Re: [TLS] consensus on backwards compatibility changes

[Dave Garrett <[e-mail]>]

On Sunday, January 25, 2015 03:03:27 pm Kurt Roeckx wrote:
> On Tue, Dec 30, 2014 at 05:03:03AM -0500, Dave Garrett wrote:
> > PR #105 remove SSL 2 backwards compatibility section & prohibit SSL negotiation
> > https://github.com/tlswg/tls13-spec/pull/105
> 
> Doesn't that "or accept" prevent the previous sentence?  And isn't
> the rest already covered by the first sentence?

The SSL2 CLIENT-HELLO format can be used with TLS 1.0 (version {3,1}).

Explaining each part:

> | Implementations MUST NOT send an SSL version 2.0 compatible CLIENT-HELLO.

Regardless of what versions are in play, the SSL2 format is not allowed to be sent.
It can optionally still be accepted by servers, however, only for backwards compatibility.

> | Implementations MUST NOT negotiate TLS 1.3 or later using an SSL version 2.0 compatible
> | CLIENT-HELLO. Implementations MAY accept an SSL version 2.0 compatible CLIENT-HELLO in
> | order to negotiate older versions of TLS, however this is not recommended.

The old format can be used to negotiate TLS 1.0-1.2, but not 1.3+ or SSL.
Servers are not required to support this and can ignore them if preferred.

> | Implementations MUST NOT send or accept any records with a version less than { 3, 0 }.

Nothing stating a version for SSL2 or any bogus versions below SSL3 are allowed.
A v2 format hello with a TLS 1.0 version is unfortunately permitted.
Dropping support for this is an open issue:
https://github.com/tlswg/tls13-spec/issues/113

The minimum version tolerated here is for SSL3 due to the requirement to accept
record layer versions of any {3,X} for backwards compatibility. Hello record layer
versions mean pretty much nothing in current practice.


Dave