Re: [TLS] prohibit <1.2 on clients (but allow servers) (was: prohibit <1.2 support on 1.3+ servers (but allow clients))

[Xiaoyin Liu <[e-mail]>]

Hi,

Instead of prohibiting bad crypto on the server side, I would like to propose a BCP which prohibits TLS 1.1- on the clients, but allows servers to keep supporting TLS 1.0+. The simple reason is that we should allow normal users to gradually upgrade their old browsers/operating systems, but should encourage (or require) webmasters to upgrade their servers as soon as possible in order to protect their users' security and privacy. I believe phasing out insecure web technology should be promoted by browsers. Microsoft's plan to phase out SHA-1 certificates has been quite effective so far, and I suggest we do the same for old TLS protocols and old cipher suites.
 
I do understand that, as many have pointed out, upgrading servers is not an easy task for some companies. But if not now, they have to be upgraded sometime. Is 2-3 years enough for all servers to be upgraded? So what about specifying the following in tls1-diediedie doc:

1) (Already required in RFC 7525) TLS servers MUST support TLS 1.3 (if TLS 1.3 RFC has been published, otherwise TLS 1.2).
2) (Already required in RFC 7525) If ClientHello.client_version is 0x0303 (TLS 1.2) or above, then TLS servers MUST negotiate that version.3) TLS servers MAY support TLS 1.0 and TLS 1.1 to support old TLS clients.
4) (New requirement!) Starting from January 1, 2018, TLS clients MUST terminate the handshake if serverHello.server_version is 0x0302 (TLS 1.1) or below.5) (New requirement!) Starting from January 1, 2018, TLS clients MUST NOT include cipher suites that do not provide forward secrecy in the ClientHello message.6) (Same as RFC 7525) The requirements above do not apply to opportunistic encryptions, like STARTTLS. The date specified in 4) and 5) can be discussed later. It is important that all major browser vendors agree to enforce 4) and 5) after this specific date, and that this date is widely known by website operators. The goal of my proposal is to eliminate TLS 1.0-only and non-PFS TLS servers before the next decade.

Best,Xiaoyin