Subject: [TLS] Confirming consensus: TLS1.3->TLS*

From: Sean Turner <[email-masked]>
Date: Fri, 18 Nov 2016 11:12:48 +0900

At IETF 97, the chairs lead a discussion to resolve whether the WG should rebrand TLS1.3 to something else.  Slides can be found @ https://www.ietf.org/proceedings/97/slides/slides-97-tls-rebranding-aka-pr612-01.pdf.

The consensus in the room was to leave it as is, i.e., TLS1.3, and to not rebrand it to TLS 2.0, TLS 2, or TLS 4.  We need to confirm this decision on the list so please let the list know your top choice between:

- Leave it TLS 1.3
- Rebrand TLS 2.0
- Rebrand TLS 2
- Rebrand TLS 4

by 2 December 2016.

Thanks,
J&S

---

From: Yoav Nir <[email-masked]>
Date: Fri, 18 Nov 2016 11:41:31 +0900

Bleh. Can’t we get AOL to release the SSL trademark so that we can call it SSLv4? 

I hummed for TLS 4, so I’ll stay consistent: TLS 4.

Yoav

> On 18 Nov 2016, at 11:12, Sean Turner <[email-masked]> wrote:
> 
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: Erik Nygren <[email-masked]>
Date: Thu, 17 Nov 2016 22:11:43 -0500

I also prefer TLS 4 but am fine with TLS 1.3

- Erik

On Nov 17, 2016 9:41 PM, "Yoav Nir" <[email-masked]> wrote:

> > At IETF 97, the chairs lead a discussion to resolve whether the WG
> should rebrand TLS1.3 to something else.  Slides can be found @
> https://www.ietf.org/proceedings/97/slides/slides-
> 97-tls-rebranding-aka-pr612-01.pdf.
> >
> > The consensus in the room was to leave it as is, i.e., TLS1.3, and to
> not rebrand it to TLS 2.0, TLS 2, or TLS 4.  We need to confirm this
> decision on the list so please let the list know your top choice between:
> >
> > - Leave it TLS 1.3
> > - Rebrand TLS 2.0
> > - Rebrand TLS 2
> > - Rebrand TLS 4
> >
> > by 2 December 2016.
> >
> > Thanks,
> > J&S

---

From: Nick Harper <[email-masked]>
Date: Fri, 18 Nov 2016 13:16:00 +0900

I prefer TLS 1.3 but am also fine with TLS 4.

On Fri, Nov 18, 2016 at 11:12 AM, Sean Turner <[email-masked]> wrote:

> At IETF 97, the chairs lead a discussion to resolve whether the WG should
> rebrand TLS1.3 to something else.  Slides can be found @
> The consensus in the room was to leave it as is, i.e., TLS1.3, and to not
> rebrand it to TLS 2.0, TLS 2, or TLS 4.  We need to confirm this decision
> on the list so please let the list know your top choice between:
>
> - Leave it TLS 1.3
> - Rebrand TLS 2.0
> - Rebrand TLS 2
> - Rebrand TLS 4
>
> by 2 December 2016.
>
> Thanks,
> J&S

---

From: Tony Arcieri <[email-masked]>
Date: Thu, 17 Nov 2016 21:20:15 -0800

I am a big fan of leaving it as TLS 1.3.

It feels more like evolution than revolution, even with the addition of
0-RTT. I would like to see a future TLS 2.0, but one that makes fundamental
changes which didn't make the cut for 1.3, e.g. moving to OPTLS.

-- 
Tony Arcieri

---

From: Viktor Dukhovni <[email-masked]>
Date: Fri, 18 Nov 2016 06:04:29 +0000

On Fri, Nov 18, 2016 at 11:12:48AM +0900, Sean Turner wrote:

> https://www.ietf.org/proceedings/97/slides/slides-97-tls-rebranding-aka-pr612-01.pdf.
> 

TLS 4 sounds about right to me:

    * Conveys the substantial protocol changes
    * Avoids any confusion from SSLv2/SSLv3 bearing higher numbers than TLS 1.x
    * If someone happens to call it SSLv4 it will not be confusing.
    * Matches the minor version on the wire protocol

Though with this choice, the next version would likely be TLS 5,
whether or not it is a major change or just incremental change, I
don't think it will going forward be important to convey that some
version updates are minor.  A non-branching integral sequence feels
about right.

The only downside I see is that it becomes unclear what to call
some future protocol version with a wire protocol major number not
equal to 3.  My take is that such a protocol would no longer be
TLS (it would presumably have an incompatible HELLO and/or record
layer format and would not be able to negotiate older protocol
versions), so there's likely not much point in calling such a
hypothetical beast "TLS".

-- 
	Viktor.

---

From: David Benjamin <[email-masked]>
Date: Fri, 18 Nov 2016 06:18:05 +0000

I already hummed in the room, but I think it should stay as TLS 1.3. Either
of TLS 2 or TLS 4 makes the SSL/TLS silliness worse. One matches SSL 2.0
and the other just makes all this weirder. (Do we really want 2.0 < 3.0 <
1.0 < 1.1 < 1.2 < 4?)

TLS 1.3 is the natural next number and doesn't make anything worse. Let's
just use it.

---

From: Dave Garrett <[email-masked]>
Date: Fri, 18 Nov 2016 02:27:07 -0500

> The consensus in the room was to leave it as is, i.e., TLS1.3, and to not rebrand it to TLS 2.0, TLS 2, or TLS 4.  We need to confirm this decision on the list so please let the list know your top…

In descending order of preference:
1) TLS 2.0 or TLS 2
2) TLS 1.3
3) TLS 4

There is no versioning here that doesn't have a confusion risk. Some people worry about an SSL/TLS 2.0 confusion. I worry that TLS 1.3 won't be taken with as much seriousness/urgency at a glance by those with a lower technical understanding (too many of us resort to "it's really like TLS 2" when trying to explain the leap). TLS 4 or elventybillion just forces people to answer the "what happened to TLS 3" question forever, without really making anything more clear. The confusion a big number jump tries to avoid is far better addressed by experts finally stopping with the SSL/TLS conflation.

If the consensus is to keep the status quo, in spite of major changes that would normally dictate a major version bump, that's unfortunate... but the world will not implode. :/

Dave

PS
I suspect that a push for a major version bump a year and a half ago would've had more support, but many of us who are currently in favor of it were still in the "meh, whatever" camp. Oh well.

---

From: Martin Thomson <[email-masked]>
Date: Fri, 18 Nov 2016 18:42:44 +0900

> - Leave it TLS 1.3

There is no point in re-litigating this decision.  The consensus call
was pretty clear in the room.

Perhaps the question would have been better phrased as: "does anyone
have new information that would suggest those present at the meeting
made the wrong choice?" or "does anyone vehemently object to this
decision?"  I see no new information in the responses thus far.

On 18 November 2016 at 16:27, Dave Garrett <[email-masked]> wrote:
> I suspect that a push for a major version bump a year and a half ago would've had more support

Yep, that would have been a more appropriate time to raise the naming
thing.  Now lots of people know this thing as TLS 1.3, which means a
name change would be a big setback to our marketing efforts (such as
they are ;)...

---

From: Peter Gutmann <[email-masked]>
Date: Fri, 18 Nov 2016 10:09:52 +0000

Sean Turner <[email-masked]> writes:

>rebrand it to TLS 2.0, TLS 2, or TLS 4.

Which is kind of odd, because the consensus on the list when it was debated
here a while back was to not call it 1.3.  It definitely shouldn't be 1.3
because it's a new protocol, nothing like the 1.0 - 1.2 that preceded it.
Since the general opinion (on the list) so far seems to be to call it TLS 4,
I'd be quite happy to go with that.

Peter.

---

From: Viktor Dukhovni <[email-masked]>
Date: Fri, 18 Nov 2016 11:53:21 +0000

> was pretty clear in the room.

My impression was that the list is where rough consensus is
established, and consensus in "the room" does not preempt discussion
on the list.  Rather "the room" merely provides an early indication
of the likely consensus position.

-- 
	Viktor.

---

From: Ilari Liusvaara <[email-masked]>
Date: Fri, 18 Nov 2016 14:19:10 +0200

On Fri, Nov 18, 2016 at 11:12:48AM +0900, Sean Turner wrote:
> The consensus in the room was to leave it as is, i.e., TLS1.3, and
> to not rebrand it to TLS 2.0, TLS 2, or TLS 4.  We need to confirm
> this decision on the list so please let the list know your top
> choice between:

I say leave it.

I would leave that sort of version changes to really major shifts where
the compatiblity is completely broken. And TLS 1.3 is not that major
change.

-Ilari

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 18 Nov 2016 12:48:49 +0000

Renaming was brought up on the list before like Peter said.  It was discussed with at least one chair during an interim, and I was told we'll bring it up when we're almost done because we don't want to distract the group now.  And I'll attribute Martin's atypical heavy-handed comments to typical post-IETF exhaustion on his part.

Especially with the flurry of activity over the past couple of weeks, this is not the TLS 1.x we all know.  We should change the version number, and for the sake of comity I don't care what it is.

--  
Senior Architect, Akamai Technologies
Member, OpenSSL Dev Team
IM: [email-masked] Twitter: RichSalz

---

From: Peter Gutmann <[email-masked]>
Date: Fri, 18 Nov 2016 13:03:50 +0000

Ilari Liusvaara <[email-masked]> writes:

>I would leave that sort of version changes to really major shifts where the
>compatiblity is completely broken. And TLS 1.3 is not that major change.

So you're saying that apart from the different algorithms, cipher suites,
messages, message fields, message flow, handshaking, negotiation, extensions,
and crypto, it's practically the same thing?

Peter.

---

From: Eric Mill <[email-masked]>
Date: Fri, 18 Nov 2016 10:34:52 -0500

> on the list so please let the list know your top choice between:

Because I have literally had the experience of a (very) major organization
insisting that HTTPS was not secure because the "most recent" version, SSL
version 3.0, had recently been broken, I support moving this out to TLS 4.

But more generally, I support getting off of the major/minor version naming
scheme. There are no "minor versions" of TLS. Every one is a huge deal for
the ecosystem to update to. I think it will be simpler for everyone in the
future if TLS always just uses whole numbers with no decimal points.

So either TLS 4 or TLS 2 would be improvements in some way. TLS 2.0
wouldn't get you improvements in either category.

As really a non-participant in the WG, I don't expect my preference to
count much, but for whatever it's worth, it would be:

TLS 4 > TLS 2 > TLS 1.3 > TLS 2.0

-- Eric

by 2 December 2016.

-- 
konklone.com | @konklone <https://twitter.com/konklone>

---

From: Ilari Liusvaara <[email-masked]>
Date: Fri, 18 Nov 2016 17:40:43 +0200

> and crypto, it's practically the same thing?

Yes. One can downnegotiate TLS 1.3 to TLS 1.2.

-Ilari

---

From: Michael Ströder <[email-masked]>
Date: Fri, 18 Nov 2016 16:42:14 +0100

On 2016-11-18 16:34, Eric Mill wrote:
> count much,

dito for in my case

> but for whatever it's worth, it would be:
> 

+1

Ciao, Michael.

---

From: Will Serumgard <[email-masked]>
Date: Fri, 18 Nov 2016 07:49:03 -0800

At this point it is a little late to change. I say stay with TLS1.3. As some others pointed out maybe we can make a jump in the next version. 

Will Serumgard

> On Nov 18, 2016, at 7:42 AM, Michael Ströder <[email-masked]> wrote:
>

---

From: Adam Langley <[email-masked]>
Date: Fri, 18 Nov 2016 07:56:35 -0800

On Fri, Nov 18, 2016 at 7:49 AM, Will Serumgard <[email-masked]>
wrote:

> At this point it is a little late to change. I say stay with TLS1.3. As
> some others pointed out maybe we can make a jump in the next version.
>

Renumbering SSL 3.1 as TLS 1.0 was a mistake in the first place, but I
don't believe that changing the version of TLS 1.3 (even if monotonic) will
help at this point. Thus I support keeping TLS 1.3.

Cheers

AGL

---

From: Henrick Hellström <[email-masked]>
Date: Fri, 18 Nov 2016 16:56:19 +0100

> Yes. One can downnegotiate TLS 1.3 to TLS 1.2.

Shouldn't you be able to do that between major protocol versions as well?

---

From: Hubert Kario <[email-masked]>
Date: Fri, 18 Nov 2016 17:16:36 +0100

> on the list so please let the list know your top choice between:

Keep it at TLS 1.3.

TLS 2.0 and 2 are just too likely to be confused with SSL 2.

-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic

---

From: Ira McDonald <[email-masked]>
Date: Fri, 18 Nov 2016 11:47:01 -0500

Hi,

+1 --- keep TLS 1.3

Cheers,
- Ira

---

From: Christian Huitema <[email-masked]>
Date: Fri, 18 Nov 2016 07:30:36 -1000

I prefer TLS 1.3, because is signals continuity with the ongoing TLS deployment efforts.

-- Christian Huitema 

> On Nov 18, 2016, at 6:47 AM, Ira McDonald <[email-masked]> wrote:
> 
> Hi,
> 
> +1 --- keep TLS 1.3
> 
> Cheers,
> - Ira
>

---

From: [email-masked] (Martin Rex)
Date: Fri, 18 Nov 2016 19:00:06 +0100 (CET)

> ongoing TLS deployment efforts.

As long as the awful hiding of the ContentType information in TLS Records
remains in this protocol, it will *NOT* easily deploy as a replacement
of TLSv1.2.

I'm OK with TLS 4,

but my real concern is the (current) lack of backwards compatibility
of the TLS record format.

-Martin

---

From: "D. J. Bernstein" <[email-masked]>
Date: 18 Nov 2016 18:07:37 -0000

The largest number of users have the least amount of information, and
they see version numbers as part of various user interfaces. It's clear
how they will be inclined to guess 3>1.3>1.2>1.1>1.0 (very bad) but
4>3>1.2>1.1>1.0 (eliminating the problem as soon as 4 is supported).

We've all heard anecdotes of 3>1.2>1.1>1.0 disasters. Even if this type
of disaster happens to only 1% of site administrators, it strikes me as
more important for security than any of the arguments that have been
given for "TLS 1.3". So I would prefer "TLS 4".

Yes, sure, we can try to educate people that TLS>SSL (but then we're
fighting against tons of TLS=SSL messaging), or educate them to use
server-testing tools (so that they can fix the problem afterwards---but
I wonder whether anyone has analyzed the damage caused by running SSLv3
for a little while before switching the same keys to a newer protocol),
and hope that this education fights against 3>1.3 more effectively than
it fought against 3>1.2. But it's better to switch to a less error-prone
interface that doesn't require additional education in the first place.

---Dan

---

From: Vlad Krasnov <[email-masked]>
Date: Fri, 18 Nov 2016 11:29:13 -0800

First: where can we see the study that proves people are indeed confused that TLS > SSL? I don’t buy into that. Are people really confused after 17 years of TLS?

Second: I don’t think that the changes between TLS 1.3 and TLS 1.2 are considered a major: just look at the difference between HTTP/2 and HTTP/1 - those are completely different protocols.

Most of TLS 1.3 could be implemented on top of TLS 1.2 with extensions (the way it really looks, if you consider even client_version remains the same).

Third: There was *some* marketing on TLS 1.3, and changing the name now will just tell the public the WG is confused and doesn’t know what its doing.

I vote for TLS 1.3.

> On 18 Nov 2016, at 10:07, D. J. Bernstein <[email-masked]> wrote:
>

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 18 Nov 2016 21:00:40 +0000

> First: where can we see the study that proves people are indeed confused
> that TLS > SSL? I don’t buy into that. Are people really confused after 17 years
> of TLS?

Well, for example, your website has twice as many mentions of SSL as TLS.  Why?  Why don't you have a product called "Universal TLS"? The ratio is the same for letsencrypto.org. TLS 1.0 had already existed for more then a decade before either place existed.  BTW, at google, it's 20:1, and that's just google, not the web.  (Counts were done in the obvious dumb way "site:letsencrypt.org tls" and then with "ssl" and noting the summary stats at the top of the return results.) 

People are confused because we treat them as the same thing. 

> Third: There was *some* marketing on TLS 1.3, and changing the name now
> will just tell the public the WG is confused and doesn’t know what its doing.

The public has no idea what the WG is.

Listen to the non-developers who have posted here.  Version numbers matter to low-information decision makers, who need something quick and simple to grab on to.  It's silly, but so is the real world.  TLS 4 or TLS 4.0  The technology will get more exposure as the trade press explains why the new version number -- it's so much more secure than what we've had before -- and therefore the "new TLS" will get more mindshare.  And therefore adoption will be more rapid.  That's what we want, right?  Or are we satisfied with just letting two browser's canary builds pull the entire Internet forward?

Yes it wil be inconvenient.  Suck it up, buttercup.  At the IETF this week we had people telling people from an entire industry segment "too bad, this is the right thing to do; adapt."  (I exaggerate for effect here.)  And now we're going to confuse the world because we can't change the name of a GitHub repo, a few #define's in source, and maybe a Wikipedia page?

---

From: Vlad Krasnov <[email-masked]>
Date: Fri, 18 Nov 2016 13:19:04 -0800

> People are confused because we treat them as the same thing. 

Well, if the result of the confusion would be people *disabling* TLS 1.* in favor of SSL 3.0, they would discover very quickly what is TLS, and why no major browser works for them.

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 18 Nov 2016 21:25:02 +0000

> Well, if the result of the confusion would be people *disabling* TLS 1.* in
> favor of SSL 3.0, they would discover very quickly what is TLS, and why no
> major browser works for them.

People changing browser settings?  Really?

---

From: Eftychios Theodorakis <[email-masked]>
Date: Fri, 18 Nov 2016 13:36:05 -0800

It is imprinted in people's mind that minor version numbering = small
improvements and compatibility. People for better or worse see a minor
version as minor improvements and often disregard them considering the
effort versus the payout - even if that is a single configuration change.
That's how they learned from non security related projects.

> ongoing TLS deployment efforts.

The alternative suggestion (4) also signals the ongoing efforts. True it
does hint on possible incompatibility; but is this not an honest versioning
then?

I think educating people is a good cause, but that's not enough. One has to
account for all the real life anecdotes mentioned above. If people were
good and fully informed decision makers there would not be a need for "do
not press this red button" signs.

I am not sure what will end up being the better version, but I am certain
that 1.3 will be disregarded as a minor change - it is not. My suggestion
is for TLS 4.

---

From: Vlad Krasnov <[email-masked]>
Date: Fri, 18 Nov 2016 13:42:38 -0800

> People changing browser settings?  Really?

I was thinking about site admins.

---

From: Julien ÉLIE <[email-masked]>
Date: Fri, 18 Nov 2016 22:53:50 +0100

Hi all,

> tonot rebrand it to TLS 2.0, TLS 2, or TLS 4. We need to confirm this

Is there a reason why TLS 4.0 was not proposed?

I would indeed vote for TLS 4.0 (I believe minor versions are useful to 
keep; bumping the major version should occur only when there are 
disruptive changes).
TLS 4.0 gives people a stronger signal that it is a "must-have" 
(compared to 1.3), and prevent people from being confused by SSL 2 and 3.

P.-S.:  I would also suggest to use the TLS 1.3 name for "TLS 1.2 LTS".

-- 
Julien ÉLIE

« Ce que j'aime chez vous, c'est que vous savez jusqu'où on va trop
   loin. » (Cocteau)

---

From: Martin Thomson <[email-masked]>
Date: Sat, 19 Nov 2016 07:18:02 +0900

On 18 Nov 2016 21:10, "Peter Gutmann" <[email-masked]> wrote:
> here a while back was to not call it 1.3.

Some of us stayed quiet for that conversation. I might speculate that it
was because it wasn't a constructive discussion.

In the end, it's just a label.

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 18 Nov 2016 22:21:55 +0000

>In the end, it's just a label.

And some folks here have tried to explain why labels matter.  If you don't find those arguments compelling, that's fine.  But if it's really "just" a label to you, then I'll assume we've seen your last post on this thread? :)

---

From: Eric Mill <[email-masked]>
Date: Fri, 18 Nov 2016 17:32:32 -0500

It seems like TLS 2 and TLS 2.0 have very little support, so it's really
just deciding between:

TLS 1.3
TLS 4 (or maybe 4.0)

I'll just amplify Rich's and djb's points by noting that the cost of
switching away from TLS 1.3 really only affects a very small number of
people -- really just the people in and around this WG.

There is a much, much larger universe of people who will make deployment
and implementation decisions, with varying attention span and degrees of
skill, and I think they're best served with a clean start of an unambiguous
version number. Just because it feels uncomfortable to us doesn't mean it
will feel uncomfortable to the larger technical/enterprise community who
don't really *care* about the versioning scheme, they just need to make
some decisions and move on.

-- Eric

---

From: Nick Sullivan <[email-masked]>
Date: Fri, 18 Nov 2016 23:04:31 +0000

If we decide to move to some numeral higher than 3 to avoid confusion, I
recommend *TLS 4*, but urge people to tell the story of the name in a way
that retains some sense of continuity and logic.

Here's a framing that makes sense:

*TLS 4 is the fourth version of TLS*
This framing will tell a positive message of progression, rather than
embody a condescending message such as "we gave it this name because people
aren't able to understand that TLS 1.3 is newer than SSL 3". It will also
immediately make sense to people who were exposed to the marketing around
Windows 7.

Without this framing, TLS 4 (or 4.0) will seem like a confusing choice.

(for the record, I'm still for TLS 1.3)

On Fri, Nov 18, 2016 at 11:13 AM Sean Turner <[email-masked]> wrote:

At IETF 97, the chairs lead a discussion to resolve whether the WG should
rebrand TLS1.3 to something else.  Slides can be found @
https://www.ietf.org/proceedings/97/slides/slides-97-tls-rebranding-aka-pr612-01.pdf
.

- Leave it TLS 1.3
- Rebrand TLS 2.0
- Rebrand TLS 2
- Rebrand TLS 4

by 2 December 2016.

Thanks,
J&S

---

From: David Adrian <[email-masked]>
Date: Sat, 19 Nov 2016 02:24:37 +0000

I recognize I don't participate on this list very often, but I also agree
with TLS 4.0 and Dan's argument. I teach an undergraduate security course
at Michigan; students have enough trouble keeping track of SSL vs TLS
versions as it is. Jumping to 4.0 allows us to end this versioning debacle
now.

---

From: Kazuho Oku <[email-masked]>
Date: Sat, 19 Nov 2016 11:30:57 +0900

> It seems like TLS 2 and TLS 2.0 have very little support, so it's really
I oppose to going to TLS 4, due to the following reasons:

* it might give people false notion that  SSL 2.0, 3.0 is superior to TLS
1.0-1.2
* if name the new protocol TLS 1.3, 2.0, or 2, then there would be no
confusion once SSL goes away. However, if we name the new version TLS 4,
then people would (for upcoming tens of years) continue to ask where TLS 2
and TLS 3.

-- 
Kazuho Oku

---

From: Peter Gutmann <[email-masked]>
Date: Sat, 19 Nov 2016 02:41:04 +0000

Replying to several messages at once to save space:

Ilari Liusvaara:

>One can downnegotiate TLS 1.3 to TLS 1.2.

Ah, you're obviously a fan of Steve Wozniak humour.  When someone asked him
whether it was possible to upgrade from an Apple II+ to an Apple IIe, he
similarly said "yes, you unplug the power cable from the II+, throw it away,
and plug the IIe into the newly-vacated power cable".

>I prefer TLS 1.3, because is signals continuity with the ongoing TLS

Maybe it's just me, but wouldn't the fact that they're both called TLS sort of
indicate that there's continuity there?

Dave Kern:

>I'm in favor of TLS 4, and ignoring the minor version number (in the friendly
>text string, not the protocol field) moving forward.

That's actually a good point, "TLS 4" provides a single, clean number for people
to remember.  Even a CTO or auditor should be able to get that one right without
having to look up a table in a book to see that 1.3 > v3.

Peter.

---

From: Peter Gutmann <[email-masked]>
Date: Sat, 19 Nov 2016 03:01:38 +0000

Vlad Krasnov <[email-masked]> writes:

>Second: I don’t think that the changes between TLS 1.3 and TLS 1.2 are
>considered a major: just look at the difference between HTTP/2 and HTTP/1 -
>those are completely different protocols.

So are TLS 1.x and "1.3".  It'd be interesting to hear from other implementers
on this, but my secure-tunnel code consists of a high-level framework that
handles things at an abstract level, client hello, server hello, keyex, keyex-
auth, finished, and subsequent stuff, and that's the same for both TLS and SSH
(I use TLS names for consistency, but SSH does the same things under its own
names).  The bit-bagging for the two is obviously quite different, but the
high-level handling is taken from the same code.

For "1.3" I looked at what it'd take to bolt it onto the side of the other 1.x
code and it'd end up as this weird hermaphrodite mixture with huge amounts of
effort devoted to trying to track whether it's meant to be acting as 1.x or
"1.3", with the accompanying opportunity for problems if I miss something and
drop from 1.x to "1.3" or the other way round.  The easiest way to implement
it is as a new protocol, trying to pretend that 1.x and "1.3" are the same
thing just leads to an implementation nightmare when you have to keep the two
distinct.

So at least from this implementation's point of view, they're different
protocols.

Peter.

---

From: David Woodhouse <[email-masked]>
Date: Fri, 18 Nov 2016 19:01:04 -0800

On Fri, 2016-11-18 at 13:19 -0800, Vlad Krasnov wrote:
> > Well, for example, your website has twice as many mentions of SSL
> > as TLS.  Why?  Why don't you have a product called "Universal TLS"?
> > The ratio is the same for letsencrypto.org. TLS 1.0 had already
> > existed for more then a decade before either place existed.  BTW,
> > at google, it's 20:1, and that's just google, not the web.  (Counts
> > were done in the obvious dumb way "site:letsencrypt.org tls" and
> > then with "ssl" and noting the summary stats at the top of the
> > return results.) 
> > 
> Well, if the result of the confusion would be people *disabling* TLS
> 1.* in favor of SSL 3.0, they would discover very quickly what is
> TLS, and why no major browser works for them.

We already have a bunch of confusion around "SSL" vs. "TLS". Many mail
clients seems to allow you to configure SMTP/IMAP servers to be
accessed over "SSL", which means TLS, or "TLS", which means it connects
in the clear and then negotiates an upgrade with STARTTLS.

-- 
dwmw2

---

From: Melinda Shore <[email-masked]>
Date: Fri, 18 Nov 2016 19:22:49 -0800

> In the end, it's just a label.

Well, there are some semantics to it - I think a label
can be more than just a label.

It occurred to me that it's guaranteed that if it's
rebranded as TLS 4 we'll have people showing up with
internet drafts proposing TLS 2 and 3, much like we've
got occasional proposals for IPv5 (or other various
versions).  That said, I figure that's only a problem
to the extent that calories are burned in response to
these proposals, and what will matter is whether or
not it's likely to lead systems administrators and
those bringing up services to make bad configuration
and deployment decisions.

Melinda

---

From: Ilari Liusvaara <[email-masked]>
Date: Sat, 19 Nov 2016 08:27:25 +0200

> and plug the IIe into the newly-vacated power cable".

Nope, I was referring to the very technical property that if client sends
a TLS 1.3 handshake, a TLS 1.2 server can still successfully interop,
provoded that the client does TLS 1.2 too (which I think every TLS client
known to support TLS 1.3 except Picotls does).

The last major version bump, SSLv2->SSLv3, this was NOT true. SSLv2
server would barf upon receiving SSLv3 client hello (TLS 1.0 was
clearly "SSL v3.1" internally).

And folks could think that kind of downnegotiation wasn't the case
given major version bump. Such would cause confusion much much worse
than confusing the ordering of TLS and SSL versions.

-Ilari

---

From: Victor Vasiliev <[email-masked]>
Date: Sat, 19 Nov 2016 01:35:41 -0500

> then people would (for upcoming tens of years) continue to ask where TLS 2
I very much agree with those points.

TLS 4 is a confusing name that, as far as I can tell, cannot actually make
things better.  Right now we have:

    SSL 2 -> SSL 3 -> TLS 1.0 -> TLS 1.1 -> TLS 1.2 -> TLS 1.3
 (1)

Now, some people may get confused by this because of the "SSL is TLS" idea,
but
once you learn that in reality "SSL is a thing that was before TLS", it does
make sense and seem fairly straightforward (a series of numbers under one
name,
followed by another series of numbers under the new name).

With TLS 4, we have:

    SSL 2 -> SSL 3 -> TLS 1.0 -> TLS 1.1 -> TLS 1.2 -> TLS 4
 (2)

This does has a nice property of indicating that TLS 4 is clearly the latest
version (as long as you know that SSL came before TLS), but omission of TLS
2
and TLS 3 will leave people confused, and most likely lead them to conclude
that what happened is TLS was renamed to SSL and then back again, so that

    TLS 1.0 -> TLS 1.1 -> TLS 1.2 -> SSL 2 -> SSL 3 -> TLS 4.
(3)

But this is not even the worst of the problems.

The real problem is that we can't actually rename TLS 1.3, because at the
end
we will merely create a new name for it.  It has already been TLS 1.3 for a
few
years, it has been discussed in the tech community as TLS 1.3, researchers
have
published papers about TLS 1.3, there's probably already the marketing
material
with TLS 1.3 out there.  The code that refers to it as TLS 1.3 will probably
end up being referring to it as 1.3 for approximately forever, even if all
the
implementers had been enthusiastic about renaming it, because refactoring is
high-cost and low-priority, and may not be even possible if you've already
exposed it via the ABI.  The old name will never die, and it will be a
burden
to anyone in this community, making confusing versioning scheme even more
confusing.  It will probably leak outside of it too, and instead of (2), we
will end up getting

    SSL 2 -> SSL 3 -> TLS 1.0 -> TLS 1.1 -> TLS 1.2 -> TLS 1.3 = TLS 4
 (4)

which seems strictly more confusing than (1) in any way.

tl;dr: the only way to minimze confusion at this point is to not change
anything.

---

From: Anders Rundgren <[email-masked]>
Date: Sat, 19 Nov 2016 07:49:29 +0100

On 2016-11-19 07:35, Victor Vasiliev wrote:
> On Fri, Nov 18, 2016 at 9:30 PM, Kazuho Oku <[email-masked] <mailto:[email-masked]>> wrote:
>
>     * it might give people false notion that  SSL 2.0, 3.0 is superior to TLS 1.0-1.2
>     * if name the new protocol TLS 1.3, 2.0, or 2, then there would be no confusion once SSL goes away. However, if we name the new version TLS 4, then people would (for upcoming tens of years) continue to ask where TLS 2 and TLS 3.

Windows 9 never made it to the public.  Hardly nobody complained.

If the TLS protocol you are working on is "Brand New" or is just an "Incremental Upgrade"
is more a matter of personal opinion than an absolute truth.  It is definitely a "Major Overhaul"
since every little bit of the protocol has been reviewed thoroughly.

TLS 4 seems OK to me.

Anders

>     SSL 2 -> SSL 3 -> TLS 1.0 -> TLS 1.1 -> TLS 1.2 -> TLS 1.3              (1)
>
> Now, some people may get confused by this because of the "SSL is TLS" idea, but
> make sense and seem fairly straightforward (a series of numbers under one name,
>     SSL 2 -> SSL 3 -> TLS 1.0 -> TLS 1.1 -> TLS 1.2 -> TLS 4                (2)
>
> version (as long as you know that SSL came before TLS), but omission of TLS 2
>     TLS 1.0 -> TLS 1.1 -> TLS 1.2 -> SSL 2 -> SSL 3 -> TLS 4.               (3)
>
> The real problem is that we can't actually rename TLS 1.3, because at the end
> we will merely create a new name for it.  It has already been TLS 1.3 for a few
> years, it has been discussed in the tech community as TLS 1.3, researchers have
> published papers about TLS 1.3, there's probably already the marketing material
> end up being referring to it as 1.3 for approximately forever, even if all the
> exposed it via the ABI.  The old name will never die, and it will be a burden
>     SSL 2 -> SSL 3 -> TLS 1.0 -> TLS 1.1 -> TLS 1.2 -> TLS 1.3 = TLS 4      (4)
>

---

From: Jeffrey Walton <[email-masked]>
Date: Sat, 19 Nov 2016 06:32:06 -0500

> The consensus in the room was to leave it as is, i.e., TLS1.3, and to not rebrand it to TLS 2.0, TLS 2, or TLS 4.  We need to confirm this decision on the list so please let the list know your top…

Please forgive my ignorance...

Who are you targeting for the versioning scheme? Regular users? Mom
and pop shops with a web presence? Tech guys and gals? Security folks?

For most tech people and security folks, I don't think it matters
much. However, how many regular users would have clung to SSLv3 and
TLS 1.0 (given TLS 1.2 was available) if they were named SSL 1995 and
TLS 1999 (given TLS 2008 or TLS 2010 was available)?

(Sorry to violate the Hum restriction).

Jeff

---

From: Viktor Dukhovni <[email-masked]>
Date: Sat, 19 Nov 2016 11:40:25 +0000

On Sat, Nov 19, 2016 at 01:35:41AM -0500, Victor Vasiliev wrote:

> Now, some people may get confused by this because of the "SSL is TLS"
> idea, but once you learn that in reality "SSL is a thing that was before
> TLS", it does make sense and seem fairly straightforward (a series of
> numbers under one name, followed by another series of numbers under the
> new name).

This feels like a contrived and speculative argument, backed by no
evidence.  There is on the other hand actual user confusion with
the current numbers.  

We should not rationalize personal preferences with plausible, and
yet non-factual arguments.  It is fine to just state a preference.
If a majority of the WG prefers the status quo because 3 is a
Gaussian prime, and 4 is bad karma in China (*), then that's
sufficient, the reasons don't actually have to be rational.

-- 
	Viktor.

(*) Some decades back, shortly before the hand-over of Hong-Kong
to China, there was a property boomlet in Melbourne, and IIRC some
streets sprouted houses numbered 3+1/2...

---

From: Peter Gutmann <[email-masked]>
Date: Sat, 19 Nov 2016 11:51:18 +0000

Viktor Dukhovni <[email-masked]> writes:

>If a majority of the WG prefers the status quo because 3 is a Gaussian prime,
>and 4 is bad karma in China

Just as long as we don't end up going for version 8888.

Peter.

---

From: Peter Gutmann <[email-masked]>
Date: Sat, 19 Nov 2016 11:56:11 +0000

Ilari Liusvaara <[email-masked]> writes:

>Nope, I was referring to the very technical property that if client sends a
>TLS 1.3 handshake, a TLS 1.2 server can still successfully interop, provoded
>that the client does TLS 1.2 too

That's like saying that PGP and S/MIME are compatible because if a client
sends a PGP message, a MIME-enabled server can still successfully interop
provided the S/MIME server does PGP too.

Anyway, it's a silly debate (as my Wozniak joke tried to point out), so I'll bow 
out now.

Peter.

---

From: Ira McDonald <[email-masked]>
Date: Sat, 19 Nov 2016 08:31:07 -0500

Hi,

I think that the presumption that most tech people (or even security people)
won't have any trouble with the future version numbering of TLS is wrong.

Yesterday morning, on an SAE Vehicle Electrical Systems Security call with
some 40 auto security professionals present, I mentioned that TLS 1.3 was
wrapping up and was asked "What's TLS?"  Usual explanation about SSL
being succeeded by IETF TLS 17 years ago.  Several responses that were
the equivalent of blank stares.  And finally, "Then why is the library still
called OpenSSL?"

Rich has highlighted that the tech community goes right on conflating SSL
with TLS on web sites.

I change my two cents to "TLS 4" but am unsure about "4" or "4.0" because
the tech community has been trained to care about major.minor.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions WG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: [email-masked]
Jan-April: 579 Park Place  Saline, MI  48176  734-944-0094
May-Dec: PO Box 221  Grand Marais, MI 49839  906-494-2434

---

From: Vlad Krasnov <[email-masked]>
Date: Sat, 19 Nov 2016 08:28:41 -0800

"Then why is the library still
> called OpenSSL?"

All those arguments show basic confusion of what TLS is. Version numbers won't help solve that. 

Only going back to using the SSL name might.

---

From: Steven Valdez <[email-masked]>
Date: Sat, 19 Nov 2016 16:39:45 +0000

Maintaining my hum from the meeting, I prefer keeping TLS 1.3 over
renaming, primarily because there's now a good amount of
documentation/implementation in the wild that refers to TLS 1.3, and we'll
need to keep around the new equivalence of TLS 2 (or 4)=TLS 1.3.

---

From: Judson Wilson <[email-masked]>
Date: Sat, 19 Nov 2016 09:46:05 -0800

What Jeff said makes a ton of sense to me.

"TLS 2017" would solve the problems that "TLS 4 solves," without being
confusing, and with the added benefit that the age is painfully obvious.  I
see big wins all around.

The downsides I see are that there is no major/minor distinction, and it
would be hard to have 2 versions in a year - but I think both are small
issues.

---

From: Watson Ladd <[email-masked]>
Date: Sat, 19 Nov 2016 10:55:22 -0800

Rebrand 4. There is no reason not to.

---

From: "D. J. Bernstein" <[email-masked]>
Date: 21 Nov 2016 00:56:12 -0000

The messages on the list seem to be perfectly split between "TLS 1.3"
and "TLS 4". I suspect that the "TLS 2017" idea will break this impasse:

   * it shares the fundamental advantage that led to the "TLS 4" idea;
   * it has the additional advantage of making the age obvious;
   * it eliminates the "4 sounds too much like 3" complaint; and
   * it eliminates the "where are TLS 2 and TLS 3?" complaint.

Perhaps it's worth starting a poll specifically between "TLS 1.3" and
"TLS 2017"? Or at least asking whether the new "TLS 2017" option would
swing some previous opinions?

Of course people who prioritize retaining the existing "TLS 1.3"
mindshare will be just as unhappy with "TLS 2017" as with "TLS 4", but
they'll get over it within a few years. :-)

---Dan

---

From: Eric Rescorla <[email-masked]>
Date: Sun, 20 Nov 2016 17:16:07 -0800

I mildly prefer TLS 1.3 to TLS 2 and TLS 4 (If we're going to rev the major
version number we should abandon the minor one).
TLS 2017 strikes me as quite bad; we're certainly not planning to do a TLS
2018. I am strongly opposed to TLS 2017.

-Ekr

---

From: Bill Frantz <[email-masked]>
Date: Sun, 20 Nov 2016 18:55:28 -0800

>they'll get over it within a few years. :-)

The Ecmascript standards body, TC39 has moved to year === 
version. It seems to work well for them.

I don't think that using a year means that there will be a new 
standard every year.

In the unlikely event that there is a standard bug bad enough to 
need a second standard in one year, decimal version(s) could be 
used e.g 2017.1.  It would be understandable and act as 
punishment for us who screwed up.

Cheers - Bill

-----------------------------------------------------------------------
Bill Frantz        | Concurrency is hard. 12 out  | Periwinkle
(408)356-8506      | 10 programmers get it wrong. | 16345 
Englewood Ave
www.pwpconsult.com |                - Jeff Frantz | Los Gatos, 
CA 95032

---

From: Xiaoyin Liu <[email-masked]>
Date: Mon, 21 Nov 2016 03:44:44 +0000

+1 for “TLS 2017” for all the four reasons given in the proposal.

My overall preference is TLS 2017 > TLS 4 > TLS 2 or 2.0 > TLS 1.3.

Best,

Xiaoyin

From: D. J. Bernstein<mailto:[email-masked]>
Sent: Sunday, November 20, 2016 7:56 PM
To: [email-masked]<mailto:[email-masked]>
Subject: Re: [TLS] Confirming consensus: TLS1.3->TLS*

---Dan

---

From: Mark Nottingham <[email-masked]>
Date: Mon, 21 Nov 2016 15:18:56 +1100

I give the chairs my full support for whatever colour they wish to paint this bikeshed.

> On 18 Nov. 2016, at 1:12 pm, Sean Turner <[email-masked]> wrote:
> 

--
Mark Nottingham   https://www.mnot.net/

---

From: Viktor Dukhovni <[email-masked]>
Date: Sun, 20 Nov 2016 23:26:42 -0500

> On Nov 20, 2016, at 7:56 PM, D. J. Bernstein <[email-masked]> wrote:
> 

This worked well enough for IDNA2003 and IDNA2008 (the latter was
finally published in 2010, and even that is not a problem).

So I can get behind TLS 2017.  I had even considered suggesting it,
but did not at the time want to add more options to the mix.

I think the risk of two TLS standards published in a single year
is vanishingly low.  And see no problems with "gaps" in the numbers.

-- 
	Viktor.

---

From: Andrey Jivsov <[email-masked]>
Date: Mon, 21 Nov 2016 01:03:47 -0800

> The consensus in the room was to leave it as is, i.e., TLS1.3, and to not rebrand it to TLS 2.0, TLS 2, or TLS 4.  We need to confirm this decision on the list so please let the list know your top…
...

TLS 4.

TLS 1.3 introduces major changes to message flow and substantial 
redesign of crypto.

I will respectfully remind that earlier this year the WG has made a 
decision to break backward compatibility with large number of devices by 
rejecting an option to extend allowed in TLS 1.3 RSA PKCS#1.5 signature 
padding scheme to all portions of the handshake. The solution was that 
these peers must keep using TLS 1.2 
https://www.ietf.org/mail-archive/web/tls/current/msg19360.html .

Changes of this magnitude are not typically associated with a "dot" 
release.

+ what other said on confusion with SSL. I don't see this one as a big 
deal, but I will go with the consensus of "4.0" v.s "2.0". "1.3" is the 
worst choice here.

---

From: Andrei Popov <[email-masked]>
Date: Mon, 21 Nov 2016 18:23:20 +0000

Peter has some excellent points here (although I would prefer "TLS 2.0").

Perhaps the "re-branders" are losing votes and hums because we're fragmented into numerous camps.

With this in mind, I'm voting in favor of any re-branding of TLS 1.3 where the protocol name remains "TLS" and major version becomes > 1.

Cheers,

Andrei

-----Original Message-----
From: TLS [mailto:[email-masked]] On Behalf Of Peter Gutmann
Sent: Friday, November 18, 2016 6:41 PM
To: Ilari Liusvaara <[email-masked]>
Cc: <[email-masked]> <[email-masked]>
Subject: Re: [TLS] Confirming consensus: TLS1.3->TLS*

>One can downnegotiate TLS 1.3 to TLS 1.2.

Ah, you're obviously a fan of Steve Wozniak humour.  When someone asked him whether it was possible to upgrade from an Apple II+ to an Apple IIe, he similarly said "yes, you unplug the power cable from the II+, throw it away, and plug the IIe into the newly-vacated power cable".

>I prefer TLS 1.3, because is signals continuity with the ongoing TLS 

Maybe it's just me, but wouldn't the fact that they're both called TLS sort of indicate that there's continuity there?

Dave Kern:

>I'm in favor of TLS 4, and ignoring the minor version number (in the 
>friendly text string, not the protocol field) moving forward.

That's actually a good point, "TLS 4" provides a single, clean number for people to remember.  Even a CTO or auditor should be able to get that one right without having to look up a table in a book to see that 1.3 > v3.

Peter.

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 21 Nov 2016 18:43:30 +0000

> With this in mind, I'm voting in favor of any re-branding of TLS 1.3 where the
> protocol name remains "TLS" and major version becomes > 1.

Me too.

---

From: Dmitry Belyavsky <[email-masked]>
Date: Mon, 21 Nov 2016 21:45:09 +0300

Hello,

-- 
SY, Dmitry Belyavsky

---

From: [email-masked]
Date: Mon, 21 Nov 2016 13:02:52 -0600

Hello,

> protocol name remains "TLS" and major version becomes > 1.

I originally hummed for 1.3 in the room as that is what people (that are 
currently aware of it) know it by.  However, as the new standard goes out 
into the world, a major revision number seems appropriate to recognize the 
significant changes that have gone into it. 

+1
Darin Pettis

U.S. BANCORP made the following annotations
---------------------------------------------------------------------
Electronic Privacy Notice. This e-mail, and any attachments, contains information that is, or may be, covered by electronic communications privacy laws, and is also confidential and proprietary in nature. If you are not the intended recipient, please be advised that you are legally prohibited from retaining, using, copying, distributing, or otherwise disclosing this information in any manner. Instead, please reply to the sender that you have received this communication in error, and then immediately delete it. Thank you in advance for your cooperation.

