Re: [TLS] drop obsolete SSL 2 backwards compatibility from TLS 1.3 draft

[Dave Garrett <[e-mail]>]

On Wednesday, December 24, 2014 01:40:10 am you wrote:
> > There's no reason to maintain any backwards support here just for
> > Internet Explorer 2.0 on Windows 3.1.
> 
> I’m not objecting to the change, but I am objecting to the hyperbole. The
> issue is with Internet Explorer 6 on Windows XP, which still exists, but
> more importantly, a lot of web service clients running on top of Windows
> XP use the same SCHANNEL library as IE would use, so they issue a SSLv2
> ClientHello. Despite Microsoft’s best efforts, there is still a
> substantial but diminishing install base of XP.

I was not aware Microsoft used an SSL2 ClientHello for SSL3. Thanks for pointing 
that out. Is it not capable of sending an SSL3/TLS Hello at all? If it were 
properly configured to enable TLS1 and disable SSL2/3, would it send the proper 
TLS compatible Hello? (Microsoft really should've pushed an XP update to flip 
that switch years ago)

> It’s fine for us to break compatibility with these clients, but let’s not
> pretend it’s some ancient technology that doesn’t exist in the market
> anymore.
> 
> Yoav

Sad, but I guess that's true. :/


Dave