Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1.1"
Loganaden Velvindron <loganaden@gmail.com> Fri, 26 April 2019 06:16 UTC
Return-Path: <loganaden@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 612B612016C for <tls@ietfa.amsl.com>; Thu, 25 Apr 2019 23:16:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fjs4bn25-GrR for <tls@ietfa.amsl.com>; Thu, 25 Apr 2019 23:16:19 -0700 (PDT)
Received: from mail-it1-x129.google.com (mail-it1-x129.google.com [IPv6:2607:f8b0:4864:20::129]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 963C81202A3 for <tls@ietf.org>; Thu, 25 Apr 2019 23:16:18 -0700 (PDT)
Received: by mail-it1-x129.google.com with SMTP id v8so3810142itf.0 for <tls@ietf.org>; Thu, 25 Apr 2019 23:16:18 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=wO5NSm7M1ZRnx0PFSnw5bzB4cJ1rmkFZhGM8MvtPxvU=; b=YX25mQEphxqTPKkmPGuQdoWK53d2wk/H2tMyuk5Mzb50zY2SwwbeKXZlYnWULASXw0 S2IuSpVNGPSUnrd2NJKfpHBZyTQwX0RK7M7/Ww0hkHAl8nevlGt4oczhktNrLnD31DVg j8RUrskm2m7/MIcRgVc1GFPu2Sz+87Z1DJ2sZvdklm5aqQwbO8ep2e/EBuO0qy1j1/iU IzHmeyI8gTBgoCgLhgEfK7Vt3FG0tlNp7hJ/0kZTCXQvFaLXVytcLlg8GapTM3nTp+zL NULvVvWKfI2EljQ5xDup32ymFJNXml8nudXcxWAPGisETp49izlW9Bo5wc0Fmf50awsi hdLg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=wO5NSm7M1ZRnx0PFSnw5bzB4cJ1rmkFZhGM8MvtPxvU=; b=htC6sGsOcv2s1/kyo6rszbtahW5MYCbSQMTfnjkwkEexhgL87lMBF/Rzp7ej8qxkEl fUrSKBvgUpTWDM5916xHtVD3v/u+31xm8KW5FYgbaRZ75h5P4W83HT5ELUyllHaG/0M5 Ys8gPk40sAJATXSyv2fJykDFX6KTVnrsQJa/uJ2GQTiQCIYCIT3LnGhFLO8JI7RgZnXr +Tdh2wKRntmOEEyPdVj/4nv/3xZMAhhfko2bCAg1TrwaYYQPyBSqe9aJG30J8Scffrpb TxqWhDuzJuOCfSbDm6X8z+pZP5k4EEZJUvKZ1aaXW6S5HXNmTLjygRGLj7XsyaAXpGB3 m64g==
X-Gm-Message-State: APjAAAVsLPXJbJglq5mC2PLd575gX5QFASnQ9PPL1nye3x1zC5O3PbHQ dUW5DMXTicM3oGWf+Hue2US8yEHmv/dXHK5cwNU=
X-Google-Smtp-Source: APXvYqy9f6RTJkh/54o24oUt3/eMZXxFDkVYZ4x3iZUTxNFbMbDHrb8RsSOBrBdZhoXwZ2KAD3+tGt+o4EpW16fhzGU=
X-Received: by 2002:a24:424c:: with SMTP id i73mr7160538itb.91.1556259377889; Thu, 25 Apr 2019 23:16:17 -0700 (PDT)
MIME-Version: 1.0
References: <28511b10-8f6a-4394-95a9-5188130f7b58@www.fastmail.com> <2EF7433E-DB94-497F-80D7-2A060097261B@dukhovni.org> <CADZyTkkJ63uq-Uukp00XAn+vFs6JtsNXF7stK=wbJpOvNBSs9g@mail.gmail.com>
In-Reply-To: <CADZyTkkJ63uq-Uukp00XAn+vFs6JtsNXF7stK=wbJpOvNBSs9g@mail.gmail.com>
From: Loganaden Velvindron <loganaden@gmail.com>
Date: Fri, 26 Apr 2019 10:16:06 +0400
Message-ID: <CAOp4FwR7EZQ9vz2Np2DD0sT8NHvMtp_wYYHv80nRf6dZOR16-A@mail.gmail.com>
To: Daniel Migault <daniel.migault@ericsson.com>
Cc: IETF TLS WG <tls@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/VpxahaTM9cxQAXf1TpIc-ewb5nk>
Subject: Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1.1"
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 26 Apr 2019 06:16:22 -0000
I also believe that it's ready. On Fri, Apr 26, 2019 at 5:49 AM Daniel Migault <daniel.migault@ericsson.com> wrote: > > I believe the doc is fine as it is. > Yours, > Daniel > > On Thu, Apr 25, 2019 at 9:30 PM Viktor Dukhovni <ietf-dane@dukhovni.org> wrote: >> >> > On Apr 12, 2019, at 7:28 PM, Christopher Wood <caw@heapingbits.net> wrote: >> > >> > This is the working group last call for the "Deprecating TLSv1.0 and TLSv1.1” draft available at: >> > >> > https://datatracker.ietf.org/doc/draft-ietf-tls-oldversions-deprecate/ >> > >> > Please review the document and send your comments to the list by April 26, 2019. >> >> My concern is whether the time is yet nigh for TLS 1.0 to be disabled >> in opportunistic TLS in SMTP, or whether TLS 1.0 remains sufficiently >> common to cause deprecation to do more harm than good via unnecessary >> downgrades to cleartext. >> >> I don't have survey numbers for SMTP TLS protocol versions across MTAs >> generally to shed light on this, perhaps someone does. What I do have >> is numbers for those MTAs (not a representative sample) that have DANE >> TLSA records (so presumably a greater focus on security). >> >> The observed version frequencies are approximately: >> >> TLS 1.0: 1% >> TLS 1.1: 0% >> TLS 1.2: 87% >> TLS 1.3: 12% >> >> essentially regardless of whether I deduplicate by name, IP or name and IP. >> The respective sample sizes are 5435, 6938 and 7959. >> >> So if a DANE-enabled sender were to disable TLS 1.0 today, approximately >> 1% of the destination MX hosts would be broken and need remediation. These >> handle just of 189 mostly small SOHO domains out of the ~1.1 million total >> DANE SMTP domains, but four handle enough email to show up on the Gmail >> SMTP transparency report: >> >> tu-darmstadt.de >> t-2.net >> t-2.com >> t-2.si >> >> So on the whole, the draft should proceed, but some caution may be appropriate >> outside the browser space, before operators start switching off TLS 1.0 support. >> >> I don't see an operational considerations section. Nor much discussion of >> "less mainstream" (than Web browser) TLS application protocols. Would a few >> words of caution be appropriate, or is it expected that by the time the RFC >> starts to change operator behaviour the "market share" of TLS 1.0 will be >> substantially lower than I see today even with SMTP, XMPP, NTTP and the like. >> >> [ I would speculate that TLS 1.0's share is noticeably higher among MTAs >> generally than among the bleeding-edge MTAs that have published DANE TLSA >> RRs. ] >> >> -- >> Viktor. >> >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls
