Re: [TLS] [Last-Call] Last Call: <draft-ietf-tls-oldversions-deprecate-09.txt> (Deprecating TLSv1.0 and TLSv1.1) to Best Current Practice

Peter Gutmann <pgut001@cs.auckland.ac.nz> Tue, 08 December 2020 11:35 UTC

Return-Path: <pgut001@cs.auckland.ac.nz>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C90243A0C0A for <tls@ietfa.amsl.com>; Tue, 8 Dec 2020 03:35:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.917
X-Spam-Level:
X-Spam-Status: No, score=-1.917 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l_TFW22nyNsM for <tls@ietfa.amsl.com>; Tue, 8 Dec 2020 03:35:22 -0800 (PST)
Received: from au-smtp-delivery-117.mimecast.com (au-smtp-delivery-117.mimecast.com [124.47.189.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1519D3A0C0D for <tls@ietf.org>; Tue, 8 Dec 2020 03:35:21 -0800 (PST)
Received: from AUS01-SY4-obe.outbound.protection.outlook.com (mail-sy4aus01lp2168.outbound.protection.outlook.com [104.47.71.168]) (Using TLS) by relay.mimecast.com with ESMTP id au-mta-102-zrLFnqy4MN6XWCaWZOYY2g-1; Tue, 08 Dec 2020 22:35:16 +1100
X-MC-Unique: zrLFnqy4MN6XWCaWZOYY2g-1
Received: from SG2PR06CA0132.apcprd06.prod.outlook.com (2603:1096:1:1d::34) by SYCPR01MB4880.ausprd01.prod.outlook.com (2603:10c6:10:42::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3632.21; Tue, 8 Dec 2020 11:35:13 +0000
Received: from SG2APC01FT053.eop-APC01.prod.protection.outlook.com (2603:1096:1:1d:cafe::c6) by SG2PR06CA0132.outlook.office365.com (2603:1096:1:1d::34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3632.17 via Frontend Transport; Tue, 8 Dec 2020 11:35:12 +0000
X-MS-Exchange-Authentication-Results: spf=none (sender IP is 130.216.95.224) smtp.mailfrom=cs.auckland.ac.nz; cisco.com; dkim=none (message not signed) header.d=none;cisco.com; dmarc=none action=none header.from=cs.auckland.ac.nz
Received: from uxcn13-ogg-b.UoA.auckland.ac.nz (130.216.95.224) by SG2APC01FT053.mail.protection.outlook.com (10.152.250.240) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.3632.17 via Frontend Transport; Tue, 8 Dec 2020 11:35:12 +0000
Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-ogg-b.UoA.auckland.ac.nz (10.6.2.3) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 9 Dec 2020 00:35:10 +1300
Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.5]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.5]) with mapi id 15.00.1497.007; Wed, 9 Dec 2020 00:35:10 +1300
From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: Bill Frantz <frantz@pwpconsult.com>
CC: Eliot Lear <lear@cisco.com>, Keith Moore <moore@network-heretics.com>, "last-call@ietf.org" <last-call@ietf.org>, "tls-chairs@ietf.org" <tls-chairs@ietf.org>, "draft-ietf-tls-oldversions-deprecate@ietf.org" <draft-ietf-tls-oldversions-deprecate@ietf.org>, "tls@ietf.org" <tls@ietf.org>
Thread-Topic: [TLS] [Last-Call] Last Call: <draft-ietf-tls-oldversions-deprecate-09.txt> (Deprecating TLSv1.0 and TLSv1.1) to Best Current Practice
Thread-Index: AQHWyN+o6yOLLgx4YkCvyiF+16OpkqntGNHr
Date: Tue, 8 Dec 2020 11:35:10 +0000
Message-ID: <1607427310012.84758@cs.auckland.ac.nz>
References: <1606905451349.74964@cs.auckland.ac.nz>, <r480Ps-10146i-5D92DBE073F0406BAA96981F436B8E28@Williams-MacBook-Pro.local>
In-Reply-To: <r480Ps-10146i-5D92DBE073F0406BAA96981F436B8E28@Williams-MacBook-Pro.local>
Accept-Language: en-NZ, en-GB, en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [130.216.158.4]
MIME-Version: 1.0
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: d19d40c1-18c9-414d-a701-08d89b6d5379
X-MS-TrafficTypeDiagnostic: SYCPR01MB4880:
X-Microsoft-Antispam-PRVS: <SYCPR01MB48807C84F80CA8F9C39D933DEECD0@SYCPR01MB4880.ausprd01.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:10000
