Date: Wed, 28 Jan 2015 00:43:15 +0100
From: Aaron Zauner <azet@azet.org>
To: Hanno =?utf-8?B?QsO2Y2s=?= <hanno@hboeck.de>
Message-ID: <20150127234314.GA6124@typhoon.azet.org>
References: <CAOgPGoD806Mf=wa76ixU15nGDCK91tgG4r3Sb0Us2meX4Rqk5A@mail.gmail.com>
 <54C7F106.9070400@azet.org>
 <CABkgnnUdbLnG_7DJLuVeNrK0Q2rDhNm2kRKbwMDAE7bmCr=JqQ@mail.gmail.com>
 <201501271815.23083.davemgarrett@gmail.com>
 <20150128003356.41d2899b@pc>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="Nq2Wo0NMKNjxTN9z"
Content-Disposition: inline
In-Reply-To: <20150128003356.41d2899b@pc>
User-Agent: Mutt/1.5.23 (2014-03-12)
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/P9AtAmlCVGVmCcfqUmIzFk7aVzk>
Cc: tls@ietf.org
Subject: Re: [TLS] Working Group Last Call for
 draft-ietf-tls-sslv3-diediedie-00
Precedence: list


--Nq2Wo0NMKNjxTN9z
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Hanno B=C3=B6ck <hanno@hboeck.de> [28/01/2015 00:34:13] wrote:
> On Tue, 27 Jan 2015 18:15:22 -0500
> Dave Garrett <davemgarrett@gmail.com> wrote:
>=20
> > Is it at all practical to publish an TLS RFC stating intent to
> > deprecate TLS 1.0/1.1 within some fixed timeframe? I think everyone
> > would rather phase it out then have to "be the hitman" each time.
>=20
> I think if the deprecation of SSLv3 shows one thing it is that we need
> to start now if we want to deprecate it in several years.
>=20

I cannot agree more.

> There are products on the market developed as late as 2011 that only
> support SSLv3. I think a crucial thing would be to identify and stop
> people from deploying TLS 1.0-only solutions today - so we won't have
> them tomorrow when we really need to deprecate TLS 1.0.
>=20
> It's a topic I've been discussing with a number of people lately. Ideas
> welcome. I thought about adding something to webpages that will warn
> users if they connect with anything !=3D TLS 1.2. That could at least
> make people aware if they surf with deprecated technology.

It's been pointed out earlier, but as not many people from TLS-WG
have been active at UTA I just want to reference those two documents
(currently WGLC and submitted for publication):

Recommendations for Secure Use of TLS and DTLS:
https://datatracker.ietf.org/doc/draft-ietf-uta-tls-bcp/

Summarizing Known Attacks on TLS and DTLS:
https://datatracker.ietf.org/doc/draft-ietf-uta-tls-attacks/

Aaron

--Nq2Wo0NMKNjxTN9z
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJUyCKSAAoJEOTbZJL9ubXVg9MQAKvND+NaaLwHp7EGtaJnz0dN
4FKGoVr7YM5UDPXrKNUx1ugk/GrhBPRz91GvfLrOCZ0uF2ZSPQSKif9I+4QJduJh
/5/ccF69MTDMspFnNC55Jq4j3z0zBVBN6VtrPd1e12sIS5hO9oV+0peAjLTesx3I
KBPNFzMPYFOp3CCCQlvmIOtpQ3IrTCxmeVDpU2GYG74jvelXC+qXgmGqmmQXkArF
1wzZq4BD8hHGImh8TWQ4LOPAQSdMo+M/RRUVgov5GHLCicSiLKvwllRswmgUy86m
XQdacoEaxxi5e39whdbUwxAgba35UzdiIXdB7Kxwmot7NonajvEh1ZiOy6/Pb6z5
+1OuxocBRlJSzwCt+NY8L3QeULawtMWk0qXyYWc7LYP/btAY0x+J+r7jcByV0paQ
T05HzHwTe5aMGWfhXcS+IP3nRVKexuah4mGBSpL3uv0HcH9jVFOlPbVB/EJ8a4Q6
/BGG/D5zchQkBYBeS0pCMZV3gowhyQyAkEzuTOIveVZDnKdhq0jY19HsC22+cdfj
cVgc0ZT63SkNDV6x4LqQfyARMHboXV0FMTkmgCjkCrFPhhj/NhLDrV42tH/QVp9/
QGsUaMBKaCD+so98w8LTgnWsKh3HRy4aquh4eI4/7WCoEk+7wsLVGts8+t6wrPMK
bV605FKiSnRU9ETZUDD6
=Ak18
-----END PGP SIGNATURE-----

--Nq2Wo0NMKNjxTN9z--