> In hindsight, renaming SSL 3.1 was a terrible mistake.

IIRC that was sort-of a condition for adoption of the work
in the IETF 20 years ago, when there were two different
protocols already being deployed and the proponents of one
of them said "we'll use that other one (SSL) but you gotta
change the name of the standard or we can't get our <bosses>
to agree to change to all use the same thing."

So changing to TLS was maybe a mistake or maybe not as it
allowed us to end up with one protocol with two names and
not two (or more) protocols.

Cheers,
S.

---

From: Peter Gutmann <[email-masked]>
Date: Fri, 2 Dec 2016 08:33:21 +0000

Stephen Farrell <[email-masked]> writes:

>IIRC that was sort-of a condition for adoption of the work in the IETF 20
>years ago, when there were two different protocols already being deployed and
>the proponents of one of them said "we'll use that other one (SSL) but you
>gotta change the name of the standard or we can't get our <bosses> to agree
>to change to all use the same thing."

It was Netscape with SSL vs. Microsoft with PCT.

If no-one from Microsoft has any objections, can we just rename it back to
what it's always been for everyone but us, SSL?

Peter.

---

From: Yoav Nir <[email-masked]>
Date: Fri, 2 Dec 2016 11:22:43 +0200

> On 2 Dec 2016, at 10:33, Peter Gutmann <[email-masked]> wrote:
> 

Is that even possible? The way I’ve heard it “SSL” is a registered trademark owned by Netscape (now AOL), so we can’t use it unless AOL lawyers sign off on that. It might be wrong, but if it’s true - good luck with that.

Yoav

---

From: Peter Gutmann <[email-masked]>
Date: Fri, 2 Dec 2016 09:36:04 +0000

Yoav Nir <[email-masked]> writes:

>The way I’ve heard it “SSL” is a registered trademark owned by Netscape (now
>AOL), so we can’t use it unless AOL lawyers sign off on that. It might be
>wrong, but if it’s true - good luck with that.

http://tmsearch.uspto.gov/bin/showfield?f=toc&state=4810%3Ajoxwrl.1.1&p_search=searchss&p_L=50&BackReference=&p_plural=yes&p_s_PARA1=&p_tagrepl%7E%3A=PARA1%24LD&expr=PARA1+AND+PARA2&p_s_PARA2=ssl&p_tagrepl%7E%3A=PARA2%24COMB&p_op_ALL=AND&a_default=search&a_search=Submit+Query&a_search=Submit+Query 

http://tmsearch.uspto.gov/bin/showfield?f=toc&state=4805%3A16epd1.1.1&p_search=searchstr&BackReference=&p_L=100&p_plural=yes&p_s_PARA1=SSL&p_tagrepl%7E%3A=PARA1%24ALL&expr=PARA1+and+PARA2&p_s_PARA2=security&p_tagrepl%7E%3A=PARA2%24ALL&a_default=search&f=toc&state=4805%3A16epd1.1.1&a_search=Submit+Query

http://tmsearch.uspto.gov/bin/showfield?f=toc&state=4805%3A16epd1.4.1&p_search=searchstr&BackReference=&p_L=100&p_plural=yes&p_s_PARA1=%22secure+sockets+layer%22&p_tagrepl%7E%3A=PARA1%24ALL&expr=PARA1+or+PARA2&p_s_PARA2=&p_tagrepl%7E%3A=PARA2%24ALL&a_default=search&f=toc&state=4805%3A16epd1.4.1&a_search=Submit+Query
    
Doesn't look like it.  And even if it was, Netscape's failure to defend it
against infringement by half the planet would probably make its enforceability
dubious.

Peter.

---

From: Matt Caswell <[email-masked]>
Date: Fri, 2 Dec 2016 09:38:40 +0000

> Is that even possible? The way I’ve heard it “SSL” is a registered trademark owned by Netscape (now AOL), so we can’t use it unless AOL lawyers sign off on that. It might be wrong, but if it’s true…

It does not appear on this list of AOL trademarks:

http://legal.aol.com/trademarks/

Searching here does not turn up any relevant *registered* trademarks:

http://tmsearch.uspto.gov/bin/showfield?f=toc&state=4803%3Aaagjih.1.1&p_search=searchss&p_L=50&BackReference=&p_plural=yes&p_s_PARA1=&p_tagrepl~%3A=PARA1%24LD&expr=PARA1+AND+PARA2&p_s_PARA2=SSL&p_tagrepl~%3A=PARA2%24COMB&p_op_ALL=AND&a_default=search&a_search=Submit+Query&a_search=Submit+Query

It does not appear to be a current trademark if it ever was one. IANAL
but IIUC a trademark is only valid for as long as it is in use and
defended.

Matt

---

From: Hubert Kario <[email-masked]>
Date: Fri, 02 Dec 2016 12:11:30 +0100

On Friday, 2 December 2016 03:12:41 CET Peter Gutmann wrote:
> >There's already ample material out there (papers, presentations, mailing
> >list discussions, etc) which talks about "TLS 1.3".
> 
> call it TLS 1.3.  That's hardly a strong argument when most of the rest of
> the world doesn't even call it TLS.
> 
> In fact that's something that's come up repeatedly in the bikeshedding so
> far, there are some really good, sound arguments for calling it TLS/SSL 4
> or TLS/SSL 2017, while pretty much the only reasons I've seen for TLS 1.3
> are inertia, "we've always called it that"/"I don't want to change"/etc.

People already know that SSL3 is worse than "SSL" 1.0 though 1.2 , it's 
logical that SSL 1.3 continues that trend. creating "SSL" 4 will bring more 
confusion.

In 10 years time, when the only way for you to get anything that can talk SSL 
3 is to run EOL software and hardware, then we can create "SSL" 4. But not 
when one fifth of the Internet still supports SSL 3.

-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 2 Dec 2016 13:47:20 +0000

> People already know that SSL3 is worse than "SSL" 1.0 though 1.2 , it's logical
> that SSL 1.3 continues that trend. creating "SSL" 4 will bring more confusion.

Please explain that assertion.

--  
Senior Architect, Akamai Technologies
Member, OpenSSL Dev Team
IM: [email-masked] Twitter: RichSalz

---

From: Ted Lemon <[email-masked]>
Date: Fri, 2 Dec 2016 08:59:25 -0500

Rich, I don't think there is any explanation that can be given for the
assertion without collecting a lot of data.   That said, the objection
makes sense to me.   I certainly think of SSL as poison.   Of course,
the average Joe on the street doesn't even know what TLS stands for,
but the people who are deciding what software to run do.   In that
audience, adding confusion with a new name change is probably bad.
So what Hubert said seems self-evident to me, not requiring any
explanation.

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 2 Dec 2016 14:04:36 +0000

Nobody knows the difference tween 1.0 1.1 1.2

SSL 4 or SSL 4.0 is a bigger number than 1.x and uses the same term that everyone, including our industry, uses.  If someone sees "TLS 1.2" and thinks "wow, that's so much worse than SSL 4 because the number is so much smaller," then isn't that a good thing, increasing pressure to move forward?

I would much rather spend time explaining "no, really TLS 1.2 is not that bad" than have to spend more decades explaining "no, really, that thing the world things of as SSL is really TLS and 1.3 is really better than what you think you should have."

---

From: Hubert Kario <[email-masked]>
Date: Fri, 02 Dec 2016 15:06:40 +0100

On Friday, 2 December 2016 13:47:20 CET Salz, Rich wrote:
> > logical that SSL 1.3 continues that trend. creating "SSL" 4 will bring
> > more confusion.
> 

SSL 2 < SSL 3 < "SSL" 1.0 < "SSL" 1.1 < "SSL" 1.2 < "SSL" 4
is not logical ordering

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 2 Dec 2016 14:12:38 +0000

> SSL 2 < SSL 3 < "SSL" 1.0 < "SSL" 1.1 < "SSL" 1.2 < "SSL" 4 is not logical ordering

So?  Who cares?  A couple-hundred people in the IETF.  And the issue is that SSL 3 < "SSL" 1.0 which is the issue no matter what we call what we're doing here.  And the quotes around the last SSL do not belong there.

You can say that calling it "TLS 1.3" promulgates the illogical ordering, or you could say it continues a renumbering.  A renumbering that the world has never recognized or understood.  You can say that "SSL 4" confuses people twice, or you can say that it restores sanity to a 20-year glitch and starts us using the same name that the rest of the world, *and our industry,* uses.

---

From: Peter Gutmann <[email-masked]>
Date: Sat, 03 Dec 2016 03:12:52 +1300

>Please explain that assertion.

I was going to ask that too, the quoted text seems...,  well, gibberish to me.

Peter.

---

From: Hubert Kario <[email-masked]>
Date: Fri, 02 Dec 2016 15:14:52 +0100

On Friday, 2 December 2016 14:04:36 CET Salz, Rich wrote:
> SSL 4 or SSL 4.0 is a bigger number than 1.x and uses the same term that
> everyone, including our industry, uses.  If someone sees "TLS 1.2" and
> thinks "wow, that's so much worse than SSL 4 because the number is so much
> smaller," then isn't that a good thing, increasing pressure to move
> forward?

Or he thinks "stupid 'experts' pushing stuff down our throats by inflating 
numbers".

Certainly not all of them will think the same thing.
 
> I would much rather spend time explaining "no, really TLS 1.2 is not that
> bad" than have to spend more decades explaining "no, really, that thing the
> world things of as SSL is really TLS and 1.3 is really better than what you
> think you should have."

Except in 10 years we may be explaining that "no, TLS 1.3/2.0/4/2017 alone is 
completely insecure, you need to deploy post-quantum crypto on TLS 
1.2/2.0/4/2017"
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic

---

From: "Ackermann, Michael" <[email-masked]>
Date: Fri, 2 Dec 2016 14:17:24 +0000

+1  On Ted's comments. 

In Enterprise circles TLS is an unknown acronym and as painful as it is,  we must usually refer to it as SSL,  before anyone knows what we are talking about.  
Software products are guilty too.   Parameter fields frequently reference SSL.   :(

-----Original Message-----
From: TLS [mailto:[email-masked]] On Behalf Of Ted Lemon
Sent: Friday, December 2, 2016 8:59 AM
To: Salz, Rich <[email-masked]>
Cc: [email-masked]
Subject: Re: [TLS] Confirming consensus: TLS1.3->TLS*

So what Hubert said seems self-evident to me, not requiring any explanation.

On Fri, Dec 2, 2016 at 8:47 AM, Salz, Rich <[email-masked]> wrote:
>> People already know that SSL3 is worse than "SSL" 1.0 though 1.2 , 
>> it's logical that SSL 1.3 continues that trend. creating "SSL" 4 will bring more confusion.
>

The information contained in this communication is highly confidential and is intended solely for the use of the individual(s) to whom this communication is directed. If you are not the intended recipient, you are hereby notified that any viewing, copying, disclosure or distribution of this information is prohibited. Please notify the sender, by electronic mail or telephone, of any unintended receipt and delete the original message without making any copies.
 
 Blue Cross Blue Shield of Michigan and Blue Care Network of Michigan are nonprofit corporations and independent licensees of the Blue Cross and Blue Shield Association.

---

From: Hubert Kario <[email-masked]>
Date: Fri, 02 Dec 2016 15:42:31 +0100

On Friday, 2 December 2016 14:12:38 CET Salz, Rich wrote:
> So?  Who cares?  A couple-hundred people in the IETF.  And the issue is that
> SSL 3 < "SSL" 1.0 which is the issue no matter what we call what we're
> doing here.  And the quotes around the last SSL do not belong there.

> You can say that calling it "TLS 1.3" promulgates the illogical ordering, or
> you could say it continues a renumbering.  A renumbering that the world has
> never recognized or understood.  You can say that "SSL 4" confuses people
> twice, or you can say that it restores sanity to a 20-year glitch and
> starts us using the same name that the rest of the world, *and our
> industry,* uses.

what it does is it introduces a second glitch

speaking of confusion, do you know that e-mail clients by "SSL" mean "SSL/TLS" 
and by "TLS" mean "STARTTLS"?
(note the port numbers)
https://sils.unc.edu/it-services/email-faq/outlook
https://mail.aegee.org/smtp/kmail.html
https://sils.unc.edu/it-services/my-computer/email-faq/thunderbird

---

From: Thomas Pornin <[email-masked]>
Date: Fri, 2 Dec 2016 15:53:57 +0100

On Fri, Dec 02, 2016 at 02:17:24PM +0000, Ackermann, Michael wrote:
> In Enterprise circles TLS is an unknown acronym and as painful as it
> is,  we must usually refer to it as SSL,  before anyone knows what we
> are talking about.  Software products are guilty too.   Parameter
> fields frequently reference SSL.   :(

Actually there is a large variety in what I encounter (I work in a big
financial institution, and I have gone through other big organisations).

Some will just know "SSL" and talk about SSL for all protocols in the
"SSL" family (which so far includes SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1
and TLS 1.2).

Some will use "SSL" for SSL 2.0 and SSL 3.0, and "TLS" for the TLS 1.x
versions. They then ban "SSL" and want to enforce "TLS". When they
encounter regulations that say "don't use TLS 1.0, only TLS 1.1+", they
get confused.

Some people and software interfaces use "SSL vs TLS" in a completely
different way, in the context of protocols like IMAP or FTPS: they use
"SSL" to mean "SSL handshake first, then protocol inside it", and "TLS"
to mean "protocol first and a STARTTLS command". This distinction is
orthogonal to protocol versions.

Commercial CA tend to sell "SSL certificates", not "TLS certificates"
or "SSL/TLS certificates". In a similar vein, the 'S' in 'HTTPS' does
_not_ mean "SSL", but not many people know that.

When I encounter someone who knows the differences between all versions,
then I am in front of a mirror. The taxonomy is confused and
complicated, and people who are maniacal enough to learn and remember it
are very rare.

If we look at what Microsoft did when it encountered the same kind of
terminology mess, it decided that the number following 2000 was "XP".
Lately, for server versions, Microsoft uses a year-based numbering,
and even so, they depart from it at times, e.g. when they decided that
"2009" was really "2008R2".

In practice, people don't have problem with gaps in numbering; they
are even eager to _create_ gaps when convenient, for instance by
not acknowledging the existence of Windows Vista.

So my conclusion is that terminology is essentially fluid and chosen by
people in the field, without any form of concertation and with a trend
toward simplification: the _operational_ notion is to lump versions into
two groups, the ones that must be used and the ones that must not be
used. There is about nothing IETF can do about it (though a really
poorly chosen name might increase confusion even further). The only
naming scheme which is kinda coherent is the numbering scheme on the
wire (3.0, 3.1...), and even that one fails to capture SSL 2.0 (which is
in fact 0.2 on the wire).

	--Thomas Pornin

---

From: Ted Lemon <[email-masked]>
Date: Fri, 2 Dec 2016 09:54:25 -0500

The bottom line is that this is an unanswerable question.   My advice
is to not change the name, because I think more name changes = more
confusion and it is _way_ too late to put TLS back in the box.   But
what do I know--I'm just an end user!   :)

---

From: Maarten Bodewes <[email-masked]>
Date: Fri, 2 Dec 2016 17:02:32 +0100

Hi all,

The point is we are now indeed on draft 18. Changing the name now is very
problematic because everybody on the mailinglist already calls it TLS 1.3,
for a long time and no matter what you do, a lot of us (who are hopefully
the experts) will keep referring to it under that name.

If you want a name change, introduce it early (as editor of the RFC, these
guys should be able to make this kind of decision) or otherwise keep the
name.

The same kind of discussion was on the SHA-3 mailing list, where some
argued for AHS instead of SHA-3. The same problem ensued there and SHA-3
was kept in the end (although I don't know how the decision was made at
that time).

Further discussions continue at [email-masked] ;)

Regards,
Maarten

2016-12-02 15:54 GMT+01:00 Ted Lemon <[email-masked]>:

> >> > SSL 2 < SSL 3 < "SSL" 1.0 < "SSL" 1.1 < "SSL" 1.2 < "SSL" 4 is not
> logical
> >> > ordering
> >>

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Fri, 02 Dec 2016 09:35:40 -0500

> what it's always been for everyone but us, SSL?

fwiw, the industry (and stackexchange) uses "SSL" to mean all sorts of
things, not only TLS.  Yesterday i got an e-mail from a reputable CA
reseller that said "Your SSL is expiring in two days!  Buy a new SSL
now!"

Surely no one is proposing that we also re-name the X.509 certificate
format to "SSL" just because vendors whose business models revolve
around these products are confused about terminology.  What else should
we rename to "SSL" on that basis?  Maybe a load-balancer is also "SSL"!

Here's a useful and effective meme for convincing bosses that it's ok to
turn off SSLv3: all known versions of SSL are broken and should never be
used.  Please do not break this meme by trying to rename TLS to SSL.

I don't care about the bikeshed over the number: i'd be fine with any of
TLS 1.3 or TLS 4 or TLS 2017.  But can we please not create *even more*
confusion by bikeshedding over the name itself?

       --dkg

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 2 Dec 2016 16:12:05 +0000

> Here's a useful and effective meme for convincing bosses that it's ok to turn
> off SSLv3: all known versions of SSL are broken and should never be used.
> Please do not break this meme by trying to rename TLS to SSL.

Is "all known versions before SSL 4" that much worse?

---

From: Rob Stradling <[email-masked]>
Date: Fri, 2 Dec 2016 15:01:08 +0000

On 02/12/16 14:53, Thomas Pornin wrote:
<snip>
> or "SSL/TLS certificates".

It's worse than that.  Many customers, and even some salespeople, seem 
to think that we sell "SSLs".

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online

---

From: Hubert Kario <[email-masked]>
Date: Fri, 02 Dec 2016 18:00:32 +0100

> Is "all known versions before SSL 4" that much worse?

given:
1. we have people that need support for SSLv3 and SSLv2 style Client Hello 
messages (The Web is not the only place where SSL/TLS is deployed), let alone 
TLS 1.0
2. TLS 1.2 is not broken (so the statement is demonstrably false)

yes, it is much worse

---

From: Andrei Popov <[email-masked]>
Date: Fri, 2 Dec 2016 17:45:28 +0000

Not that I can speak for the whole of Microsoft, but I would not drop TLS support in Windows if it were renamed "SSL":).

However, "transport layer security" makes a lot more sense to me than "secure sockets layer" because the latter seems to imply network socket-style API, which is not a requirement of this protocol.

Cheers,

Andrei

-----Original Message-----
From: TLS [mailto:[email-masked]] On Behalf Of Peter Gutmann
Sent: Friday, December 2, 2016 12:33 AM
To: Stephen Farrell <[email-masked]>; David Benjamin <[email-masked]>; Tony Arcieri <[email-masked]>; <[email-masked]> <[email-masked]>
Subject: Re: [TLS] Confirming consensus: TLS1.3->TLS*

Stephen Farrell <[email-masked]> writes:

>IIRC that was sort-of a condition for adoption of the work in the IETF 
>20 years ago, when there were two different protocols already being 
>deployed and the proponents of one of them said "we'll use that other 
>one (SSL) but you gotta change the name of the standard or we can't get 
>our <bosses> to agree to change to all use the same thing."

If no-one from Microsoft has any objections, can we just rename it back to what it's always been for everyone but us, SSL?

Peter.

---

From: David Benjamin <[email-masked]>
Date: Fri, 02 Dec 2016 17:58:44 +0000

(To clarify, I was not at all suggesting we go back to SSL. If we had a
time machine, I might make other suggestions, but as far as I know we do
not.)

On Fri, Dec 2, 2016 at 12:45 PM Andrei Popov <[email-masked]>
wrote:

> Not that I can speak for the whole of Microsoft, but I would not drop TLS
> support in Windows if it were renamed "SSL":).
>
> However, "transport layer security" makes a lot more sense to me than
> "secure sockets layer" because the latter seems to imply network
> socket-style API, which is not a requirement of this protocol.
>
> Cheers,
>
> Andrei
>
> To: Stephen Farrell <[email-masked]>; David Benjamin <
> [email-masked]>; Tony Arcieri <[email-masked]>; <[email-masked]> <
> [email-masked]>

---

From: Yoav Nir <[email-masked]>
Date: Fri, 2 Dec 2016 20:23:16 +0200

> On 2 Dec 2016, at 19:58, David Benjamin <[email-masked]> wrote:
> 
> (To clarify, I was not at all suggesting we go back to SSL. If we had a time machine, I might make other suggestions, but as far as I know we do not.)

Can’t we borrow one from tictoc?

---

From: Andrei Popov <[email-masked]>
Date: Fri, 2 Dec 2016 18:34:42 +0000

Indeed, "all known versions of SSL are broken and should never be used" is what I've been telling people for a while now...

