Re: [TLS] drop obsolete SSL 2 backwards compatibility from TLS 1.3 draft

[Dave Garrett <[e-mail]>]

On Saturday, December 27, 2014 07:39:07 pm Brian Smith wrote:
> Dave Garrett <[e-mail]> wrote:
> > On Saturday, December 27, 2014 06:37:08 pm Brian Smith wrote:
> >> if the server is allowed to support TLS 1.0, then it should seems
> >> reasonable for it to negotiate TLS 1.0 with a client that sent an
> >> SSL2-compatible TLS 1.0 ClientHello.
> > 
> > The fact
> > that some clients are EOL and might not do connect in a way that will
> > work forever is not something worth worrying about. I don't think it's
> > unreasonable to expect that 20 years later the "new" hello format should
> > be mandatory.
> > 
> > SSL2 messages should not be tolerated at this point if we want TLS 1.3 to
> > be considered a specification for a modern security protocol
> > implementation.
> 
> Like I said in my previous message, I do think that for TLS 1.3,
> SSL2-compatible ClientHellos must not be used since they don't allow
> extensions. Further, it is better for the TLS 1.3 spec to remove all
> the text describing the SSL2-compatible hello stuff, regardless of
> whether or not supporting SSL2-compatible-ClientHello for TLS
> 1.0/1.1/1.2 is explicitly prohibited or not.

I'm hesitant to even mention it, but obviously my next most preferred route is 
obviously to do that and make acceptance of an SSL2 hello for older TLS versions 
a SHOULD NOT rather than a MUST NOT. That, however, is basically just RFC 6176 
with a wag of a finger thrown in.

If the TLS WG was doing the proper thing, namely writing a TLS 1.3 that was just 
an update of TLS designed to make implementing modern security easier and saving 
other changes for TLS 1.4, then I would probably agree with your position. It's 
not though; HTTP/2 is having to be released with a messy hack to attempt to make 
TLS 1.2 palatable. The response I got to suggesting a more iterative approach 
was that people wanted to fix all the problems and get it right. That's a bit of 
a contradiction with considering this hello format valid for any use.

There have been bugs caused by supporting this and it should be mandated to no 
longer be usable for all implementations. Anyone actually relying on it and not 
capable of flipping the client-side switches needed to stop it is not likely to 
be a candidate for early adoption of TLS 1.3, anyway.


Dave