Re: [TLS] drop obsolete SSL 2 backwards compatibility from TLS 1.3 draft

[Dave Garrett <[e-mail]>]

On Friday, December 26, 2014 06:26:25 pm Kurt Roeckx wrote:
> Isn't it up to the implementations to decide if they still wish to
> support it?  Does it do any harm to support it other then possible
> talking to outdated software?
> 
> (It currently seems to be about 150 lines in OpenSSL, and it seem
> clear to me that it's just to support that.)

It's always possible for some implementation to have a bug in how it handles 
hellos. Having to decipher which is which is not as clean as one would hope. 
Just because it's probably being done correctly now, doesn't mean some (new) 
implementation couldn't do something bad here. If there is a problem, it's 
probably not going to be properly tested, seeing as it's an obsolete format. 
It's yet another thing to worry about.

> Even if TLS 1.3 reduces complexity, it's not suddenly going to
> make any implementation less complex.   I think it's likely going
> to make things more complex.   It's not like we're going drop
> support for the older protocols at the same time.  We'll add one
> more that is different then the others.

Well, strictly speaking, the goal is to add as little new complexity as 
possible, in total. Dropping SSL3 support is at least another drop in 
complexity, as well.

> > Refusing to connect to these old clients will also, hopefully, get some
> > of them upgraded to new ones that actually work with modern protocols.
> 
> Or prevent the adoption of the new software because it breaks
> things.

Anyone using software that old has probably already made that choice. :/

> I would also like to get rid of TLS 1.0.  It's just not realistic
> to do this at this point in time.  Only about 50% of the http
> servers support TLS 1.2 currently.

I agree. I'm certainly not in favor of an SSL2/3 style prohibition RFC, or 
anything. I'm just saying that it would be far better to attempt to put some 
pressure on them rather than just waiting around. Unfortunately, I admit that 
changing UIs to indicate HTTP as insecure, and releasing HTTP/2 and 
letsencrypt.org are prerequisites to getting serious about not tolerating out-
of-date security. An official "please stop using TLS 1.0" from the IETF is about 
the best one could hope for, at the moment. I guess we'll get that to some 
degree with:
https://tools.ietf.org/html/draft-ietf-uta-tls-bcp-08


Dave