Re: [TLS] consensus on backwards compatibility changes

On Sun, Jan 25, 2015 at 3:33 PM, Dave Garrett <davemgarrett@gmail.com>
wrote:

> On Sunday, January 25, 2015 02:36:14 pm Eric Rescorla wrote:
> > Based on reading the mailing list, it seems to me that there is rough
> > consensus on PR#105, but not (yet?) on PR#107.
>
> I don't recall any objections to #107, but not much discussion either.
>
> To sum it up here, in addition to some editorial changes:
>
> 1) Fixes initial ClientHello record layer version to { 3, 1 } (TLS 1.0) &
> mandates
> all other record layer versions to match negotiated version.
> (Brian's suggestion)
>
>
[Joe] I think this makes sense.  I added to comments to the PR.  I propose
to move the bit about the server accepting versions {3,x} to the same place
and change the wording of the existing test to say:

"The client MUST set the version to {3, 1} for the initial ClientHello."

> In SCSV discussion, evidence was given that this improves interop by 5.3%
> for TLS 1.3 & an additional 1.5% for TLS 1.2:
> http://www.ietf.org/mail-archive/web/tls/current/msg15141.html
>
> 2) Mention some other interop concerns along side existing notes.
>
> 3) Cite RC4 prohibition pending RFC.
>
> 4) "If an implementation negotiates usage of TLS 1.2, then negotiation of
> cipher
> suites also supported by TLS 1.3 SHOULD be preferred, if available."
> (only a SHOULD, and only if available; language up for negotiation if
> needed)
>
> 5) Explicitly prohibit EXPORT ciphers and any others <100 bits.
> (100 bit line is arbitrary; could be 112 if preferred)
>
>
[Joe] draft-ietf-uta-tls-bcp-08 recommends 112 so we probably would match
that.

>
> Dave
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>