Re: [TLS] prohibit <1.2 support on 1.3+ servers (but allow clients)

[Hubert Kario <[e-mail]>]

On Friday 22 May 2015 09:42:40 Martin Rex wrote:
> Dave Garrett wrote:
> > On Thursday, May 21, 2015 07:09:42 pm Yoav Nir wrote:
> >> Then point at the BCP. Only problem is that it doesn?t say what you want
> >> it to say (it allows TLS 1.0 when the client does not support anything
> >> else)> 
> > In my first post I said that I don't propose changing anything for
> > existing
> > deployments. The BCP is currently a "SHOULD NOT" for current TLS.
> > I'm proposing a "MUST NOT" for TLS 1.3+ implementations only.
> > 
> > The BCP is also not directly part of the TLS spec. What I'm suggesting is
> > considering 1.0/1.1 to be not legitimate forever, not just not "best".
> 
> All current "recommendations" against TLSv1.0 and TLSv1.1 are well-known
> FUD.
> 
> The difference between TLSv1.0 with 1/(n-1) record splitting and
> TLSv1.1 is cryptographically insignificant and the security of
> TLSv1.2 is lower than both of its precedessors (e.g. throug the
> botched TLS signature extension and the dumb idea to replace
> the md5+sha1 signatures with sha1-only signatures for RSA certificates.

schannel, OpenSSL, NSS and GnuTLS will use at least sha256 if only given 
chance

yes, clients should not be advertising support for sha-1, but it's not an end 
of the world scenario just yet

-- 
Regards,
Hubert Kario
Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic