[TLS] 1.0 or else (was Re: Working Group Last Call for draft-ietf-tls-sslv3-diediedie-00)

[Martin Thomson <[e-mail]>]

On 28 January 2015 at 15:31, Martin Rex <[e-mail]> wrote:
> That's not quite true.  There es little, if any stuff outside of the
> browser world that could go to > extension-less TLSv1.0, because there
> are still too many servers out there that will abort the handshake
> when extensions are present or when the version is > TLSv1.0.

Our limited survey thus far has identified only a small number (0.27%)
of sites [1][2] that can't handle our TLS 1.2 handshake [3], even
though they will tolerate our TLS 1.0 handshake.  In contrast,
disabling SSL3 affected more than twice this amount.

Note that we don't drop extensions now that SSL3 is disabled, so we
have no information on Martin's claims of extension intolerance.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1084025#c96
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=1084025#c99
[3] We use a TLS 1.0 record layer, 1.2 ClientHello and a modest set of
extensions.