[Maprg] Fwd: Ben Campbell's Yes on draft-ietf-uta-email-deep-09: (with COMMENT)

[Mirja Kühlewind <[e-mail]>]

Hi group,

I’m forwarding a snip from the uta mailing list because there is a request for data. The question is how many of the deployed mail clients use/support TLS1.2 or higher. Does anybody has data?

Mirja


> Anfang der weitergeleiteten Nachricht:
> 
> Von: Keith Moore <[e-mail]>
> Betreff: Aw: Ben Campbell's Yes on draft-ietf-uta-email-deep-09: (with COMMENT)
> Datum: 25. Oktober 2017 um 12:48:37 MESZ
> An: Ben Campbell <[e-mail]>, The IESG <[e-mail]>
> Kopie: [e-mail], [e-mail], [e-mail], [e-mail]
> 
>> -4.1, last paragraph: "It is RECOMMENDED that new users be required to use TLS
>> version 1.1
>>    or greater from the start."
>> Is 1.1 correct? Why not start with 1.2?
> 
> TLS 1.1 was a deliberate choice.  Reality is that some new users will still be using old mail user agents, and there are often other factors that impair users' ability to upgrade.   If new users were _required_ to use TLS 1.2, that would essentially prevent them from getting new email service, or maybe force them to spend large amounts of money for new hardware and/or software in order to do so.  Either that or mail service providers might legitimately claim that they had good reason to take exception to the RECOMMENDED keyword and the paragraph would have no beneficial effect.
> 
> It's basically a judgment call - what policy on the part of mail service providers results in the best security overall?   It appears possible to err on the side of either too strict or too loose.
> 
> That said, some of the text in this draft is three years old, and conditions have changed somewhat in that interval.   If 99% of deployed user agents implement TLS 1.2, requiring 1.2 for new users would probably not bother me.  But if the figure were closer to 90%, it would bother me.   Maybe someone has actual figures, but I suspect the actual level of deployment is still well less than 90%.