IETF Logo Mail Archive

Re: [TLS] prohibit <1.2 support on 1.3+ servers (but allow clients)

Martin Thomson <martin.thomson@gmail.com> Fri, 22 May 2015 03:42 UTC

Return-Path: <martin.thomson@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E220D1A90BD for <tls@ietfa.amsl.com>; Thu, 21 May 2015 20:42:17 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lQCnPewXNcTc for <tls@ietfa.amsl.com>; Thu, 21 May 2015 20:42:16 -0700 (PDT)
Received: from mail-yh0-x233.google.com (mail-yh0-x233.google.com [IPv6:2607:f8b0:4002:c01::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 20AFE1A90B7 for <tls@ietf.org>; Thu, 21 May 2015 20:42:16 -0700 (PDT)
Received: by yhda23 with SMTP id a23so1624837yhd.2 for <tls@ietf.org>; Thu, 21 May 2015 20:42:15 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=iVTKARmKcmKcm5NrdGKdqywcP3+wBuxhvWuIKgZJ4eA=; b=Gj0PO7oS58YoGKIK5WcxBdOWJV8lF9OgUVYx7JcqUTqXa4tyxj6Ja3nkqdS+XRXUN6 NAEdJzlWvFGp0QtgiTED0O0x77t2Mv70lvsyL5J9+105SZ4pcFBEemqgGoc/p9hMlMNu Z+2MbJhFCIGCb8Hzdf69UURkAcpGUZz8P/wlKZIFWwFt7kbsT5D8JhGblJYTBlh++/jM VDqnCIxTwLAX2/1n/Deegv/wrJK4FOq1CgyNHINPFI3GonJDSn8F6ECykfMINQFlJloY 3lIN3KZbekWKMBM+ydRv6V8YOSKDxXED2pSVxea2/KTz+hOKK0LsSqpJWQlChVYw8pz7 eG4w==
MIME-Version: 1.0
X-Received: by 10.170.112.18 with SMTP id e18mr2211069ykb.101.1432266135468; Thu, 21 May 2015 20:42:15 -0700 (PDT)
Received: by 10.13.247.71 with HTTP; Thu, 21 May 2015 20:42:15 -0700 (PDT)
In-Reply-To: <201505212314.57525.davemgarrett@gmail.com>
References: <201505211210.43060.davemgarrett@gmail.com> <201505212304.11513.davemgarrett@gmail.com> <CABkgnnWa=VvYR4cWDZAi-suaezvLCcBW1+QUSeGu4LJ6A22y8A@mail.gmail.com> <201505212314.57525.davemgarrett@gmail.com>
Date: Thu, 21 May 2015 20:42:15 -0700
Message-ID: <CABkgnnU1FiOXkPQYc6MNtK7DTYGsZucuoxxKWSxnEOHj4dDpbg@mail.gmail.com>
From: Martin Thomson <martin.thomson@gmail.com>
To: Dave Garrett <davemgarrett@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/-iLXwM0wvGPAOdtwGqL4ouRqlcU>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] prohibit <1.2 support on 1.3+ servers (but allow clients)
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 22 May 2015 03:42:18 -0000

On 21 May 2015 at 20:14, Dave Garrett <davemgarrett@gmail.com> wrote:
> I should say instead that I have not seen a change nearly on the scale of the SSL3 RFC. Those who were in the process of phasing out RC4 are still doing so at a comparable pace. Browsers were willing to accept breakage for SSL3, but they're not yet ready for RC4. In comparison it appears to have had less effect, at least so far. This will, of course, hopefully change.

There is a big difference in the baseline in both cases.  RC4 was
about half of all TLS on the web before we decided to start killing
it.  You can't shift something like that quickly.

v2.23.0 | Report a Bug | By Email