-----Original Message-----
From: TLS [mailto:[email-masked]] On Behalf Of Daniel Kahn Gillmor
Sent: Friday, December 2, 2016 6:36 AM
To: Peter Gutmann <[email-masked]>; Stephen Farrell <[email-masked]>; David Benjamin <[email-masked]>; Tony Arcieri <[email-masked]>; <[email-masked]> <[email-masked]>
Subject: Re: [TLS] Confirming consensus: TLS1.3->TLS*

On Fri 2016-12-02 03:33:21 -0500, Peter Gutmann wrote:
> If no-one from Microsoft has any objections, can we just rename it 
> back to what it's always been for everyone but us, SSL?

fwiw, the industry (and stackexchange) uses "SSL" to mean all sorts of things, not only TLS.  Yesterday i got an e-mail from a reputable CA reseller that said "Your SSL is expiring in two days!  Buy a new SSL now!"

Surely no one is proposing that we also re-name the X.509 certificate format to "SSL" just because vendors whose business models revolve around these products are confused about terminology.  What else should we rename to "SSL" on that basis?  Maybe a load-balancer is also "SSL"!

Here's a useful and effective meme for convincing bosses that it's ok to turn off SSLv3: all known versions of SSL are broken and should never be used.  Please do not break this meme by trying to rename TLS to SSL.

I don't care about the bikeshed over the number: i'd be fine with any of TLS 1.3 or TLS 4 or TLS 2017.  But can we please not create *even more* confusion by bikeshedding over the name itself?

       --dkg

---

From: [email-masked]
Date: Fri, 2 Dec 2016 12:54:43 -0600

+1 with Andrei. 

"That SSL should never be used" is the one clear message we have so going 
back to SSL would muddy those waters too much.  Strong vote for staying 
with TLS.  It will become better known over time- especially with the 
current enterprise push to deprecate all SSL versions from use. 
Regarding the numbering schema, someone recently mentioned that probably 
only a few hundred of us are aware of the TLS 1.3 nomenclature at this 
point and I would concur with that.  So, after considering all of the good 
points that have been circulating, I would like to change my vote to TLS 
2017.  It provides clarity, recognizes that it is a major change and pulls 
us out of the whole SSL/TLS numbering confusion/quagmire.

Darin

From:   Andrei Popov <[email-masked]>
To:     Daniel Kahn Gillmor <[email-masked]>, Peter Gutmann 
<[email-masked]>, Stephen Farrell <[email-masked]>, 
David Benjamin <[email-masked]>, Tony Arcieri <[email-masked]>, 
"<[email-masked]>" <[email-masked]>
Date:   12/02/2016 12:34 PM
Subject:        Re: [TLS] Confirming consensus: TLS1.3->TLS*
Sent by:        "TLS" <[email-masked]>

Indeed, "all known versions of SSL are broken and should never be used" is 
what I've been telling people for a while now...

-----Original Message-----
From: TLS [mailto:[email-masked]] On Behalf Of Daniel Kahn Gillmor
Sent: Friday, December 2, 2016 6:36 AM
To: Peter Gutmann <[email-masked]>; Stephen Farrell 
<[email-masked]>; David Benjamin <[email-masked]>; Tony 
Arcieri <[email-masked]>; <[email-masked]> <[email-masked]>
Subject: Re: [TLS] Confirming consensus: TLS1.3->TLS*

fwiw, the industry (and stackexchange) uses "SSL" to mean all sorts of 
things, not only TLS.  Yesterday i got an e-mail from a reputable CA 
reseller that said "Your SSL is expiring in two days!  Buy a new SSL now!"

Surely no one is proposing that we also re-name the X.509 certificate 
format to "SSL" just because vendors whose business models revolve around 
these products are confused about terminology.  What else should we rename 
to "SSL" on that basis?  Maybe a load-balancer is also "SSL"!

       --dkg

U.S. BANCORP made the following annotations
---------------------------------------------------------------------
Electronic Privacy Notice. This e-mail, and any attachments, contains information that is, or may be, covered by electronic communications privacy laws, and is also confidential and proprietary in nature. If you are not the intended recipient, please be advised that you are legally prohibited from retaining, using, copying, distributing, or otherwise disclosing this information in any manner. Instead, please reply to the sender that you have received this communication in error, and then immediately delete it. Thank you in advance for your cooperation.

---------------------------------------------------------------------

---

From: Viktor Dukhovni <[email-masked]>
Date: Fri, 2 Dec 2016 14:05:36 -0500

> On Dec 2, 2016, at 3:33 AM, Peter Gutmann <[email-masked]> wrote:
> 

I was with you up to this point, but I do think that going back to SSL is
not a good idea, and takes us off topic.

Is there any glimmer of rough consensus on:

 * TLS 1.3 vs.
 * TLS 4   vs.
 * TLS 2017 vs.
 * TLS 2.0?

Opening it up even wider seems like a sure way to get nowhere (which is
likely status quo TLS 1.3).

-- 
	Viktor.

---

From: "Ackermann, Michael" <[email-masked]>
Date: Fri, 2 Dec 2016 19:15:42 +0000

+2
On removing all  references to SSL.

From: TLS [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Friday, December 2, 2016 1:55 PM
To: Andrei Popov <[email-masked]>
Cc: TLS <[email-masked]>; <[email-masked]> <[email-masked]>
Subject: Re: [TLS] Confirming consensus: TLS1.3->TLS*

+1 with Andrei.