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam: BCL:0
X-Microsoft-Antispam-Message-Info: Faz6HA+2J/kKKxc2Q56nLLyTyVqrRMQYAXamPHFWT5/VoCqSiahHQBViG8HNuKVzGgsnXBhTxmDmR+bKo4z09hYk5kbgU6hHGERPvLAXjAHwe2xwDcWkJcFwIT4q3CfJju+TnGheu9Ah3eyeqmgB13IBH/OPby1t1K4124t8SVdxUfF0Ei/hF7ZUBZZOlA4K2DwC4/pcfgS6SyvQHolqMfaRSxsY+Zz+EXvT7/BKOT88n0m0b4+0qFjjbijHJKTXYex+Fj7y6YKmJkR/btNj2SjCc+wwJTE98JOwSGNESZWk2vIFxCWZ2ghACUnYkPjBlqsIU+QLYdp9vu0fIGsiwbYcyGe5mn6UiPkEh/RwefvgJIo/SPEVBYweV5HlWTE560sAAKPfhvYyrACDViXMMA==
X-Forefront-Antispam-Report: CIP:130.216.95.224; CTRY:NZ; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:uxcn13-ogg-b.UoA.auckland.ac.nz; PTR:natgate2-1.auckland.ac.nz; CAT:NONE; SFS:(4636009)(376002)(136003)(346002)(46966005)(508600001)(2616005)(4326008)(26005)(8936002)(7636003)(336012)(82310400003)(186003)(70206006)(83380400001)(36906005)(8676002)(356005)(54906003)(5660300002)(47076004)(786003)(86362001)(2906002)(70586007)(6916009); DIR:OUT; SFP:1101
X-OriginatorOrg: cs.auckland.ac.nz
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Dec 2020 11:35:12.4358 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: d19d40c1-18c9-414d-a701-08d89b6d5379
X-MS-Exchange-CrossTenant-Id: d1b36e95-0d50-42e9-958f-b63fa906beaa
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=d1b36e95-0d50-42e9-958f-b63fa906beaa; Ip=[130.216.95.224]; Helo=[uxcn13-ogg-b.UoA.auckland.ac.nz]
X-MS-Exchange-CrossTenant-AuthSource: SG2APC01FT053.eop-APC01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SYCPR01MB4880
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: cs.auckland.ac.nz
Content-Language: en-NZ
Content-Type: text/plain; charset=WINDOWS-1252
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/dC-6m6MnnSNfuaqoYUMyWhlxibs>
Subject: Re: [TLS] [Last-Call] Last Call: <draft-ietf-tls-oldversions-deprecate-09.txt> (Deprecating TLSv1.0 and TLSv1.1) to Best Current Practice
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 08 Dec 2020 11:35:25 -0000

Bill Frantz <frantz@pwpconsult.com> writes:

>I would like to have a few more examples of "Can't be taken out of
>production".

Well as a bit of a generalisation anything running an RTOS is likely to be
something that can't be taken out of production, and certainly wouldn't be
taken out of production for something as minor as a security changeover.
These are devices for which availability overrides all other concerns.  To
give an actual example from earlier this year, a risk analysis for a set of
devices included a discussion of how long and under what conditions you could
keep operating a device after it had been compromised by an attacker, because
the only thing worse than a device that was co-managed by an attacker would be
a device that wasn't functioning at all.  The presence of an attacker, while
suboptimal, was still far better than not having it operational at all.

Some examples of reasons why devices can't be easily upgraded include one I
mentioned a year or two back on this list for which the upgrade cycle, which
required a site visit for each device, ran over about ten years and the next
cycle was planned to complete in 2030 (but these things always take longer
than planned, I don't think they've even started it), and for more exotic
examples, "service calls to low earth orbit are expensive", "we can only
replace the hardware when the reactors are shut down for refuelling", and
"[suggested change] is a good idea but would involve renegotiating
international treaties", which still rates as the most solid reason-we-can't-
do-it I've ever heard.

Peter.