[TLS] False Start and TLS 1.3+

[Brian Smith <[e-mail]>]

1. TLS 1.3 will have its own 1-RTT mechanism, so it makes less (no?)
sense do do False Start for TLS 1.3.

2. During the development and testing of TLS 1.3, it is far from clear
that a TLS 1.3 handshake will be as secure as a TLS 1.2 handshake. It
seems likely, in fact, that for some handshakes, due to implementation
bugs, and/or problems in new parts of the protocol, that TLS 1.3 could
be a security downgrade from TLS 1.2, at least until TLS 1.3 gets its
RFC number.

3. During the development of TLS 1.3, my understanding is that an
extension will be used to negotiate which draft of TLS 1.3 is being
spoken. This extension would only be safe for False Start if every
draft were equally secure, which is unlikely.

Because of these reasons, the False Start draft should be updated to
say that False Start MUST NOT be used for TLS 1.3 and later.

Cheers,
Brian