Re: [TLS] prohibit <1.2 on clients (but allow servers) (was: prohibit <1.2 support on 1.3+ servers (but allow clients))

[Dave Garrett <[e-mail]>]

On Friday, May 22, 2015 08:30:49 am Peter Gutmann wrote:
> So if some sort of BCP is published, it should explicitly target browsers and
> web servers where this kind of upgrade/change is possible.  Telling people to
> throw away their PLCs and replace them with new ones isn't going to fly.

To be clear, in case it was lost the noise, I did not propose mandating this in the TLS 1.3 spec. If you're going to be sticking with TLS 1.0 until the wheels fall off, you'll be sticking with other TLS 1.0 software to connect to it. (which might entail forking software into TLS 1.0-1.2 & TLS 1.2-1.3 variations, if you really have to) The proposals for the TLS 1.3 spec are intended to apply only to things that are actually updating. The idea is to drag the whole ecosystem kicking and screaming into the 21st century. If the ecosystem isn't moving at all, there's nothing we can do about that here. :(


Dave