Re: [TLS] Comments on various things on agenda (Was: Re: TLS Interim - update and agenda)

[Ilari Liusvaara <[e-mail]>]

On Wed, Mar 11, 2015 at 05:18:45AM +0000, Peter Gutmann wrote:
> Ilari Liusvaara <[e-mail]> writes:
> 
> >Backwards compatibility:
> >
> >Is this about what is needed for compatiblity with past TLS versions?
> 
> TLS 1.3, which I've already pointed out several times has so little backwards
> compatibility that it should be called TLS 2.0, doesn't need to be hamstrung
> with retaining stuff from the other TLS 1.x versions, for example the totally
> pointless:

Here by backwards compatiblity, I interpret:

"Possiblity to securely downnegotiate to earlier versions without reconnect."

This has the following implications:
- TLS 1.2 servers have to be able to interpret the TLS 1.3 first flight in
  a sane way, so handshake can continue.
- TLS 1.3 clients have to be able to interpret the TLS 1.2 first flight in
  a sane way, so handshake can continue.

Not doing this is basically either a major security hole or serious deployment
obstacle.

> >- The first byte of record header needs to remain subprotocol id (for
> >  muxing TLS with other stuff)
> 
> (and many others).  It's already so different even to TLS 1.2 that there's no
> point in retaining some crufty old artefact of SSL 3.0 just because we've
> always done it this way.  If there's a feature that's useful or important to
> the functioning of the protocol then by all means include it, but there's no
> point in dragging along old protocol misfeatures "for backwards compatibility"
> when so much else has changed incompatibly.

There actually are _protocols_ that _break_ if TLS ever generates first byte
of record that isn't on certain range (20-63 / 0x14-0x3F), and that is the
only non-abstract requirement (not easily re-definable by TLS). Radical
handshake changes are OK.

Or protocols that break if TLS ever starts the connection with byte that isn't
0x16 (but this is also required by "backward compatiblity" as defined above).

E.g. Redefine what record type 0x17 (which is appdata in TLS 1.2) means? Sure,
no problem. Drop 0x14 (ChangeCipherSpec)? No problemo. Enable encryption in
the middle of hanshake? Ditto.


-Ilari