Re: [TLS] publishing SSL 3.0 as historic

[Martin Rex <[e-mail]>]

Simon Josefsson wrote:
> 
> Martin Rex <[e-mail]> writes:
> 
> > Ralph Holz wrote:
> >> 
> >> > Considering that a non-marginal fraction of the TLS protected communication
> >> > actually negotiates protocol version {0x03,0x00}, there is not reason for
> >> > a classification of "historic".
> >> 
> >> Not intending to take sides here, but from our own observations at a
> >> large ISP, SSLv3 seems to be chosen as a protocol version only for a
> >> very marginal fraction of connections. I can't quite remember the
> >> numbers, but it was something around 0.1% or less. I can look it up, if
> >> you want.
> >
> > That low number appears somewhat unrealistic to me.
> >
> > Microsoft Windows XP was shipped with SSLv2 enabled and TLSv1.0 disabled.
> 
> Service packs can make rather radical changes, are you sure an updated
> Windows XP still enable SSLv2?  If so, I'm hoping the next security
> update will disable it.

I do not have access to a sufficient variety of "virgin" installs.
My impression is that installation of MSIE7 (or later) might change
the defaults and disable SSLv2 and enable TLSv1.0.  I don't know about XPsp3.

With XPsp2+MSIE6 as well as Win2K3sp2+MSIE6 the original default applies.

-Martin