Re: [TLS] drop obsolete SSL 2 backwards compatibility from TLS 1.3 draft

[Hauke Mehrtens <[e-mail]>]

Hi,

as even OpenSSL 0.9.8 sends such ClientHellos in the default settings, I
think TLS 1.3 should support the following:

1. TLS 1.3 Clients must only negotiate TLS 1.0 or up. I think with the
Poodle attack most servers and clients already deactivated SSL v3
support. This is draft-ietf-tls-sslv3-diediedie-00.
2. A TLS 1.3 Client most not send a SSL v2 or SSL v3 ClientHello. This
is draft-ietf-tls-sslv3-diediedie-00.
2. A TLS 1.3 server may or should accept a SSL V2 and V3 compatible
ClientHello, but not negotiate these protocol versions.

I think for compatibility reasons most implementors would like to stay
compatible with old ClientHellos, but I think the RFC should not mandate
this. In 10 years TLS servers implementors are probably save to remove
support for this old OpenSSL version, Java 6 and probably more stuff.
This should be an implementors decision how long they want to stay
backwards compatible with old software as long as this does not have
negative implications on security.

Hauke

On 12/27/2014 11:54 PM, Yoav Nir wrote:
> Hi, Dave
> 
> I see a "should" from Hauke and a "should not" from you. But using RFC 2119 words like “MUST NOT” in the spec could mean one of the following things:
>  1, That an SSLv2 ClientHello with version equal to whatever we choose for TLS 1.3 (0x03,0x04?) must be rejected and the connection closed.
>  2. That any TLS 1.3 implementation MUST remove support for SSLv2 ClientHellos.
>  3. That it is no longer prudent to even perform handshakes with clients that still offer SSLv2. In this case SSLv2 support is used as a proxy for insecure peer.
> 
> In your message you said “should not”. Why do you think we need to mandate dropping this support from existing products?
> 
> Yoav
> 
> 
>> On Dec 28, 2014, at 12:39 AM, Dave Garrett <[e-mail]> wrote:
>>
>> On Saturday, December 27, 2014 05:07:12 pm Hauke Mehrtens wrote:
>>> On 12/24/2014 07:40 AM, Yoav Nir wrote:
>>>> It’s fine for us to break compatibility with these clients, but let’s not
>>>> pretend it’s some ancient technology that doesn’t exist in the market
>>>> anymore.
>>>
>>> In addition the Oracle Java Runtime Environment in Version 6 uses a SSL
>>> v2 compatible ClientHello in the default settings. It supports SSL v3
>>> and TLS 1.0. In Java JRE 7 a SSLv3 ClientHello is used by default.
>>>
>>> I think a TLS 1.3 Client must not send a SSLv2 ClientHello, but a server
>>> should understand it.
>>
>> The newest version of TLS should not be have to be written to accommodate an 8 
>> year old EOL Java version's default settings.
>>
>>
>> Dave
>