Re: [TLS] Working Group Last Call for draft-ietf-tls-sslv3-diediedie-00

Peter Gutmann <> Wed, 28 January 2015 08:06 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 07F8E1A00E9 for <>; Wed, 28 Jan 2015 00:06:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -4.21
X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 4xugbEw1v1hx for <>; Wed, 28 Jan 2015 00:06:35 -0800 (PST)
Received: from ( []) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 5F6C31A004C for <>; Wed, 28 Jan 2015 00:06:35 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;;; q=dns/txt; s=uoa; t=1422432395; x=1453968395; h=from:to:subject:date:message-id: content-transfer-encoding:mime-version; bh=Tc+22tEYWls/nVxO5JlUbUrLDLwxVzq+uh3bVkZJYRM=; b=HcYyhixjHzL0VyGmh6M+W495kCjAVMO7bOAhQEFQHm/V2xLJvL27Sf2s foSnAl/fyQsXGlKGJ/RqaamLl5YDLghc9rI8OeEc641GtTGWkPXDdDfpJ fDq1Z26s6AWLzHlb8zMCkNu3gZVhMroSuMDMkHDDA0TcdE2Yu7Boo+vCY I=;
X-IronPort-AV: E=Sophos;i="5.04,630,1406548800"; d="scan'208";a="304108544"
X-Ironport-Source: - Outgoing - Outgoing
Received: from ([]) by with ESMTP/TLS/AES256-SHA; 28 Jan 2015 21:06:34 +1300
Received: from ([]) by ([]) with mapi id 14.03.0174.001; Wed, 28 Jan 2015 21:06:33 +1300
From: Peter Gutmann <>
To: "<>" <>
Thread-Topic: [TLS] Working Group Last Call for draft-ietf-tls-sslv3-diediedie-00
Thread-Index: AdA60VPfS8MwK9YHRGeU1+dc4LoiMg==
Date: Wed, 28 Jan 2015 08:06:32 +0000
Message-ID: <>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
x-originating-ip: []
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <>
Subject: Re: [TLS] Working Group Last Call for draft-ietf-tls-sslv3-diediedie-00
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 28 Jan 2015 08:06:43 -0000

Dave Garrett <> writes:

>Is it at all practical to publish an TLS RFC stating intent to deprecate TLS
>1.0/1.1 within some fixed timeframe? I think everyone would rather phase it
>out then have to "be the hitman" each time.

I'm happy to have 1.0 phased out, but I'd make the baseline 1.1, not 1.2.  1.1
fixes the major issues with SSL (no support for extensions, no per-message IV)
without being a major rewrite like 1.2 is.  There's an awful lot of stuff
outside of the browser world that can move to 1.1 if it isn't there already,
but that's going to take a long, long time to move to 1.2 if it ever does.
Killing 1.0 (which is really just SSL IETF-ised) is a pretty straightforward
step if you're already getting rid of SSL because it has most of the same
problems, but deprecating 1.1 is going a bit too far.