Re: [TLS] Analysis of Interop scenarios TLS extension RI w/MCSV

[Martin Rex <[e-mail]>]

Nelson B Bolyard wrote:
> 
> >>> That is interesting information. Would you happen to have a copy of the
> >>> last "official" spec you can send me?
> >> Netscape's official SSLv3 spec as of 2005:
> >> http://web.archive.org/web/20050207004652/wp.netscape.com/eng/ssl3/3-SPEC.HTM
> > 
> > That's pretty clear, SSLv3 did not have a provision for extending Client
> > Hello.
> > 
> >> As obvious from it's name that spec is a product of the TLS WG and
> >> the TLS WG decided to completely abandon (instead of publishing as
> >> informational RFC) that document so that it expired and vanished
> >> from the I-D repository 6 month later.
> > 
> > Seems like SSLv3 was simultaneously one of the most critical protocols
> > for net security and orphaned.
> 
> