Subject: Re: [TLS] Confirming consensus: TLS1.3->TLS*

From: =JeffH <[email-masked]>
Date: Mon, 21 Nov 2016 11:14:33 -0800

In the room last week, I hummed for "TLS 4".

that said, I overall agree with Andrei's sentiment..

 > I'm voting in favor of any re-branding of TLS 1.3 where the
 > protocol name remains "TLS" and major version becomes > 1.

HTH,

=JeffH

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 21 Nov 2016 19:34:03 +0000

Do "about:config" in firefox and look for TLS:
	security.tls.version.max     default   integer  3

And then perhaps look at http://kb.mozillazine.org/Security.tls.version.* (yes the star is part of the URL)

EVEN MOZILLA can't get it "right."

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 21 Nov 2016 12:00:14 -0800

> EVEN MOZILLA can't get it "right."

You should be reluctant to draw too many conclusions from a field which you
can only
access by clicking through a big scary warning that you are voiding your
warranty:

https://techjourney.net/media/2015/03/firefox-about-config-warning.png

-Ekr

>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: David Woodhouse <[email-masked]>
Date: Mon, 21 Nov 2016 20:20:17 +0000

> EVEN MOZILLA can't get it "right."

What's wrong with that? On a version of Firefox which supports only up
to TLSv1.2, the default setting of security.tls.version.max is 3 (i.e.
TLSv1.2). Which seems reasonable enough.

If you update to a hypothetical newer version of Firefox+NSS which
supports a newer version of TLS, presumably the default value of
security.tls.version.max will be 4, and will take effect unless you've
manually set it to any other value in your own local config.

-- 
dwmw2

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 21 Nov 2016 20:33:10 +0000

➢ You should be reluctant to draw too many conclusions from a field which you can only access by clicking through a big scary warning that you are voiding your warranty:

Warranty?

And sure, users never click through security warnings ☺

At any rate, this was intended to be a little light-hearted, but might have rubbed some folks the wrong way.  Sorry ‘bout that.

---

From: Hugo Krawczyk <[email-masked]>
Date: Mon, 21 Nov 2016 17:39:39 -0500

If it wasn't because we don't need more noise in this discussion I would
have suggested SSL 5.0 which seems to be the logical conclusion from the
reasoning people are using. Clearly, everyone thinks that the battle of
replacing "SSL" with "TLS" in the popular and technical references to the
standard has been lost and there is not much hope to win it in the future.
So if the mountain won't come to  Muhammad then go back to SSL and call it
SSL 5.0 leaving SSL 4.0 as an historic parallel/re-naming of TLS 1.0. (Also
note that the two 'S' of SSL already hint to the number 5 and L is 50 in
Roman numerals.)

On a more serious note, I would keep a minor option in whatever is chosen
(e.g. 4.0). The reason is that I can see more resistance in the future to
minor revisions if such revision needs to be called TLS 5 rather than 4.1.
However, minor but crucial revisions may be needed sooner than one hopes
for and delaying them for when more changes are accumulated is not a good
thing.

Hugo