Re: [TLS] ban more old crap

Dave Garrett <> Thu, 23 July 2015 18:21 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id EB12A1B2B19 for <>; Thu, 23 Jul 2015 11:21:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id xVAqX3QguOn0 for <>; Thu, 23 Jul 2015 11:21:20 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:400d:c09::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 6F9D71AC41A for <>; Thu, 23 Jul 2015 11:21:18 -0700 (PDT)
Received: by qkdv3 with SMTP id v3so116381qkd.3 for <>; Thu, 23 Jul 2015 11:21:17 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113; h=from:to:subject:date:user-agent:cc:references:in-reply-to :mime-version:content-type:content-transfer-encoding:message-id; bh=rjncr9Sw1PdwmudVLvWxTBC6WUjOA0oSDAtYn8mBW1g=; b=XQacC9s2nFH6x1AvvJFB07hFkvaSnPqLyK4koRVxjp25rhgMaTrhBEN9C4xoU4hnSH G0Da+WCGzZpQl5NOCDtZE/WfJurSmrSM8W3or/jyTYtTSRs1bvvah/vT4/mKJzB7kVJS 2sgYAWX1IetvOd1ndwvk4KlmK+ZgMKS/z6lTRBKpEY6sNR2kl94YFHNhg+xTjzOANBPK MFREVDV5yc/FxOLo1EEJnS9ybgg0fa0vM9NzGbrO2o5ajdXYtOywqnYg7EFAqtWFD51H HiojqxQpUuugx6VC/bc0cLeZK5d4GPSm3QAtvr2JKDulacR1T5vH1zGUIHr+fw9kUk8E s53w==
X-Received: by with SMTP id g6mr4940527qhc.7.1437675677778; Thu, 23 Jul 2015 11:21:17 -0700 (PDT)
Received: from dave-laptop.localnet ( []) by with ESMTPSA id 128sm2751977qhg.45.2015. (version=TLSv1 cipher=RC4-SHA bits=128/128); Thu, 23 Jul 2015 11:21:17 -0700 (PDT)
From: Dave Garrett <>
To: Eric Rescorla <>
Date: Thu, 23 Jul 2015 14:21:15 -0400
User-Agent: KMail/1.13.5 (Linux/2.6.32-74-generic-pae; KDE/4.4.5; i686; ; )
References: <> <> <>
In-Reply-To: <>
MIME-Version: 1.0
Content-Type: Text/Plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Message-Id: <>
Archived-At: <>
Cc: "" <>
Subject: Re: [TLS] ban more old crap
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 23 Jul 2015 18:21:22 -0000

On Thursday, July 23, 2015 01:10:30 pm Eric Rescorla wrote:
> On Thu, Jul 23, 2015 at 7:06 PM, Stephen Farrell <>
> wrote:
> > A suggestion - could we remove mention of anything that
> > is not a MUST or SHOULD ciphersuite from the TLS1.3 document
> > and then have someone write a separate draft that adds a
> > column to the registry where we can mark old crap as
> > deprecated?
> I'm starting to lean towards this. I don't generally think of TLS 1.3 as a vehicle
> for telling people how to configure use of TLS 1.2, and I think it might be better
> to move all that stuff out.

If we've learned one thing from the past year of high-profile vulnerabilities with names and logos, it's that TLS is not really secure if you don't take into account its weakest/oldest feature that's still possible. I don't think any responsible TLS 1.3 spec can afford to not acknowledge this.

That said, if all you want to move out are things that aren't MUSTs or SHOULDs, I don't see a problem with that. (with possibly the exception of a "NOT RECOMMENDED" or two, though that's really just a synonym for "SHOULD NOT") What would that actually entail? Or, did you just mean to cut out all non-MUST/SHOULD cipher suites? I also don't see a problem with that. I just updated the list with everything. The full list can go in a separate document if we want to just focus on MUST/SHOULD support ciphers in the spec, proper.

Also on the topic of cutting out hunks of text, someone should write up a DSS/DSA removal PR. There's quite a bit of text scattered throughout the spec to handle it that we don't need anymore.