Re: [TLS] drop obsolete SSL 2 backwards compatibility from TLS 1.3 draft

[Watson Ladd <[e-mail]>]

On Sun, Dec 28, 2014 at 11:44 AM, Kurt Roeckx <[e-mail]> wrote:
> On Sun, Dec 28, 2014 at 03:43:41PM +0100, Hauke Mehrtens wrote:
>> Hi,
>>
>> as even OpenSSL 0.9.8 sends such ClientHellos in the default settings, I
>> think TLS 1.3 should support the following:
>>
>> 1. TLS 1.3 Clients must only negotiate TLS 1.0 or up. I think with the
>> Poodle attack most servers and clients already deactivated SSL v3
>> support. This is draft-ietf-tls-sslv3-diediedie-00.
>> 2. A TLS 1.3 Client most not send a SSL v2 or SSL v3 ClientHello. This
>> is draft-ietf-tls-sslv3-diediedie-00.
>> 2. A TLS 1.3 server may or should accept a SSL V2 and V3 compatible
>> ClientHello, but not negotiate these protocol versions.
>
> Maybe some people would like to see that TLS 1.3 should never be
> set up using an SSLv2 compatible client hello.

I am really confused as to what the proposed v2 compatible, TLS 1.3
hello would look like. TLS 1.3 demands extension support, and the
SSLv2 and v3 protocols do not support extensions.  We've already seen
bugs and workarounds (padding extensions) resulting from continued
support of SSLv2.

There is a working version negotiation mechanism in TLS 1.0 and above
which doesn't have these issues. We should use it: a tiny handful of
old clients don't matter.

Sincerely,
Watson Ladd
>
>
> Kurt
>
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin