Re: [TLS] [Last-Call] Last Call: <draft-ietf-tls-oldversions-deprecate-09.txt> (Deprecating TLSv1.0 and TLSv1.1) to Best Current Practice

["Ackermann, Michael" <[e-mail]>]

Thanks Ted
And no, I do not think that you do not take this seriously.   I think we all appreciate your  related thoughts and concerns and I thank you for expressing them.  

I do think you have misunderstood much of what has been said here.    Since that is likely my fault, let me try to clarify by responding to directly to many of your statements below: 

1. Enterprises do not expect nor want IETF to be responsible for their planning for changes in technology.    But when IETF decides to change protocols or deprecate existing technology of any sort,  it would be beneficial to all if our needs were considered and we were aware of related developments, in an effective and timely fashion.       
2. No one at any enterprise I am aware even remotely thinks that IETF is making changes to cause us or anyone else trouble.   Not even sure why you would say this.    The IETF is not as well understood by enterprises as many of us would like,  but in no way is it considered a troublemaker, adversary or any of the other things you say below that would make us seem at odds.   This area of understanding and communication is another area I hope we can collectively improve, by getting enterprises more engaged,  in some fashion or another.  
3. No one I am aware of is saying do not deprecate protocols that are obsolete..........    Not TLS or any others.    We understand and recognize this need and support it.    My comments in this thread were in regards to related timing and the realization that large organizations cannot always be as nimble as most of us technicians would like.   And to a small degree I described WHY most enterprises require more time for changes in many cases. 
4.  I don't think I or anyone else has said such changes will take 12 years as you stated.   However, 1-2 is usually a base due to budget and planning cycles at large orgs. 
5. I appreciate your advice on which vendors to deal with and how, but I do not view this as a vendor issue and do not have any current issues with any vendors on any related issues.    But I do agree, as stated several times in this Email chain,  that I would like to see enterprise requirements and engagement much earlier on in IETF processes.    You mention 12 years once again referring to how late we are and I am again not sure where that comes from, but I very much hope for earlier on involvement, in the future. 
6. Once again, in NO way am I or anyone else saying that the IETF should back off and not say these protocols or any others are not obsolete, not problematic or should not be deprecated.     

I hope the above makes sense and clarifies much of what I was trying to say.     IMHO we have taken this as far as we can or should on this list topic,  but hopefully improving enterprise and IETF communication/involvement discussions can be continued on other lists or in other fashions, as has been suggested by Barbara and Deborah.    Assuming this occurs, and I hope it does,  I hope you can be involved, as you are a greatly respected member of the IETF community and could add a lot to that discussion.  

Thanks again for taking this seriously!

Mike


-----Original Message-----
From: Ted Lemon <[e-mail]> 
Sent: Friday, December 4, 2020 12:21 PM
To: Ackermann, Michael <[e-mail]>
Cc: Stephen Farrell <[e-mail]>; BRUNGARD, DEBORAH A <[e-mail]>; Rob Sayre <[e-mail]>; Peter Gutmann <[e-mail]>; Watson Ladd <[e-mail]>; Eliot Lear <lear=[e-mail]>; [e-mail]; [e-mail]; [e-mail]; STARK, BARBARA H <[e-mail]>; [e-mail]
Subject: Re: [Last-Call] [TLS] Last Call: <draft-ietf-tls-oldversions-deprecate-09.txt> (Deprecating TLSv1.0 and TLSv1.1) to Best Current Practice

[External email]


Michael, fundamentally the disconnect here seems to be that the IETF could ever be responsible for helping businesses to figure out how to plan for changes in technology _other_ than by doing work like this. Deprecating old versions of protocols is exactly what the IETF should be doing. This is how the signal burbles up through your vendors to you.

I think it's useful for folks from enterprises to show up and pay attention to this, but it's important to recognize that the reason we are making these changes is not to cause you trouble. It's to try to help you to avoid trouble. If you come to the IETF with the goal in mind to get us to not deprecate protocols that are obsolete and have known attacks that the newer version of the protocol fixes, that's just not the right model. We aren't the adversary here. The IETF is not causing the protocol to be obsolete. The IETF is simply observing that the protocol is in fact obsolete, and it's past time to stop using it. That is, we are observing a fait accompli over which we have no control.

The reason we do this is in the hope that you will do what you need to do to protect your customers from this fait accompli. The only thing that we could do differently is to not try to alert you to this problem.

When it takes twelve years for (some) enterprises to upgrade to the new version of a protocol, that's an indication of some kind of systemic problem. It's not a problem the IETF can solve. What I heard you saying at the beginning of this problem was that the IETF needed to understand your operational realities. But the implication is that we don't understand your operational realities. That's not what's going on here. What's going on here is that we simply can't do anything about your operational realities.

The fact that we can't do anything about them does not mean that TLS 1.1 shouldn't be deprecated. It just means that you, not the IETF, need to take the next step: now that we have told you TLS 1.1 is so obsolete that nobody should be using it anymore, you need to integrate that into your planning. You need to communicate with your vendors. You need to budget for whatever your plan of action is going to be. If you find yourself in an untenable situation because of this, you need to learn from that and change your planning methodology so that you aren't caught up short next time a protocol needs to be obsoleted.

Don't do business with vendors who do not have a plan for how to deal with this problem. Get it in the purchasing agreements. Get it in the service provider contracts. Begin planning your transition to the new protocol the day it's published, or ideally as soon as you become aware that it's going to be published. Don't wait until we publish a document twelve years later saying that it's now officially obsolete.

This is a very important problem, and I'm sorry if my previous note made it seem like I don't take it seriously. I do. But it's not a problem that the IETF can solve. If the IETF were to decide not to say that the protocol is obsolete, that wouldn't solve it.  You have the problem whether we tell you you have the problem or not.



The information contained in this communication is highly confidential and is intended solely for the use of the individual(s) to whom this communication is directed. If you are not the intended recipient, you are hereby notified that any viewing, copying, disclosure or distribution of this information is prohibited. Please notify the sender, by electronic mail or telephone, of any unintended receipt and delete the original message without making any copies.
 
 Blue Cross Blue Shield of Michigan and Blue Care Network of Michigan are nonprofit corporations and independent licensees of the Blue Cross and Blue Shield Association.