---------------------------------------------------------------------

---

From: Yoav Nir <[email-masked]>
Date: Mon, 21 Nov 2016 21:51:08 +0200

> On 21 Nov 2016, at 20:43, Salz, Rich <[email-masked]> wrote:
> 
> 

Agree

---

From: "Short, Todd" <[email-masked]>
Date: Mon, 21 Nov 2016 20:02:18 +0000

Throwing my hat into the ring, the basic record protocol has not changed.

If anything, what is currently referred to as TLSv1.3 is really just a major update to the handshake messages.

If the record protocol were to change to use a sane 4-byte header (which I proposed many months ago), then I think that calling it TLSv4 or equivalent would be appropriate.

At this point, I’d prefer to keep it TLSv1.3, since I don’t consider this a significant update to the protocol.
--
-Todd Short
// [email-masked]<mailto:[email-masked]>
// "One if by land, two if by sea, three if by the Internet."

On Nov 21, 2016, at 2:51 PM, Yoav Nir <[email-masked]<mailto:[email-masked]>> wrote:

On 21 Nov 2016, at 20:43, Salz, Rich <[email-masked]<mailto:[email-masked]>> wrote:

Me too.

Agree

_______________________________________________
TLS mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/tls

---

From: Sean Leonard <[email-masked]>
Date: Mon, 21 Nov 2016 12:13:35 -0800

+1 to TLS 1.3. My strong preference is TLS 1.3.

Reasons have been advanced ad-nauseam.

Just a couple of additional thoughts:
1.3 is in the protocol. So there.
"Perl 6". Just because you advance a version number to a big one, 
doesn't mean that businesses will see the justification to upgrade.

Sean

---

From: Richard Barnes <[email-masked]>
Date: Mon, 21 Nov 2016 15:13:44 -0500

> >> protocol name remains "TLS" and major version becomes > 1.

I can live with this approach, though if we go this way, I would have a
strong preference for 4, as the minimum change that gets us clear of the
SSL version numbers.

That said, I still think 1.3 is the most sensible option.  Regardless of
what we do here, we're still going to have to struggle with "N > 1.2 > 1.1
> 1.0 > 3.0" for a long time.  The only decision we've got here is which
additional exasperating conversation we want to have in the future, "Yes, N
is the one that comes after 1.2", or "Yes, 1.3 > 3.0".  Might as well stick
with the one we've been having all along anyway.

--Richard

---

From: Scott Schmit <[email-masked]>
Date: Tue, 22 Nov 2016 10:04:48 -0500

> The consensus in the room was to leave it as is, i.e., TLS1.3, and to not rebrand it to TLS 2.0, TLS 2, or TLS 4.  We need to confirm this decision on the list so please let the list know your top…

I find it compelling that if we lived in an alternate universe where we
had SSL 1996, TLS 1999, and a recently-published TLS 2006 or TLS 2008,
there would have been a lot less inertia about switching to a later
version.  I find is very optimistic given our history that we could
manage two TLS versions in a year.  If that ever happened, though, we
could do 2019.1 (as an increment) or 2019.11 (for the month).

Barring that, I'd prefer TLS 4, since that gets us out of the version
confusion swamp.  It would seem that almost nobody outside the security
community understands the distinction between SSL and TLS; so if we call
it TLS 4, we'll probably see it referred to as SSLv4.  And that wouldn't
be horrible.  If we call it TLS 2 or TLS 2.0, some might refer to it as
SSLv2.  That would obviously be very bad.

While it's nice to able to look up information about TLS 1.3 drafts,
most of that information is going to be inaccurate anyway, so I don't
see that as a compelling reason to stick to it.  Granted, you have
specific buzz for "TLS 1.3 is going to really improve things" but that's
fairly easy to translate to "the new version of TLS is going to really
improve things".

The distinction between 2 vs 2.0 seems pretty minor.  SSLv2 is 2.0 and
SSLv3 is 3.0, but few write it that way.

Thus my ranked preference would be:

TLS 2017 > TLS 4 > TLS 1.3 > TLS 2 or TLS 2.0

But if I'm limited to a top choice from the list, then "Rebrand TLS 4"

-- 
Scott Schmit

---

From: Daniel Migault <[email-masked]>
Date: Tue, 22 Nov 2016 10:55:25 -0500

I have a small preference for TLS 1.3.

---

From: Dave Garrett <[email-masked]>
Date: Tue, 22 Nov 2016 17:06:50 -0500

(replies to a bunch of ideas in this thread)

As the person who lit the match under this latest bikeshed debate, personally, I don't see a strong consensus building here. Leaving the bikeshed unpainted seems like the option we're headed for, at this rate. I'm fine with TLS 1.3 if that's the result here.

That said, I think I've been somewhat swayed to the TLS 4 camp with the "fourth version of TLS" message. It makes a kind of messy sense that's kind of fitting for TLS. I'm no longer against it.

I've also suggested highlighting the year in the past, but only in the context of the title and messaging, not actually replacing the version number itself. I'd be ok with TLS 1.3-2017 (or something), not doing a find/replace of 1.3 and changing it to 2017, wholesale. That just feels even more confusing.

Lastly, I am vehemently against the suggestion of ditching the TLS name in favor of SSL again, as was also brought up in this thread. SSL is dead and insecure, and that message needs to stay. We need to get people to stop conflating the two and making this worse, not accepting it.

Dave

---

From: Anders Rundgren <[email-masked]>
Date: Wed, 23 Nov 2016 05:40:52 +0100

Using the YEAR as Version was created to make sure that users having old versions
of products that are constantly upgraded would feel the pressure to upgrade.

This idea doesn't seem equally suitable for security protocols.

TLS 4 would IMO be a logical choice since it is numerically higher than all its predecessors.

Anders

---

From: Dan Brown <[email-masked]>
Date: Fri, 25 Nov 2016 14:43:32 +0000

I don't oppose any of the 4 given options, but I slightly prefer TLS 2.0, it seems simple and clear.  

In my opinion, the whole SSL vs TLS confusion needs better education to confront, version numbers (even dates) alone might not be enough.  Renaming *SSL products to *TLS should help.  Avoiding "SSL/TLS" might help.

Since others have proposed new options, how about TLS 2.017? Using the date has benefits, but the actual crypto changes are much more important, so the decimal makes that point.  An old crypto principle is that older is better (among equally unbroken options) -- but naming new stuff is just not enough to rid us of broken old stuff, so putting dates in names might not undermine this principle.  For future naming, on minor changes (or even pre-scheduled reviews with no changes), update the date part, on major changes, start from scratch (as in 3.2024, or even use different letters ... ).  

By the way, I'm sorry if my opinion diverges from the currently forming consensus.

Just my $0.02.
  
Dan

PS Just to be clear, if votes are to be tallied, my vote on this issue should be weighted quite low (i.e. 0, unless other votes are weighted low too, and some kind of tie-breaker is needed), for at least three reasons: I have not followed the TLS 1.3/2.0 spec closely (i.e., I had no part in building the shed); I have nearly zero experience dealing with user interpretation (i.e. marketing) of protocol names; my preference is weak. (Enough to deserve a negative weight, if that were not cheatable;)

PPS I've said before that I prefer TLC(rypto) to TLS(ecurity), but that's unlikely to fly, and it may be okay to grandfather this tradition.  (I hope names of future crypto protocols (that TLS WG might work on) can be more specific and realistic.)

