Re: [TLS] Confirming consensus: TLS1.3->TLS*

[Hubert Kario <[e-mail]>]

On Friday, 2 December 2016 14:04:36 CET Salz, Rich wrote:
> Nobody knows the difference tween 1.0 1.1 1.2
> 
> SSL 4 or SSL 4.0 is a bigger number than 1.x and uses the same term that
> everyone, including our industry, uses.  If someone sees "TLS 1.2" and
> thinks "wow, that's so much worse than SSL 4 because the number is so much
> smaller," then isn't that a good thing, increasing pressure to move
> forward?

Or he thinks "stupid 'experts' pushing stuff down our throats by inflating 
numbers".

Certainly not all of them will think the same thing.
 
> I would much rather spend time explaining "no, really TLS 1.2 is not that
> bad" than have to spend more decades explaining "no, really, that thing the
> world things of as SSL is really TLS and 1.3 is really better than what you
> think you should have."

Except in 10 years we may be explaining that "no, TLS 1.3/2.0/4/2017 alone is 
completely insecure, you need to deploy post-quantum crypto on TLS 
1.2/2.0/4/2017"
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic