Re: [TLS] drop obsolete SSL 2 backwards compatibility from TLS 1.3 draft

[Dave Garrett <[e-mail]>]

On Saturday, December 27, 2014 05:54:22 pm Yoav Nir wrote:
> I see a "should" from Hauke and a "should not" from you. But using RFC 2119
> words like “MUST NOT” in the spec could mean one of the following things:
> 1, That an SSLv2 ClientHello with version equal to whatever we choose for
> TLS 1.3 (0x03,0x04?) must be rejected and the connection closed. 2. That
> any TLS 1.3 implementation MUST remove support for SSLv2 ClientHellos. 3.
> That it is no longer prudent to even perform handshakes with clients that
> still offer SSLv2.

The intent of the language used is #3. Specifically, neither the version nor the 
hello format from 1995 should be considered acceptable in 2015.

> In this case SSLv2 support is used as a proxy for insecure peer.

Indirectly, yes, though not directly. I'm simply stating that having to 
implement the obsolete format is an unreasonable kludge to keep around. If it 
weren't for the differing format, I'd be suggesting simply refusing to negotiate 
SSL2 as is already expected.

> In your message you said “should not”. Why do you think we need to mandate
> dropping this support from existing products?

Inverted: Can you really make a full justification for keeping this around still?

Fabrice's reply gives a specific example of breakage from this, if you want one.


Dave