Re: [TLS] drop obsolete SSL 2 backwards compatibility from TLS 1.3 draft

[Yuhong Bao <[e-mail]>]

>> On Dec 24, 2014, at 9:23 AM, Dave Garrett <[e-mail]> wrote:
>>
>> On Wednesday, December 24, 2014 01:40:10 am you wrote:
>>>> There's no reason to maintain any backwards support here just for
>>>> Internet Explorer 2.0 on Windows 3.1.
>>>
>>> I’m not objecting to the change, but I am objecting to the hyperbole. The
>>> issue is with Internet Explorer 6 on Windows XP, which still exists, but
>>> more importantly, a lot of web service clients running on top of Windows
>>> XP use the same SCHANNEL library as IE would use, so they issue a SSLv2
>>> ClientHello. Despite Microsoft’s best efforts, there is still a
>>> substantial but diminishing install base of XP.
>>
>> I was not aware Microsoft used an SSL2 ClientHello for SSL3. Thanks for pointing
>> that out. Is it not capable of sending an SSL3/TLS Hello at all? If it were
>> properly configured to enable TLS1 and disable SSL2/3, would it send the proper
>> TLS compatible Hello? (Microsoft really should've pushed an XP update to flip
>> that switch years ago)
>
> Yes. From the control panel you clicked “Internet Options”, and that had a tab for security, but it wasn’t there. Instead, it was in the tab for advanced, which had a bunch of options, some related to security, but it was under “encryption”, not security. There were checkboxes for support of SSLv2, SSLv3, and TLS 1.0. By default the SSLv2 and SSLv3 checkboxes were checked, while the TLS 1.0 box was unchecked. To get rid of the SSLv2 ClientHello you had to uncheck the SSLv2. I don’t think the kind of people who still use Windows XP are the same ones who would go into the settings to disable SSLv2.
>
> I might have some of the details wrong. It’s been a few years since I last set Internet Options on a Windows XP box.

In fact, i think you can disable the SSLv2 ClientHello globally for all users of SChannel using the following reg key:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client]
"Enabled"=dword:00000000