Re: [TLS] prohibit <1.2 support on 1.3+ servers (but allow clients)

[Dave Garrett <[e-mail]>]

On Thursday, May 21, 2015 07:29:15 pm Martin Thomson wrote:
> On 21 May 2015 at 09:10, Dave Garrett <[e-mail]> wrote:
> > 2) For TLS 1.3, add a blurb to the effect of:
> > "Server TLS implementations supporting TLS 1.3 or later MUST NOT negotiate TLS 1.0 or TLS 1.1 for any reason.
> > Client TLS implementations are RECOMMENDED to not support old TLS versions, where possible."
> 
> I don't think that this is the right way to do this.

I think it's probably the only way to set up a deprecation plan rather than rely on panic disables. I do agree that it's not looking viable.

> I'm happy to be the one wielding the stick when the time is right, but
> I probably won't come here to do it.

This standardization process is ill-equipped to deal with the issue, but it's the best place to try, near as I can tell. :/

> we support crappy crypto on the Firefox download site - including SSL3 -
> on the basis that it makes more sense to allow clients who only
> support SSL3 to download our software.  That way, they might get an
> approximation of good crypto rather than being left with the rubbish
> they have.

Yeah, browser download servers are the notable edge case. Pretty much everyone would agree that anything is better than nothing there. Ideally SSL3 could be dealt with via a separate server, but I certainly agree with their assessment that the complexity of actually doing that isn't worth it.


Dave