Re: [TLS] I-D Action: draft-ietf-tls-prohibiting-rc4-01.txt

[Bodo Moeller <[e-mail]>]

One technical issue here is that we keep updating specs that are also
(supposedly) "obsolete". I.e., "If you do that thing that you're not
supposed to do, here's how". It seems to me that having a bit of a gray
area then is unavoidable ... and often you *do* need some latitude in
backwards-compatible cases, assuming you support these to achieve
backwards-compatibility.

(www.microsoft.com, for example, does allow RC4 cipher suites when using
TLS 1.0, which would be incompatible with that MUST NOT, since it expressly
applies to TLS 1.0 too.)

If the spec isn't aligned with reality, that's a bit of a problem. You
shouldn't have to interpret a MUST NOT as a SHOULD NOT.

Maybe the spec should have strict MUST NOT requirements for TLS 1.2, but
make mere recommendations for the legacy protocols? (As mentioned before,
it would be good to also document that various other ciphers like RC2 also
aren't a good idea to use, even which TLS 1.1 which has them in the spec.)

Bodo