Re: [TLS] consensus on backwards compatibility changes

[Dave Garrett <[e-mail]>]

On Sunday, January 25, 2015 02:36:14 pm Eric Rescorla wrote:
> Based on reading the mailing list, it seems to me that there is rough
> consensus on PR#105, but not (yet?) on PR#107.

I don't recall any objections to #107, but not much discussion either.

To sum it up here, in addition to some editorial changes:

1) Fixes initial ClientHello record layer version to { 3, 1 } (TLS 1.0) & mandates
all other record layer versions to match negotiated version.
(Brian's suggestion)

In SCSV discussion, evidence was given that this improves interop by 5.3%
for TLS 1.3 & an additional 1.5% for TLS 1.2:
http://www.ietf.org/mail-archive/web/tls/current/msg15141.html

2) Mention some other interop concerns along side existing notes.

3) Cite RC4 prohibition pending RFC.

4) "If an implementation negotiates usage of TLS 1.2, then negotiation of cipher
suites also supported by TLS 1.3 SHOULD be preferred, if available."
(only a SHOULD, and only if available; language up for negotiation if needed)

5) Explicitly prohibit EXPORT ciphers and any others <100 bits.
(100 bit line is arbitrary; could be 112 if preferred)


Dave