IETF Logo Mail Archive

Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1.1"

Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com> Mon, 06 May 2019 17:51 UTC

Return-Path: <kathleen.moriarty.ietf@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C88412008A for <tls@ietfa.amsl.com>; Mon, 6 May 2019 10:51:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Level:
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U-xdzQx4rvMt for <tls@ietfa.amsl.com>; Mon, 6 May 2019 10:51:19 -0700 (PDT)
Received: from mail-oi1-x22b.google.com (mail-oi1-x22b.google.com [IPv6:2607:f8b0:4864:20::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 58D44120047 for <tls@ietf.org>; Mon, 6 May 2019 10:51:19 -0700 (PDT)
Received: by mail-oi1-x22b.google.com with SMTP id 143so10263082oii.4 for <tls@ietf.org>; Mon, 06 May 2019 10:51:19 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=UfWpg3PgFbCNMaoEhgS+XxvKRXfkw4RExvLAx1eOi7s=; b=jArGbECBz7+3bjuFh/Z0HBFWSMIseubXDCNwYFPIauPxjFSbT0epW2ra84p0AYXS79 9bt5MpfdaXFg+F6X8Yu77Lv6tW8LKpDatwA3FVYqQvBR+4Sb0Y3EUXtQd1UonrDhnu91 AxIa3Sdk1MPooHKRFzEF3ciXSl12LJrAQslWBtN3u8od4UyvW9fQlrcT2O+Puju5n8pj 7nwM5EAnLIBBzF+9bfxVMbxB2JZZwzS+VpFhwrTbTMrz/EtVZDQXyFqtd9vUGbivSBzP 3D4Wrj4dPe5JtTLjwUJ1eUpJ/wTIzf2Ju00Cktl8Tz2OiGFmbYS/V75lGjZEvgJmbEDk 5saQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=UfWpg3PgFbCNMaoEhgS+XxvKRXfkw4RExvLAx1eOi7s=; b=OZRfbtucQKHuWORtZuq7ao//MgvOvASPzMPhdtoUTBaBuUrQAkMPkI6so8ZAuezBIB tXuEA+liD3a6WNHo0CjOQgX25qiw1mr/EDNDnm+hNN7OqWP8nc9vDj425j8W0WjWNJM8 z7iKxYajbmCh0q9HW2HYrJxvz1LovIT3xtcNVRo7VIf9UDPJqRny/OPlf7rlnBv2qt3Y kz7UOg8RlD91++4rLngg6adEh1sKOC3ha3fE4t6CUVN9DagkBuRRdaIw0FDM2+Q3WbDj TIU+Kr3uU6/31/XFob21YZJPLMqkFafROlyqFKPfJIZqam67KnAKVgu/lA8GhVFs/6DB 859Q==
X-Gm-Message-State: APjAAAVszG3NpBhYyU44Hrm7nfX0BNQxgLeqkqVZdPJtvU3VwhpI1m5S hQoZUeYDjclwLjxHbvuKJf7eJ9a0n/rLKS3BbV0=
X-Google-Smtp-Source: APXvYqy4cFpuIHGIU/VmpOtJt+AJ8SxkHNZ3KQJMTwW73evWonywHLqB9auRb4Mu8XxFq6+jSu481XgjobZxhkyee+Q=
X-Received: by 2002:aca:5a07:: with SMTP id o7mr1977173oib.114.1557165078734; Mon, 06 May 2019 10:51:18 -0700 (PDT)
MIME-Version: 1.0
References: <28511b10-8f6a-4394-95a9-5188130f7b58@www.fastmail.com> <20190503172022.GH4464@akamai.com> <1556904629782.23087@cs.auckland.ac.nz> <16747558.couhpb2nsq@pintsize.usersys.redhat.com> <785E42E7-83FB-411F-8726-989CC8B734BC@ll.mit.edu>
In-Reply-To: <785E42E7-83FB-411F-8726-989CC8B734BC@ll.mit.edu>
From: Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>
Date: Mon, 06 May 2019 13:50:42 -0400
Message-ID: <CAHbuEH65=xJJr4dK=UJBMgaWFZ8h8jwtLt+Nb-jGHYB_RsjcHQ@mail.gmail.com>
To: "Blumenthal, Uri - 0553 - MITLL" <uri@ll.mit.edu>
Cc: "tls@ietf.org" <tls@ietf.org>
Content-Type: multipart/alternative; boundary="0000000000005ff42605883bbff5"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/iIlTQkaBbwmEbOkwAVB4FGPP52Q>
Subject: Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1.1"
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 06 May 2019 17:51:22 -0000

On Mon, May 6, 2019 at 1:45 PM Blumenthal, Uri - 0553 - MITLL <
uri@ll.mit.edu> wrote:

> On 5/6/19, 7:22 AM, "TLS on behalf of Hubert Kario" <tls-bounces@ietf.org
> on behalf of hkario@redhat.com> wrote:
>     > Sure, and that was the really strange thing with TLS 1.2, why not
> just say
>     > SHA-2 or better only, rather than adding mechanisms that were much,
> much
>     > weaker than its predecessors?  So the simple fix is just to use
> SHA-2 only
>     > for TLS 1.2.
>
>     I don't know as I wasn't there when that was discussed, but one reason
> could
>     be the same as the problems we are facing now with RSA-PSS in TLS 1.3:
>     smartcards and HSMs that are limited to old algorithms.
>
> HSMs are more likely than not to support SHA-2. Smartcards rarely perform
> hash themselves, relying on the software that uses them.
>
>
>     Also, don't forget that signature_algorithms, at least in theory[1],
> was
>     supposed to also influence server certificate selection, and SHA-1 was
> used in
>     vast majority of certificates in PKI.
>
> Alas. Only in some (albeit large) enclaves.
>

Is this better suited for another (short) draft?

Best,
Kathleen

>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>


-- 

Best regards,
Kathleen

v2.23.0 | Report a Bug | By Email