Re: [TLS] Confirming consensus: TLS1.3->TLS*

Peter Gutmann <> Sat, 19 November 2016 02:41 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 9593E12951B for <>; Fri, 18 Nov 2016 18:41:10 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -5.697
X-Spam-Status: No, score=-5.697 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-1.497] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id tKh_G9DgEHRz for <>; Fri, 18 Nov 2016 18:41:07 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id CF3B8129439 for <>; Fri, 18 Nov 2016 18:41:06 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;;; q=dns/txt; s=mail; t=1479523266; x=1511059266; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=NTi/bEP5QLehHvw9ZS3x8n5YcSqsfKKFYOMVMFgEJLQ=; b=rlr+Xv3olxxgQaIeVGlQns8IhNCyU4dzr7amxtdcg6cBP4ex0rETd/gO DVFRDO1VxXZZIioZ51jhK1YaG48tlYdI6VKq150Es77k9MfbjKf53J9tc AQNGgjzupjDhX16eDCtjDBiyadcKuZzT1zwaMxY/RDcrr6NyPQ7nDDP1C GOHDgUaxmjHPTOqL9Au/noGxl8MiBJirQaqmhwPt6oTtMH6tREAOcA8sb cxATPQ1ucgNYy7y7oxvJyjBc5hl0X78Z8Y9VGeusBuhzj1EVOGBgpXTQW t/n4lN1xmasd8EsZTqY35Z62aCyhwZX1bkTFffec4SrOG9CG5caMegGuQ A==;
X-IronPort-AV: E=Sophos;i="5.31,513,1473076800"; d="scan'208";a="115889384"
X-Ironport-Source: - Outgoing - Outgoing
Received: from (HELO ([]) by with ESMTP/TLS/AES256-SHA; 19 Nov 2016 15:41:05 +1300
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.1178.4; Sat, 19 Nov 2016 15:41:04 +1300
Received: from ([]) by ([]) with mapi id 15.00.1178.000; Sat, 19 Nov 2016 15:41:04 +1300
From: Peter Gutmann <>
To: Ilari Liusvaara <>
Thread-Topic: [TLS] Confirming consensus: TLS1.3->TLS*
Thread-Index: AQHSQUFcD667DaatoU6RNleDGo1T66Ddz30AgADmRXP//1ILgIABkg4f
Date: Sat, 19 Nov 2016 02:41:04 +0000
Message-ID: <>
References: <> <> <>, <>
In-Reply-To: <>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: []
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <>
Cc: "<>" <>
Subject: Re: [TLS] Confirming consensus: TLS1.3->TLS*
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sat, 19 Nov 2016 02:41:10 -0000

Replying to several messages at once to save space:

Ilari Liusvaara:

>One can downnegotiate TLS 1.3 to TLS 1.2.

Ah, you're obviously a fan of Steve Wozniak humour.  When someone asked him
whether it was possible to upgrade from an Apple II+ to an Apple IIe, he
similarly said "yes, you unplug the power cable from the II+, throw it away,
and plug the IIe into the newly-vacated power cable".

Christian Huitema:

>I prefer TLS 1.3, because is signals continuity with the ongoing TLS
>deployment efforts.

Maybe it's just me, but wouldn't the fact that they're both called TLS sort of
indicate that there's continuity there?

Dave Kern:

>I'm in favor of TLS 4, and ignoring the minor version number (in the friendly
>text string, not the protocol field) moving forward.

That's actually a good point, "TLS 4" provides a single, clean number for people
to remember.  Even a CTO or auditor should be able to get that one right without
having to look up a table in a book to see that 1.3 > v3.