Re: [TLS] TLS 1.3 -> TLS 2.0?

[Adam Caudill <[e-mail]>]

> On Aug 31, 2016, at 10:01 PM, Eric Mill <[e-mail]> wrote:
> 
> 
> FWIW, I've definitely seen real-world confusion about SSLv3 being a more recent protocol than TLS 1.X, by organizations that should know better. If there's interest and consensus, this could be a good opportunity to reset the situation with TLS/2 or TLS 4.0. 
> 
> I like TLS/2 aesthetically, and represents a similar level of progress/reset that HTTP saw when it jumped from 1.1 to /2.
> 
> -- Eric

If it was called TLS/2, I suspect most people would still view it as TLS 2.0 - personally I see the <protocol>/<version> naming scheme as more of a aesthetic choice than something that meaningfully impacts perception.

The mistakes that were made that set up the potential confusion between SSL 2 and TLS 2 were made long ago, and are likely beyond correction at this point. While we could go with TLS 3.4 (to match the version on the wire), or TLS 4.0 (to jump past the SSL versions), I agree with those that stated that it would cause additional confusion. And there’s more than enough confusion out there thanks to SSL vs. TLS, no need to further complicate matters.

As for moving from TLS 1.3 to TLS 2.0 - this is something that will have to be dealt with at some point. Calling this version 2.0 was debated quite some time ago, and as I recall, the consensus then was to go with 1.3 and keep the changes minimal, saving 2.0 for a later, larger set of changes. Looking at the current version of the draft, calling this 2.0 seems fitting to me - as the changes have been fairly significant, not the overhaul that some wanted, but still significant.

Personally, I don’t think what we call it actually has that much impact though - calling it 2.0 could cause some to jump on it quicker, could cause those that are highly risk-adverse to delay it, I doubt either of these groups would be large enough to have an impact. It’s still a new version, and will be treated the same as new versions were in the past, no matter what we call it.

Overall, I’m indifferent on calling it 2.0, generally against /2, 3.4, 4.0, etc. and perfectly fine leaving it as 1.3.

-- 
Adam Caudill
[e-mail]
http://adamcaudill.com/