-----Original Message-----
From: TLS [mailto:[email-masked]] On Behalf Of Dave Garrett
Sent: Tuesday, November 22, 2016 5:07 PM
To: [email-masked]
Subject: Re: [TLS] Confirming consensus: TLS1.3->TLS*

Dave

On Sunday, November 20, 2016 08:16:07 pm Eric Rescorla wrote:
> I mildly prefer TLS 1.3 to TLS 2 and TLS 4 (If we're going to rev the 
> major version number we should abandon the minor one).
> TLS 2017 strikes me as quite bad; we're certainly not planning to do a 
> TLS 2018. I am strongly opposed to TLS 2017.
> 
> -Ekr
> 
> 
> > this decision on the list so please let the list know your top choice between:
> >
> > - Leave it TLS 1.3
> > - Rebrand TLS 2.0
> > - Rebrand TLS 2
> > - Rebrand TLS 4
> >
> > by 2 December 2016.

---

From: Timothy Jackson <[email-masked]>
Date: Mon, 28 Nov 2016 20:09:34 +0000

At this point, my personal opinion is to move on from TLS 1.3 to either TLS 4/4.0 or TLS 2017.

After 15 years, everyone but us still calls it SSL. We need to admit that we lost the marketing battle and plan for a world where everyone calls “TLS X” “SSL X”. Even “new” implementations call themselves “LibreSSL” and “BoringSSL” rather than “LibreTLS” or “BoringTLS”.

As SSL is removed from products, we’re likely to get more and more questions “why am I using SSL 1.2, when I thought SSL 3 was broken?” This is a *legitimate* question by a user who is educated enough to know that “SSL 3 is bad” but has more important things to remember than the distinction between SSL and TLS. As others have noted, TLS 4 fixes this when users call it SSL 4, which they definitely will.

Tim

On 11/25/16, 6:43 AM, "TLS on behalf of Dan Brown" <[email-masked] on behalf of [email-masked]> wrote:

    

    Just my $0.02.
      
    Dan

    
    -----Original Message-----
    From: TLS [mailto:[email-masked]] On Behalf Of Dave Garrett
    Sent: Tuesday, November 22, 2016 5:07 PM
    To: [email-masked]
    Subject: Re: [TLS] Confirming consensus: TLS1.3->TLS*

    

    Dave

    On Sunday, November 20, 2016 08:16:07 pm Eric Rescorla wrote:
    > > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_proceedings_97_slides_slides-2D&d=DwICAg&c=N0Urj2691w_G_RMcId8BFO255JhwY1mUG9mQ4wCsdg4&r=NdXACqSCqnic2vXFj2sB1wqEOVaLJ9XgezFa4hmJAmA&m=aVqgPEkStnO8wlSeHRSGdkuqYUHHonOaRl-oH5L2N2A&s=6yJGiNGx2nAPsm7AaZ_G7L5Z-k0foqrnehHcwnU5MiA&e= 
    
    _______________________________________________
    TLS mailing list
    [email-masked]
    https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_tls&d=DwICAg&c=N0Urj2691w_G_RMcId8BFO255JhwY1mUG9mQ4wCsdg4&r=NdXACqSCqnic2vXFj2sB1wqEOVaLJ9XgezFa4hmJAmA&m=aVqgPEkStnO8wlSeHRSGdkuqYUHHonOaRl-oH5L2N2A&s=oqBj-oNvpxDdH_qaCCDu75ozyncsIX4lYcBXHhHUecI&e= 
    
    _______________________________________________
    TLS mailing list
    [email-masked]
    https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_tls&d=DwICAg&c=N0Urj2691w_G_RMcId8BFO255JhwY1mUG9mQ4wCsdg4&r=NdXACqSCqnic2vXFj2sB1wqEOVaLJ9XgezFa4hmJAmA&m=aVqgPEkStnO8wlSeHRSGdkuqYUHHonOaRl-oH5L2N2A&s=oqBj-oNvpxDdH_qaCCDu75ozyncsIX4lYcBXHhHUecI&e=

---

From: Raja ashok <[email-masked]>
Date: Tue, 29 Nov 2016 13:47:23 +0000

I feel we can go ahead with TLS 1.3.

Or else TLS 3.4, because anyway we send 0x0304 on wire for TLS 1.3.

I hope all other three options (TLS 2.0, TLS 2 and TLS 4) will make confusion with SSL versions for end user.

________________________________
Raja Ashok VK
华为技术有限公司 Huawei Technologies Co., Ltd.
[Company_logo]

Phone:
Fax:
Mobile:
Email:
Huawei Technologies Co., Ltd.
Bangalore, India
http://www.huawei.com
________________________________
本邮件及其附件含有华为公司的保密信息，仅限于发送给上面地址中列出的个人或群组。禁
止任何其他人以任何形式使用（包括但不限于全部或部分地泄露、复制、或散发）本邮件中
的信息。如果您错收了本邮件，请您立即电话或邮件通知发件人并删除本邮件！
This e-mail and its attachments contain confidential information from HUAWEI, which
is intended only for the person or entity whose address is listed above. Any use of the
information contained herein in any way (including, but not limited to, total or partial
disclosure, reproduction, or dissemination) by persons other than the intended
recipient(s) is prohibited. If you receive this e-mail in error, please notify the sender by
phone or email immediately and delete it!

-----Original Message-----
From: TLS [mailto:[email-masked]] On Behalf Of Sean Turner
Sent: 18 November 2016 07:43
To: <[email-masked]>
Subject: [TLS] Confirming consensus: TLS1.3->TLS*

- Leave it TLS 1.3

- Rebrand TLS 2.0

- Rebrand TLS 2

- Rebrand TLS 4

by 2 December 2016.

Thanks,

J&S

TLS mailing list

---

From: Nick Sullivan <[email-masked]>
Date: Thu, 01 Dec 2016 01:46:47 +0000

I took a very unofficial Twitter poll on this subject:
https://twitter.com/grittygrease/status/803644086666215424

Nick

On Tue, Nov 29, 2016 at 5:47 AM Raja ashok <[email-masked]> wrote:

> I hope all other three options (TLS 2.0, TLS 2 and TLS 4) will make
> confusion with SSL versions for end user.
>
>
> ------------------------------
>
> Raja Ashok VK
> ------------------------------
>

---

From: Peter Gutmann <[email-masked]>
Date: Thu, 1 Dec 2016 04:28:24 +0000

>https://twitter.com/grittygrease/status/803644086666215424

Given the lack of context for the question (an out-of-the-blue query
to a random bunch of people on Twitter), I think the inevitable TLSy 
McTLSface (given as Crypty McCryptFace in one response) is kind of 
representative of the quality of responses...

I actually completely agree with Timothy Jackson's recent posting:

  After 15 years, everyone but us still calls it SSL. We need to 
  admit that we lost the marketing battle and plan for a world where 
  everyone calls “TLS X” “SSL X”. Even “new” implementations call 
  themselves “LibreSSL” and “BoringSSL” rather than “LibreTLS” or 
  “BoringTLS”.

Spurred by that, I've been watching out for any uses of $protocol-
name that I come across in news, books, journals, blogs, whatever.
It's pretty clear cut: What we call TLS, the rest of the world calls
SSL.  The only place where it was referred to specifically as TLS
was in IETF WG postings and in conference papers.  To the rest of
the world, the protocol is SSL.  So given that the world will know 
it as SSL <something>, it had better have a number that makes 
explicit what precedence it takes, either 4 or 2017.  Whatever it
is, it needs to be something that can be ranked against "SSL" and
"SSL 3" and be an obvious improvement.

Peter.

---

From: Viktor Dukhovni <[email-masked]>
Date: Wed, 30 Nov 2016 23:43:38 -0500

> On Nov 30, 2016, at 11:28 PM, Peter Gutmann <[email-masked]> wrote:
> 

I'll drink to that!

I also find it amusing that muttered under one's breath, with just
a touch of voicing on the "s" sounds, SSL sounds rather like "azazel",
which seems rather apt:

  https://en.wikipedia.org/wiki/Azazel

-- 
	Viktor.