IETF Logo Mail Archive

Re: [TLS] prohibit <1.2 support on 1.3+ servers (but allow clients)

Dave Garrett <davemgarrett@gmail.com> Thu, 21 May 2015 22:21 UTC

Return-Path: <davemgarrett@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C26EE1A90DC for <tls@ietfa.amsl.com>; Thu, 21 May 2015 15:21:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JgpFnbh7olLj for <tls@ietfa.amsl.com>; Thu, 21 May 2015 15:21:34 -0700 (PDT)
Received: from mail-qg0-x22e.google.com (mail-qg0-x22e.google.com [IPv6:2607:f8b0:400d:c04::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 211211A90CE for <tls@ietf.org>; Thu, 21 May 2015 15:21:34 -0700 (PDT)
Received: by qgez61 with SMTP id z61so675309qge.1 for <tls@ietf.org>; Thu, 21 May 2015 15:21:33 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:subject:date:user-agent:cc:references:in-reply-to :mime-version:content-type:content-transfer-encoding:message-id; bh=0pcj7kkOeBpPuPcavizuFphGPnDYXRpbSGKIMesuGJY=; b=KzlQz9w4lQgVV1+OBkVF3SHl8O2tLsIYJOWREMk994IG7e9yiUuAEx5VFlg8IA/Mqg 35k2fP5NpY+ooJ8csec47qAs/nhIq0ObfZG7IzvF4bzCCJa7EkzDy1eVoSjxlybv4J0R Jc0pB0bVJ4iZnH0RNiwxhTAM8cIbjW1rUQV30ppams+iZsm0+msJRFSH+8rwlX8aI2jz hJSmiFrK0sZ/cGZ8yNpKM0qSL4qHdqAHpvA9SOUmZv2cXG0Lw+xor0MwaoI4uXRWKISn S0Hf159tOcnR0B6JcBcJx5yTffpXROLzwEqa+OHiG+aarmtBMjvFlkiOQ/r/ZR8QFMmv KMcA==
X-Received: by 10.140.100.164 with SMTP id s33mr6961098qge.36.1432246893389; Thu, 21 May 2015 15:21:33 -0700 (PDT)
Received: from dave-laptop.localnet (pool-96-245-254-195.phlapa.fios.verizon.net. [96.245.254.195]) by mx.google.com with ESMTPSA id q74sm151979qha.4.2015.05.21.15.21.32 (version=TLSv1 cipher=RC4-SHA bits=128/128); Thu, 21 May 2015 15:21:32 -0700 (PDT)
From: Dave Garrett <davemgarrett@gmail.com>
To: Yoav Nir <ynir.ietf@gmail.com>
Date: Thu, 21 May 2015 18:16:41 -0400
User-Agent: KMail/1.13.5 (Linux/2.6.32-74-generic-pae; KDE/4.4.5; i686; ; )
References: <201505211210.43060.davemgarrett@gmail.com> <BLU177-W43B228C6C40A3EFFF6D0AC3C10@phx.gbl> <08521CEE-F00B-40B5-9A91-D290ED56EE67@gmail.com>
In-Reply-To: <08521CEE-F00B-40B5-9A91-D290ED56EE67@gmail.com>
MIME-Version: 1.0
Content-Type: Text/Plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Message-Id: <201505211816.42606.davemgarrett@gmail.com>
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/D0l9qJLzfmoS61xkyfE6ZgEqAio>
Cc: "maray@microsoft.com" <maray@microsoft.com>, "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] prohibit <1.2 support on 1.3+ servers (but allow clients)
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 21 May 2015 22:21:35 -0000

On Thursday, May 21, 2015 05:50:26 pm Yoav Nir wrote:
> According to netmarketshare.com Windows XP is still 16% of desktops/laptops (as measured by web traffic). Add some older mac OS X versions and you reach 17%. Even mobile has some older versions. What this is proposing is to require servers to cut all of those off as a pre-requisite to supporting TLS 1.3.

Windows XP & old Mac OS X users can install Mozilla Firefox or Google Chrome (or one of the browsers based on one). It's just the built in browser that won't work because the vendor dropped support.

v2.3.2 | Report a Bug | By Email