"That SSL should never be used" is the one clear message we have so going back to SSL would muddy those waters too much.  Strong vote for staying with TLS.  It will become better known over time- especially with the current enterprise push to deprecate all SSL versions from use.
Regarding the numbering schema, someone recently mentioned that probably only a few hundred of us are aware of the TLS 1.3 nomenclature at this point and I would concur with that.  So, after considering all of the good points that have been circulating, I would like to change my vote to TLS 2017.  It provides clarity, recognizes that it is a major change and pulls us out of the whole SSL/TLS numbering confusion/quagmire.

Darin

From:        Andrei Popov <[email-masked]<mailto:[email-masked]>>
To:        Daniel Kahn Gillmor <[email-masked]<mailto:[email-masked]>>, Peter Gutmann <[email-masked]<mailto:[email-masked]>>, Stephen Farrell <[email-masked]<mailto:[email-masked]>>, David Benjamin <[email-masked]<mailto:[email-masked]>>, Tony Arcieri <[email-masked]<mailto:[email-masked]>>, "<[email-masked]<mailto:[email-masked]>>" <[email-masked]<mailto:[email-masked]>>
Date:        12/02/2016 12:34 PM
Subject:        Re: [TLS] Confirming consensus: TLS1.3->TLS*
Sent by:        "TLS" <[email-masked]<mailto:[email-masked]>>
________________________________

-----Original Message-----
From: TLS [mailto:[email-masked]] On Behalf Of Daniel Kahn Gillmor
Sent: Friday, December 2, 2016 6:36 AM
To: Peter Gutmann <[email-masked]<mailto:[email-masked]>>; Stephen Farrell <[email-masked]<mailto:[email-masked]>>; David Benjamin <[email-masked]<mailto:[email-masked]>>; Tony Arcieri <[email-masked]<mailto:[email-masked]>>; <[email-masked]<mailto:[email-masked]>> <[email-masked]<mailto:[email-masked]>>
Subject: Re: [TLS] Confirming consensus: TLS1.3->TLS*

      --dkg

_______________________________________________
TLS mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/tls

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 2 Dec 2016 19:44:30 +0000

> Can’t we borrow one from tictoc?

Ever since they merged with NTP, it seems to be lost in a time loop and nobody can find it.

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 2 Dec 2016 19:46:15 +0000

> after considering all of the good points that have been circulating, I would like to change my vote 

Woah, are you new here? :)

---

From: Aaron Zauner <[email-masked]>
Date: Fri, 2 Dec 2016 20:58:27 +0100

* Sean Turner <[email-masked]> [18/11/2016 03:13:23] wrote:
> At IETF 97, the chairs lead a discussion to resolve whether the WG should rebrand TLS1.3 to something else.  Slides can be found @ https://www.ietf.org/proceedings/97/slides/slides-97-tls-rebranding-aka-pr612-01.pdf.
> 
> The consensus in the room was to leave it as is, i.e., TLS1.3, and to not rebrand it to TLS 2.0, TLS 2, or TLS 4.  We need to confirm this decision on the list so please let the list know your top choice between:
> 
> - Leave it TLS 1.3

Please let's keep it to TLS 1.3 which we have been talking about for
a couple of years now, no-one expects a protocol from this WG with a
different name (of course I'd opt for SSLv5 just to mess with people).

Aaron

---

From: Michael D'Errico <[email-masked]>
Date: Fri, 02 Dec 2016 12:06:08 -0800

Aaron Zauner wrote:
> 
> (of course I'd opt for SSLv5 just to mess with people).

I'm surprised nobody has yet suggested retroactive renaming:

     SSLv4  ==  TLS 1.0
     SSLv5  ==  TLS 1.1
     SSLv6  ==  TLS 1.2
     SSLv7  ==  TLS 1.3

Mike

---

From: Patrick McManus <[email-masked]>
Date: Fri, 2 Dec 2016 15:09:13 -0500

I favor naming the result tls 1.3 - the X in 1.X has effectively become the
modern versioning field and we should stick with that road now as the best
of a bunch of weak options.

-Patrick

---

From: Peter Gutmann <[email-masked]>
Date: Fri, 2 Dec 2016 21:10:39 +0000

Hubert Kario <[email-masked]> writes:

>speaking of confusion, do you know that e-mail clients by "SSL" mean
>"SSL/TLS" and by "TLS" mean "STARTTLS"? (note the port numbers)

Ugh, how very geeky, all the charm of fetchmail with a GUI bolted on.  The
fact that security geeks suck at UX isn't really proof of anything (other than
that you need to let interaction designers do your UX, not security people).

With Apple Mail, all you have to do is click on "Use Secure Sockets Layer" and
you're done (note the name).  With the Android mailer I use it's not even
that, it's autoconfigured, just point it at your email domain and give a
username and password.

Peter.

---

From: Ted Lemon <[email-masked]>
Date: Fri, 2 Dec 2016 16:11:51 -0500

On Dec 2, 2016, at 4:10 PM, Peter Gutmann <[email-masked]> wrote:
> Ugh, how very geeky,

Really?

---

From: Peter Gutmann <[email-masked]>
Date: Fri, 2 Dec 2016 21:21:35 +0000

Maarten Bodewes <[email-masked]> writes:

>for a long time and no matter what you do, a lot of us (who are hopefully the
>experts) will keep referring to it under that name.

The change was proposed long ago, and deferred by the chairs until now.  This
is just another variant of the inertia argument.

Peter.

