Re: [TLS] drop obsolete SSL 2 backwards compatibility from TLS 1.3 draft

[Dave Garrett <[e-mail]>]

On Saturday, December 27, 2014 06:37:08 pm Brian Smith wrote:
> if the server is allowed to support TLS 1.0, then it should seems
> reasonable for it to negotiate TLS 1.0 with a client that sent an
> SSL2-compatible TLS 1.0 ClientHello.

TLS 1.0 is perfectly capable of negotiating using the proper hello. The fact 
that some clients are EOL and might not do connect in a way that will work 
forever is not something worth worrying about. I don't think it's unreasonable 
to expect that 20 years later the "new" hello format should be mandatory.

Let's stop and think about this for a moment. We're discussing a message format 
from a two decade old protocol, generally considered to be woefully insecure and 
unfit for any use. It has been listed in the "backwards compatibility" section 
since SSL3 in 1996. The following has been in there for 19 years:

"Warning: The ability to send version 2.0 client hello messages will
be phased out with all due haste. Implementers should make every
effort to move forward as quickly as possible."

SSL2 messages should not be tolerated at this point if we want TLS 1.3 to be 
considered a specification for a modern security protocol implementation.

> However, I think it is fine to
> say that the server MUST NOT implement support for the SSL2 protocol.
> And, it is fine to say that all TLS clients MUST NOT use
> SSL2-compatible ClientHellos, since they wouldn't be able to add
> extensions if they did.

That is already agreed upon via RFC 6176.

https://tools.ietf.org/html/rfc6176


Dave