Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1.1"

Loganaden Velvindron <loganaden@gmail.com> Fri, 26 April 2019 06:16 UTC

Return-Path: <loganaden@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 612B612016C for <tls@ietfa.amsl.com>; Thu, 25 Apr 2019 23:16:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fjs4bn25-GrR for <tls@ietfa.amsl.com>; Thu, 25 Apr 2019 23:16:19 -0700 (PDT)
Received: from mail-it1-x129.google.com (mail-it1-x129.google.com [IPv6:2607:f8b0:4864:20::129]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 963C81202A3 for <tls@ietf.org>; Thu, 25 Apr 2019 23:16:18 -0700 (PDT)
Received: by mail-it1-x129.google.com with SMTP id v8so3810142itf.0 for <tls@ietf.org>; Thu, 25 Apr 2019 23:16:18 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=wO5NSm7M1ZRnx0PFSnw5bzB4cJ1rmkFZhGM8MvtPxvU=; b=YX25mQEphxqTPKkmPGuQdoWK53d2wk/H2tMyuk5Mzb50zY2SwwbeKXZlYnWULASXw0 S2IuSpVNGPSUnrd2NJKfpHBZyTQwX0RK7M7/Ww0hkHAl8nevlGt4oczhktNrLnD31DVg j8RUrskm2m7/MIcRgVc1GFPu2Sz+87Z1DJ2sZvdklm5aqQwbO8ep2e/EBuO0qy1j1/iU IzHmeyI8gTBgoCgLhgEfK7Vt3FG0tlNp7hJ/0kZTCXQvFaLXVytcLlg8GapTM3nTp+zL NULvVvWKfI2EljQ5xDup32ymFJNXml8nudXcxWAPGisETp49izlW9Bo5wc0Fmf50awsi hdLg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=wO5NSm7M1ZRnx0PFSnw5bzB4cJ1rmkFZhGM8MvtPxvU=; b=htC6sGsOcv2s1/kyo6rszbtahW5MYCbSQMTfnjkwkEexhgL87lMBF/Rzp7ej8qxkEl fUrSKBvgUpTWDM5916xHtVD3v/u+31xm8KW5FYgbaRZ75h5P4W83HT5ELUyllHaG/0M5 Ys8gPk40sAJATXSyv2fJykDFX6KTVnrsQJa/uJ2GQTiQCIYCIT3LnGhFLO8JI7RgZnXr +Tdh2wKRntmOEEyPdVj/4nv/3xZMAhhfko2bCAg1TrwaYYQPyBSqe9aJG30J8Scffrpb TxqWhDuzJuOCfSbDm6X8z+pZP5k4EEZJUvKZ1aaXW6S5HXNmTLjygRGLj7XsyaAXpGB3 m64g==
X-Gm-Message-State: APjAAAVsLPXJbJglq5mC2PLd575gX5QFASnQ9PPL1nye3x1zC5O3PbHQ dUW5DMXTicM3oGWf+Hue2US8yEHmv/dXHK5cwNU=
X-Google-Smtp-Source: APXvYqy9f6RTJkh/54o24oUt3/eMZXxFDkVYZ4x3iZUTxNFbMbDHrb8RsSOBrBdZhoXwZ2KAD3+tGt+o4EpW16fhzGU=
X-Received: by 2002:a24:424c:: with SMTP id i73mr7160538itb.91.1556259377889; Thu, 25 Apr 2019 23:16:17 -0700 (PDT)
MIME-Version: 1.0
References: <28511b10-8f6a-4394-95a9-5188130f7b58@www.fastmail.com> <2EF7433E-DB94-497F-80D7-2A060097261B@dukhovni.org> <CADZyTkkJ63uq-Uukp00XAn+vFs6JtsNXF7stK=wbJpOvNBSs9g@mail.gmail.com>
In-Reply-To: <CADZyTkkJ63uq-Uukp00XAn+vFs6JtsNXF7stK=wbJpOvNBSs9g@mail.gmail.com>
From: Loganaden Velvindron <loganaden@gmail.com>
Date: Fri, 26 Apr 2019 10:16:06 +0400
Message-ID: <CAOp4FwR7EZQ9vz2Np2DD0sT8NHvMtp_wYYHv80nRf6dZOR16-A@mail.gmail.com>
To: Daniel Migault <daniel.migault@ericsson.com>
Cc: IETF TLS WG <tls@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/VpxahaTM9cxQAXf1TpIc-ewb5nk>
Subject: Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1.1"
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 26 Apr 2019 06:16:22 -0000

I also believe that it's ready.

On Fri, Apr 26, 2019 at 5:49 AM Daniel Migault
<daniel.migault@ericsson.com> wrote:
>
> I believe the doc is fine as it is.
> Yours,
> Daniel
>
> On Thu, Apr 25, 2019 at 9:30 PM Viktor Dukhovni <ietf-dane@dukhovni.org> wrote:
>>
>> > On Apr 12, 2019, at 7:28 PM, Christopher Wood <caw@heapingbits.net> wrote:
>> >
>> > This is the working group last call for the "Deprecating TLSv1.0 and TLSv1.1” draft available at:
>> >
>> >    https://datatracker.ietf.org/doc/draft-ietf-tls-oldversions-deprecate/
>> >
>> > Please review the document and send your comments to the list by April 26, 2019.
>>
>> My concern is whether the time is yet nigh for TLS 1.0 to be disabled
>> in opportunistic TLS in SMTP, or whether TLS 1.0 remains sufficiently
>> common to cause deprecation to do more harm than good via unnecessary
>> downgrades to cleartext.
>>
>> I don't have survey numbers for SMTP TLS protocol versions across MTAs
>> generally to shed light on this, perhaps someone does.  What I do have
>> is numbers for those MTAs (not a representative sample) that have DANE
>> TLSA records (so presumably a greater focus on security).
>>
>> The observed version frequencies are approximately:
>>
>>         TLS 1.0:  1%
>>         TLS 1.1:  0%
>>         TLS 1.2: 87%
>>         TLS 1.3: 12%
>>
>> essentially regardless of whether I deduplicate by name, IP or name and IP.
>> The respective sample sizes are 5435, 6938 and 7959.
>>
>> So if a DANE-enabled sender were to disable TLS 1.0 today, approximately
>> 1% of the destination MX hosts would be broken and need remediation.  These
>> handle just of 189 mostly small SOHO domains out of the ~1.1 million total
>> DANE SMTP domains, but four handle enough email to show up on the Gmail
>> SMTP transparency report:
>>
>>   tu-darmstadt.de
>>   t-2.net
>>   t-2.com
>>   t-2.si
>>
>> So on the whole, the draft should proceed, but some caution may be appropriate
>> outside the browser space, before operators start switching off TLS 1.0 support.
>>
>> I don't see an operational considerations section.  Nor much discussion of
>> "less mainstream" (than Web browser) TLS application protocols.  Would a few
>> words of caution be appropriate, or is it expected that by the time the RFC
>> starts to change operator behaviour the "market share" of TLS 1.0 will be
>> substantially lower than I see today even with SMTP, XMPP, NTTP and the like.
>>
>> [ I would speculate that TLS 1.0's share is noticeably higher among MTAs
>>   generally than among the bleeding-edge MTAs that have published DANE TLSA
>>   RRs. ]
>>
>> --
>>         Viktor.
>>
>> _______________________________________________
>> TLS mailing list
>> TLS@ietf.org
>> https://www.ietf.org/mailman/listinfo/tls
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls