Re: [TLS] prohibit <1.2 support on 1.3+ servers (but allow clients)

[Yoav Nir <[e-mail]>]

> On May 21, 2015, at 7:10 PM, Dave Garrett <[e-mail]> wrote:
> 
> I was going to hold off on suggesting this due to other topics dominating the list, but we might be in a kill-the-old-junk mood due to the latest old-junk vulnerability, so...
> 
> Old versions of TLS need to be phased out at some point (even the one we're designing now), however the current modus operandi is generally to wait until a catastrophic breakage forces everyone into a panic disable. I'd like to at least try to do better prior to the next time. I'd like to propose giving servers & clients different expectations as a transitional measure:
> 
> 1) No general change to current TLS other than pointing to the UTA BCP from time to time.
> https://tools.ietf.org/html/rfc7525
> 
> 2) For TLS 1.3, add a blurb to the effect of:
> "Server TLS implementations supporting TLS 1.3 or later MUST NOT negotiate TLS 1.0 or TLS 1.1 for any reason.

Is this needed for interoperability, or is this just a good idea that you want to slap a MUST on?

It’s the latter. It belongs in a BCP, not in the protocol document, and that is where it already is. It’s not the IETF’s job to make deployment decisions like that.

Yoav