Re: [TLS] Confirming consensus: TLS1.3->TLS*

[Scott Schmit <[e-mail]>]

On Fri, Nov 18, 2016 at 11:12:48AM +0900, Sean Turner wrote:
> At IETF 97, the chairs lead a discussion to resolve whether the WG should rebrand TLS1.3 to something else.  Slides can be found @ https://www.ietf.org/proceedings/97/slides/slides-97-tls-rebranding-aka-pr612-01.pdf.
> 
> The consensus in the room was to leave it as is, i.e., TLS1.3, and to not rebrand it to TLS 2.0, TLS 2, or TLS 4.  We need to confirm this decision on the list so please let the list know your top choice between:
> 
> - Leave it TLS 1.3
> - Rebrand TLS 2.0
> - Rebrand TLS 2
> - Rebrand TLS 4
> 
> by 2 December 2016.

I find it compelling that if we lived in an alternate universe where we
had SSL 1996, TLS 1999, and a recently-published TLS 2006 or TLS 2008,
there would have been a lot less inertia about switching to a later
version.  I find is very optimistic given our history that we could
manage two TLS versions in a year.  If that ever happened, though, we
could do 2019.1 (as an increment) or 2019.11 (for the month).

Barring that, I'd prefer TLS 4, since that gets us out of the version
confusion swamp.  It would seem that almost nobody outside the security
community understands the distinction between SSL and TLS; so if we call
it TLS 4, we'll probably see it referred to as SSLv4.  And that wouldn't
be horrible.  If we call it TLS 2 or TLS 2.0, some might refer to it as
SSLv2.  That would obviously be very bad.

While it's nice to able to look up information about TLS 1.3 drafts,
most of that information is going to be inaccurate anyway, so I don't
see that as a compelling reason to stick to it.  Granted, you have
specific buzz for "TLS 1.3 is going to really improve things" but that's
fairly easy to translate to "the new version of TLS is going to really
improve things".

The distinction between 2 vs 2.0 seems pretty minor.  SSLv2 is 2.0 and
SSLv3 is 3.0, but few write it that way.

Thus my ranked preference would be:

TLS 2017 > TLS 4 > TLS 1.3 > TLS 2 or TLS 2.0

But if I'm limited to a top choice from the list, then "Rebrand TLS 4"

-- 
Scott Schmit