- [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1.1" Christopher Wood
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Watson Ladd
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Martin Thomson
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… John Mattsson
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Maarten Aertsen (NCSC-NL)
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Stephen Farrell
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Gary Gapinski
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Kathleen Moriarty
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Daniel Migault
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Viktor Dukhovni
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Loganaden Velvindron
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Hubert Kario
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Töma Gavrichenkov
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Salz, Rich
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Viktor Dukhovni
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Roland Zink
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Martin Thomson
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Christopher Wood
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Viktor Dukhovni
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Martin Rex
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Töma Gavrichenkov
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Kathleen Moriarty
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Kathleen Moriarty
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Kathleen Moriarty
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Kathleen Moriarty
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Kathleen Moriarty
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Kathleen Moriarty
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Martin Thomson
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Hubert Kario
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Kathleen Moriarty
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Martin Rex
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Hubert Kario
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Peter Gutmann
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Benjamin Kaduk
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Peter Gutmann
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Viktor Dukhovni
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Eric Rescorla
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Kathleen Moriarty
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Kathleen Moriarty
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Peter Gutmann
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Kathleen Moriarty
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Martin Thomson
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Hubert Kario
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Hubert Kario
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Töma Gavrichenkov
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Benjamin Kaduk
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Kathleen Moriarty
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Blumenthal, Uri - 0553 - MITLL
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Kathleen Moriarty
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Viktor Dukhovni
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Viktor Dukhovni
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… David Benjamin
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Martin Rex
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Peter Gutmann
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Hubert Kario
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Martin Rex
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Peter Gutmann
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Martin Thomson
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Hubert Kario
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Martin Rex
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Peter Gutmann
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Hubert Kario
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Martin Rex
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… David Benjamin
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Kathleen Moriarty
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Hubert Kario
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Martin Rex
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Peter Gutmann
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Christopher Wood
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Martin Rex
- Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1… Peter Gutmann