Subject: [TLS] Simplify, simplify, simplify

From: Watson Ladd <[email-masked]>
Date: Wed, 14 May 2014 22:23:23 -0700

Dear all,

As we are about to embark on a meeting to produce a protocol, let me
bring forwards what a veteran IETF participant believes about
protocols:
https://www.w3.org/2014/strint/papers/34.pdf

If TLS 1.3 is easier to deploy then TLS 1.2 it will be deployed.
Otherwise it will not be. Some of the specific recommendations are for
other WGs (in particular DANE, DNSSEC, and whoever is in charge of the
mess that is PKIX), but I think that the bottom-line message is worth
listening to: simplicity is the single most important criterion for a
security protocol.

Sincerely,
Watson Ladd

---

From: Michael D'Errico <[email-masked]>
Date: Wed, 14 May 2014 22:40:37 -0700

How do you get around the way version negotiation works?  If a client
asks for TLS 1.3, and the server doesn't support it so it replies with
TLS 1.2, the client has to know how to speak 1.2.  There's no way for
the client to say it supports TLS 1.0 and 1.3, but not 1.1 or 1.2.

Mike

---

From: Fabrice <[email-masked]>
Date: Wed, 14 May 2014 23:07:10 -0700

> On May 14, 2014, at 22:40, Michael D'Errico <[email-masked]> wrote:
> 
> TLS 1.2, the client has to know how to speak 1.2.

No, at that point the client can refuse to speak TLS 1.2 and abort the connection,

... then restart a new connection using it's legacy TLS 1.0 implementation. 

>  There's no way for
> the client to say it supports TLS 1.0 and 1.3, but not 1.1 or 1.2

You could also have out of band indications of what the servers support, so that you avoid the reconnection in most cases. 

I don't see a simple and efficient way though, so I guess you have a point...

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Thu, 15 May 2014 10:36:16 +0200

> the client to say it supports TLS 1.0 and 1.3, but not 1.1 or 1.2.

The best would be for TLS 1.3 not to bump the protocol version number.
It could masquerade as TLS 1.2 and use extensions to negotiate any new
functionality. That way it wouldn't have any interoperability issues (if
we ignore for a moment the client hello size issues).

regards,
Nikos