IETF Logo Mail Archive

Re: [TLS] drop obsolete SSL 2 backwards compatibility from TLS 1.3 draft

Peter Gutmann <pgut001@cs.auckland.ac.nz> Tue, 30 December 2014 08:12 UTC

Return-Path: <pgut001@cs.auckland.ac.nz>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B8E411ACEC7 for <tls@ietfa.amsl.com>; Tue, 30 Dec 2014 00:12:29 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.31
X-Spam-Level:
X-Spam-Status: No, score=-2.31 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GFJ9tBdNBvsa for <tls@ietfa.amsl.com>; Tue, 30 Dec 2014 00:12:27 -0800 (PST)
Received: from mx2.auckland.ac.nz (mx2.auckland.ac.nz [130.216.125.245]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 33C081ACDC3 for <tls@ietf.org>; Tue, 30 Dec 2014 00:12:26 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=uoa; t=1419927147; x=1451463147; h=from:to:subject:date:message-id: content-transfer-encoding:mime-version; bh=OCMU3nEna8yX8lE9lRbtZ1sRMJZy2hWxM5U38tYrknQ=; b=C4fH3NLBVefQ1FbYqFWxidv2bUbmV7afSh9iw4uepzleRyp50bvM7Kg+ d8p2PNu2pphIvoJIv2GvGQpfl3eQ/ol2NRwF2snP+hB4pWu0nDxbS/K3T /kobT32QXuoDMJtPhr3nGiBU0n8USgSaV1YDoqr+Owq2auDKozzPEaNML A=;
X-IronPort-AV: E=Sophos;i="5.04,630,1406548800"; d="scan'208";a="298842968"
X-Ironport-HAT: MAIL-SERVERS - $RELAYED
X-Ironport-Source: 130.216.4.106 - Outgoing - Outgoing
Received: from uxchange10-fe2.uoa.auckland.ac.nz ([130.216.4.106]) by mx2-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 30 Dec 2014 21:12:22 +1300
Received: from UXCN10-TDC05.UoA.auckland.ac.nz ([169.254.9.148]) by uxchange10-fe2.UoA.auckland.ac.nz ([130.216.4.106]) with mapi id 14.03.0174.001; Tue, 30 Dec 2014 21:12:23 +1300
From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: "<tls@ietf.org>" <tls@ietf.org>
Thread-Topic: [TLS] drop obsolete SSL 2 backwards compatibility from TLS 1.3 draft
Thread-Index: AdAkCFZdyRPhUar6QYmBW0Klcr+WqQ==
Date: Tue, 30 Dec 2014 08:12:22 +0000
Message-ID: <9A043F3CF02CD34C8E74AC1594475C73AAF4C93B@uxcn10-tdc05.UoA.auckland.ac.nz>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [130.216.158.4]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/SRSzDQ5SZ2Iex0EV50-xrqDBywg
Subject: Re: [TLS] drop obsolete SSL 2 backwards compatibility from TLS 1.3 draft
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 30 Dec 2014 08:12:29 -0000

Dave Garrett <davemgarrett@gmail.com> writes:

>The following has been in there for 19 years:
>
>"Warning: The ability to send version 2.0 client hello messages will be
>phased out with all due haste. Implementers should make every effort to move
>forward as quickly as possible."

Another way to look at it is from the truth-in-advertising perspective: change
the text to match actual practice:

  "Warning: SSL 2.0 is an obsolete, insecure protocol from twenty years ago,
  however support for version 2.0 client hello messages will be retained in
  perpetuity in order to deal with an increasingly irrelevant remnant of
  obsolete software that still uses it.  Implementers don't need to make any
  effort to ever move forward."

This is simply the existing text rephrased to match actual practice.

Peter.

v2.23.0 | Report a Bug | By Email