---

From: Peter Gutmann <[email-masked]>
Date: Fri, 2 Dec 2016 21:26:45 +0000

Viktor Dukhovni <[email-masked]> writes:

>I was with you up to this point, but I do think that going back to SSL is not
>a good idea, and takes us off topic.

It was just something to throw out there, and to point out that no matter what
the WG calls it, the rest of the world will keep calling it SSL.  It's been
twenty years, it's not going to change any more now.

>likely status quo TLS 1.3).

Yeah, fair enough.  It would be nice to finally fix a 20-year-old mistake though.

Peter.

---

From: Tony Arcieri <[email-masked]>
Date: Fri, 2 Dec 2016 14:16:16 -0800

> is just another variant of the inertia argument.

You keep dismissing this argument out of hand, but I think it has merit.

I think we can all admit the decision to rename SSL -> TLS is a mistake (to
the point people are proposing to retroactively re-rename TLS back to SSL).

There is now a huge body of work which calls the protocol "TLS 1.3" which
will be cited for years to come. You wrote this whole body of work off as
the concern of "TLS WG and a small number of people who interact with it"
as if a move to a different version number comes at zero cost almost as if
this work doesn't matter, but I have a different view: this is one more bit
of errata in exactly the same vein as the SSL -> TLS move which anyone
consulting this body of work will have to contend with.

You will no doubt disagree, so I'm simply saying it for posterity: keeping
the version TLS 1.3 is the least confusing option, IMO.

-- 
Tony Arcieri

---

From: Tony Arcieri <[email-masked]>
Date: Fri, 2 Dec 2016 19:34:16 -0800

On Thu, Nov 17, 2016 at 6:12 PM, Sean Turner <[email-masked]> wrote:

> The consensus in the room was to leave it as is, i.e., TLS1.3, and to not
> rebrand it to TLS 2.0, TLS 2, or TLS 4.  We need to confirm this decision
> on the list so please let the list know your top choice between:
>
> - Leave it TLS 1.3
> - Rebrand TLS 2.0
> - Rebrand TLS 2
> - Rebrand TLS 4
>
> by 2 December 2016.

I guess we're at the deadline, but I have a compromise I think makes sense:

- Keep this version TLS 1.3
- For the next version of TLS, drop the 1.x and call it TLS 4

-- 
Tony Arcieri

---

From: Viktor Dukhovni <[email-masked]>
Date: Fri, 2 Dec 2016 22:49:21 -0500

> On Dec 2, 2016, at 10:34 PM, Tony Arcieri <[email-masked]> wrote:
> 

That "next version", will perhaps be the one after the QC crypto-apocalypse...

More seriously I don't expect another TLS version after this for a decade
or so.  The adoption cycle is so long, it makes little sense to rev the
protocol with any frequency.  So get it right now, near-term revisions
seem unlikely.

So I see your proposal as not a compromise, but rather as staying with
the status quo, for better or worse and for quite some time...

-- 
	Viktor.

---

From: Scott Schmit <[email-masked]>
Date: Fri, 2 Dec 2016 22:57:54 -0500

> the version TLS 1.3 is the least confusing option, IMO.

SSL 3.0 was defined in November 1996 (20 years ago).
RFC 7568 (sslv3diediedie) was published in June 2015.
That's about 18.5 years.

TLS 1.0 is still in use, it was standardized in January 1999.
It's not dead yet, but there has been talk of it.
That's almost 18 years ago.

So these protocols tend to last multiple decades (granted, this is a
small sample size, but it's what we've got).

This draft has been in development since April 2014, 2.6 years ago.
Over that time, the wire protocol has changed multiple times and
incompatibly.  So not even all of that 2.6 years of details is still
applicable to the protocol we're going to publish as an RFC.  So why
would mixing up searched for the final protocol with the draft versions
be a good thing?  

Development versions get new names when they get delivered all the time.
Frankly, at $DAYJOB, development versions are always different than the
final delivered version, by definition.  Doing otherwise is poor version
control.

The volume of work that will be published in the hopefully 18 or more
years that this draft is in deployment will dwarf the current body of
work.  If it doesn't, then we will have completely failed.

Finally, at the top of every internet draft, the IETF states:
> Internet-Drafts are draft documents valid for a maximum of six months
> and may be updated, replaced, or obsoleted by other documents at any
> time.  It is inappropriate to use Internet-Drafts as reference
> material or to cite them other than as "work in progress."

So, no, we have *not* been calling the next version of TLS "TLS 1.3" for
2.6 years.  We have been calling it "a work in progress, subject to
change at any time."  Anyone doing otherwise is arguably as confused as
those who don't even know what TLS is.  And there are a lot more of the
latter than the former.

But no, I would not support calling the next TLS version "SSL 4/2017" -- the
harm of invalidating the "SSL is broken, TLS is (more) secure" advice is
too great. I'd support calling it RSSL (really secure ...) before I'd
support that.

-- 
Scott Schmit

---

From: Scott Schmit <[email-masked]>
Date: Fri, 2 Dec 2016 23:02:41 -0500

> being the informal name for the protocol family, but that isn't a numbering

Then "TLS 2017" should be even better.  It's neither < 3 nor similar
enough to SSL versions as to be confused with them.

And the shift in versioning strategy is so typical it would probably not
even draw serious notice.

