Subject: Re: [TLS] Deprecating TLS 1.3 (was SSL v3.0)

From: Watson Ladd <[email-masked]>
Date: Fri, 21 Nov 2014 07:51:11 -0800

On Fri, Nov 21, 2014 at 7:43 AM, Nikos Mavrogiannopoulos
<[email-masked]> wrote:
> On Sun, 2014-11-16 at 23:22 +0100, Alfredo Pironti wrote:
>
>
>> Yes, I agree this is a fair point. I'll complete the wording tomorrow
>> in the pending PR, and these ideas will get into the updated version.
>
> Some additional comments:
> 1. It has quite awkward structure. The main body of the document is at
> the introduction section.
>
> 2. The text "Negotiation of SSLv3 from any version of TLS MUST NOT be
> permitted."
> Not sure I understand what it means. Does it mean that fallback to SSL
> 3.0 from any version of TLS MUST NOT be permitted?
>
> 3. The document doesn't provide any instructions for clients that have
> no other way to communicate with a server that only supports SSL 3.0.
> MUST NOT is nice in theory, but can only be enforced on the systems one
> has control on, and if the advise is followed to the letter legacy
> systems (not talking of web) will be only be accessible in plaintext.
> I'd expect prohibiting the fallback dance instead, and requiring that
> SSL 3.0 is negotiated only if TLS 1.0 or later are advertised in the
> clientHello.

Let this be a moral: it never matters how broken a protocol is,
someone, somewhere, will resist turning it off.

We need to get TLS 1.3 right. But I don't think taking a hacksaw to
TLS 1.2 helps with that nearly as much as everyone seems to think.

Sincerely,
Watson Ladd
>
> regards,
> Nikos
>
>
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin