Subject: [TLS] SSL 2 CLIENT-HELLO backwards compatibility compromise

From: Dave Garrett <[email-masked]>
Date: Thu, 12 Feb 2015 17:27:24 -0500

The previous consensus is in the draft now, so resuming discussion on
what to do with the SSL 2 CLIENT-HELLO format as was planned.

https://github.com/tlswg/tls13-spec/issues/113

I'd like to say there are roughly 3 options on how to deal with SSL 2
CLIENT-HELLO backwards compatibility in TLS 1.3 implementations.
(to reiterate, we're talking about the format defined in
https://tools.ietf.org/html/rfc5246#appendix-E.2 )

Option #0) Current draft
v2 format MUST NOT be sent ever
v2 format MUST NOT be used at all for TLS 1.3+
v2 format NOT RECOMMENDED to accept for TLS 1.0-1.2

Option #1) Ditch the format that has been deprecated for 20 years
v2 format MUST NOT be sent or accepted for any reason

Option #2) Restrict to TLS 1.0
v2 format MUST NOT be sent ever
v2 format MUST NOT be used at all for TLS 1.1+
v2 format NOT RECOMMENDED to accept for TLS 1.0

The reason I frame the choices like this is that the TLS 1.0 case was of primary discussion. The TLS 1.2 case was brought up, but seems to have way less justification. Recent discussion also suggested setting TLS 1.1 as allowed and TLS 1.2 as not, however I think focusing only on the primary case of TLS 1.0 could be much better.

There has been some limited discussion on how to proceed with deprecating TLS 1.0, and TLS 1.1 has been said to be sufficiently improved as such to not necessarily deprecate it with it. With option #2, once TLS 1.0 is dropped, then for remaining supported TLS versions the situation is the same as option #1; the v2 format is completely prohibited after that point. I think option #2 is a reasonable compromise if enough people are sadly against option #1.

Opinions?

Dave

---

From: Brian Smith <[email-masked]>
Date: Thu, 12 Feb 2015 15:34:31 -0800

> v2 format NOT RECOMMENDED to accept for TLS 1.0-1.2

I think this is fine. We should move on to more important issues.

> v2 format NOT RECOMMENDED to accept for TLS 1.0

How to negotiate TLS 1.0 and what is acceptable for TLS 1.0 is out of
scope for the TLS 1.3 specification. (More generally, what to do for
earlier versions is out of scope.)

Cheers,
Brian

---

From: Yuhong Bao <[email-masked]>
Date: Thu, 12 Feb 2015 15:36:11 -0800

> earlier versions is out of scope.)

Maybe do it as a separate BCP draft eventually?

---

From: Aaron Zauner <[email-masked]>
Date: Fri, 13 Feb 2015 07:53:10 +0100

Hi,

> v2 format MUST NOT be sent or accepted for any reason

+1

Aaron