-- 
Scott Schmit

---

From: Tony Arcieri <[email-masked]>
Date: Fri, 2 Dec 2016 20:21:45 -0800

> would mixing up searched for the final protocol with the draft versions

The wire format is one thing, but there is work that has been done at a
much higher level referencing "TLS 1.3", e.g. TRON work:

http://prosecco.gforge.inria.fr/personal/karthik/pubs/proscript-tls-tron-2016.pdf

> work.  If it doesn't, then we will have completely failed.

While more security analysis against whatever-the-new-TLS-is-called will
certainly happen, I would imagine it would be split against
whatever-the-next-TLS-version-is-called. And the thing is, a lot of the
extant research about "TLS 1.3" is fantastic, so much so that I think it
will be routinely cited. Certainly there will be new research, but much of
the groundwork has already been laid.

>From what I can tell, the main argument for changing the version is to
*reduce confusion*. I am incredibly unconvinced rebranding TLS 1.3 to TLS
4/2017/9000 will actually accomplish the intended goal.

A recent example of what sort of confusion I could see arise: ECMAScript.
They moved from a numbered branding (ES6/ES7) to a year-based branding
(ES2016/ES2017). People continue to use both, so now you have to maintain a
mental mapping of which-version-to-which-year.

The optimal solution to me as far as reducing these sort of mental
gymnastics goes is to keep the version as "TLS 1.3" and drop the 1.x in the
next release. This gets the "TLS 4" advocates what they want, just not
right away, without renaming the current release at the last minute.

-- 
Tony Arcieri

---

From: Karthik Bhargavan <[email-masked]>
Date: Sat, 3 Dec 2016 14:58:27 +0100

> proscript-tls-tron-2016.pdf

Thanks for the reference but this draft paper does not count as a
publication. Yes, there are other published papers that have appeared
during the last year that use the name TLS 1.3, but I think academics will
keep out of this (re)naming debate because it does not matter so much for
us. We are already citing draft versions in our papers, because a proof for
draft 10 does not carry over to draft 18. When the RFC comes out, we'll
start consistently citing the published protocol, whatever it is called.

Again, I'll keep out of the protocol name discussion, but I don't think the
name will add too much confusion for academic works, or put another way, it
will not reduce the confusion which already exists between various draft
versions and the final RFC.

---

From: Sean Turner <[email-masked]>
Date: Sat, 3 Dec 2016 11:55:21 -0500

At this point I don’t think it’s December 2nd anywhere in the world, so it’s time to close this thread.  Joe and I will take a couple of days to review the 130+ messages.

spt

> On Nov 17, 2016, at 21:12, Sean Turner <[email-masked]> wrote:
> 
> Thanks,
> J&S

---

From: Peter Gutmann <[email-masked]>
Date: Sun, 4 Dec 2016 00:29:31 +0000

Tony Arcieri <[email-masked]> writes:

>There is now a huge body of work which calls the protocol "TLS 1.3"

When you say "huge body of work" you're referring to an IETF draft with "no
formal status, subject to change or removal at any time; therefore they should
not be cited or quoted in any formal document" (in other words a no-op), and
some research reports/papers and blog posts, pretty much invisible to anyone
outside the WG and a few people who follow it in the crypto community.  To
quote Douglas Adams, "this must be some new use of the word huge with which I
wasn't previously familiar".

So I'll maintain my point that the only real argument that's been put forward
for 1.3 is inertia, "we've always done it this way and I don't want to
change".  And that's why I support 4, or 2017, or whatever: The WG can pretend
it's meant to be called TLS, everyone else can keep calling it SSL like they
always have, but no matter what, the numbers will work out.  No matter how you
choose to label the alphabetical part, either 4 or 2017 is obviously the
newer, better version number.

Peter.

---

From: Mohan Sekar <[email-masked]>
Date: Sun, 4 Dec 2016 06:15:29 +0000

+1 on Tony comment

Mohan Sekar

From: TLS [mailto:[email-masked]] On Behalf Of Tony Arcieri
Sent: Saturday, December 3, 2016 9:04 AM
To: Sean Turner <[email-masked]>
Cc: <[email-masked]> <[email-masked]>
Subject: Re: [TLS] Confirming consensus: TLS1.3->TLS*

On Thu, Nov 17, 2016 at 6:12 PM, Sean Turner <[email-masked]<mailto:[email-masked]>> wrote:
The consensus in the room was to leave it as is, i.e., TLS1.3, and to not rebrand it to TLS 2.0, TLS 2, or TLS 4.  We need to confirm this decision on the list so please let the list know your top choice between:

- Leave it TLS 1.3
- Rebrand TLS 2.0
- Rebrand TLS 2
- Rebrand TLS 4

by 2 December 2016.

--
Tony Arcieri

---

From: Joseph Salowey <[email-masked]>
Date: Tue, 13 Dec 2016 16:23:43 -0800

Thanks to all those that participated in the list discussion, it was a very
popular topic.  On the list and in the meeting, TLS 1.3 had more support
than any other option so we believe there is rough consensus to leave the
name of the protocol as TLS 1.3.

Thanks,

J&S

On Sat, Dec 3, 2016 at 10:15 PM, Mohan Sekar <[email-masked]>
wrote:

> *From:* TLS [mailto:[email-masked]] *On Behalf Of *Tony Arcieri
> *Sent:* Saturday, December 3, 2016 9:04 AM
> *To:* Sean Turner <[email-masked]>
> *Cc:* <[email-masked]> <[email-masked]>
> *Subject:* Re: [TLS] Confirming consensus: TLS1.3->TLS*
>
>
>