Subject: Re: [TLS] Fwd: New Version Notification for draft-moriarty-tls-oldversions-diediedie-00.txt

From: Artyom Gavrichenkov <[email-masked]>
Date: Sun, 19 Aug 2018 02:45:33 +0300

On Mon, Jul 9, 2018 at 7:42 PM Kathleen Moriarty
<[email-masked]> wrote:
> Stephen and I posted the draft below to see if the TLS working group
> is ready to take steps to deprecate TLSv1.0 and TLSv1.1.  There has
> been a recent drop off in usage for web applications due to the PCI
> Council recommendation to move off TLSv1.0, with a recommendation to
> go to TLSv1.2 by June 30th.

Err, sorry, but – to make it one hundred per cent correct – it seems
like PCI SSC has just deprecated TLS v1.0 _only_.

"Migrating from SSL and Early TLS", version 1.1:
"The best response is to disable SSL entirely and migrate to a more
modern encryption protocol, which at the time of publication is a
minimum of TLS v1.1"
https://www.pcisecuritystandards.org/documents/Migrating-from-SSL-Early-TLS-Info-Supp-v1_1.pdf

draft-moriarty-diediedie also mentions PCI SSC requirements. Do I get
anything wrong here?

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 19 Aug 2018 01:01:40 +0100

Hiya,

Thanks for reading the draft!

> draft-moriarty-diediedie also mentions PCI SSC requirements. Do I get

Well, two comments:

1. The bit you quote above is incomplete, the full paragraph says
"The best response is to disable SSL entirely and migrate to a more
modern encryption protocol, which at the time of publication is a
minimum of TLS v1.1, although entities are strongly encouraged to
consider TLS v1.2.  Note that not all implementations of TLS v1.1
are considered secure – refer to NIST SP 800-52 rev 1 for guidance
on secure TLS configurations." So there's already a strong hint
in PCI-land to GOTO TLSv1.2+.

2. Use of TLSv1.1 seems to be almost non-existent. See the figures
in the -01 draft for some detail, (and more data is always welcome).
It seems like there's more already-deprecated SSL than there is
TLSv1.1 which I think means that this is really a non-issue.

I guess there could be a formal but theoretical problem resulting
from this, but OTOH, if (or when) the IETF finished an RFC based
on this draft deprecating these legacy versions then PCI folks can
catch up, and without that affecting pretty much anyone, so I'd say,
in this case, it's likely ok to just ignore this slight discrepancy.
But if you've some text change to suggest that'd handle it better,
that'd be great to see.

Cheers,
S.

> 
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Artyom Gavrichenkov <[email-masked]>
Date: Mon, 20 Aug 2018 00:22:59 +0300

Good day!

On Sun, Aug 19, 2018 at 3:01 AM Stephen Farrell
<[email-masked]> wrote:
> 1. The bit you quote above is incomplete

Yep, but the rest of the paragraph just outlines *recommendations*
(or, even better, 'encouragements') while the draft states that "PCI
Council [is] deprecating TLSv1.0 and TLSv1.1 by June 30, 2018".

In the PCI world, *deprecation* is commonly thought to be a
*requirement*, not a recommendation. It is *not recommended* to use
TLSv1.1 (and TLSv1.2) already just by virtue of fact that a more
up-to-date spec version exists.

My point here is that this wording is not, strictly speaking, correct
-- so far, as a matter of fact.

(In fact, PCI DSS even still allows usage of SSLv3 under certain
circumstances -- e.g. POS/POI, -- but said circumstances are strict
enough for us to conveniently omit mentioning those).

> in the -01 draft for some detail [..]

Maybe, but this is irrelevant to the concern I've raised. If you want
PCI SSC to deprecate TLSv1.1 just because enterprise networks are not
using it, the right way to do it is to share the data with the SSC
along with the research methodology and let them decide.

By the way, at least one issue with the research data referred to in
draft-diediedie-01 which I'm aware of is that the researchers were
hunting for open 443/tcp port only, while the enterprises have a
practice to move deprecated services those enterprises somehow cannot
get rid of to different ports, like, 4443, 4433, 8443 and so on.

To make it absolutely clear, I'm not criticizing the methodology now,
however, I just want to raise a concern that if PCI SSC somehow
decided to deprecate v1.0 (far ahead of IETF) but still keep v1.1
then, *maybe*, they had at some point in time a strong reason to do
so. It's entirely fine to ignore their preferences and let PCI SSC
'catch up' without quoting themselves as a reference, or, vice versa,
it's okay to quote the SSC while sticking to their actual suggestions.

Just in case, I'm not in any way against the draft-diediedie. I
support it, which is why I've voted for the WG adoption before posting
this to the mailing list. I'm just a nerd who wants the document to be
consistent for that matter, and that's it.

--
Töma