Re: [TLS] TLS 1.3 -> TLS 2.0?

[Hubert Kario <[e-mail]>]

On Wednesday, 31 August 2016 09:35:47 CEST Xiaoyin Liu wrote:
> > From: Hubert Kario [mailto:[e-mail]]
> > Sent: Wednesday, August 31, 2016 4:48 AM
> > To: Xiaoyin Liu <[e-mail]>
> > Cc: [e-mail]
> > Subject: Re: [TLS] TLS 1.3 -> TLS 2.0?
> > 
> > On Tuesday, 30 August 2016 22:20:45 CEST Xiaoyin Liu wrote:
> > 
> > > > -----Original Message-----
> > > > From: TLS [mailto:[e-mail]] On Behalf Of Hubert Kario
> > > > Sent: Tuesday, August 30, 2016 4:14 PM
> > > > To: [e-mail]
> > > > Subject: Re: [TLS] TLS 1.3 -> TLS 2.0?
> > > >
> > > >
> > > >
> > > > On Tuesday, 30 August 2016 14:19:33 CEST Dave Garrett wrote:
> > > >
> > > >
> > > >
> > > > > * Keep the version ID as { 3, 4 } (already weird counting;
> > > > > changing risks more intolerance)
> > > >
> > > >
> > > >
> > > >
> > > > IMNSHO this alone is enough of a reason not to do this
> > > >
> > > >
> > > >
> > > > it's enough explaining to people that SSLv3.3 is really TLSv1.2, now
> > > > we'll have
> >  
> >  SSLv3.4 == TLSv1.3 == TLSv2.0
> >  
> > >
> > >
> > >
> > > I don't think this is a problem. People will forget "TLS 1.3" and will
> > > only remember "TLS 2.0" after some time.
> > 
> > 
> > well, that's not the experience of our support engineers, people still
> > confuse
> SSLv3 with TLSv<any>
> 
> 
> It's normal that people confuse SSLv3 with TLS. SSL 3.0 was a released and
> widely deployed protocol, and the term "SSL" is still widely used today to
> refer to TLS. But the situation is much better if we rename TLS 1.3: TLS
> 1.3 spec has not been released, it is not supported by any non-testing
> clients or servers, and there are not many documents, papers or blogs
> mentioning TLS 1.3. This is why I said "TLS 1.3" is similar to "Windows 9"
> in terms of naming.

it's not, Microsoft didn't release anything similar to Windows that would have 
"9" or "10" in the name (even DOS stopped at 6). But there was both SSLv2 and 
SSLv3.

It's closer to the RHL 7 (Red Hat Linux) being confused with RHEL 7 (Red Hat 
Enterprise Linux), and yes, it's still happening

the problem is not that people will not know when you talk about TLSv2.0 you 
mean TLSv1.3 (or vice versa). The problem is that people will think that when 
you talk about TLSv2.0 you mean SSLv2 *because* people use the SSL and TLS 
terms interchangeably!

> > if the WG really wants a TLSvX.0 name, the X really should be bigger than
> > 3
 
> 
> 
> Well, I prefer TLS 2.0, because it sounds more natural that major version 2
> comes after major version 1. But TLS {>3}.0 is also fine to me, if the WG
> thinks people may get confused between SSL 2.0 and TLS 2.0.
 
> Xiaoyin


-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic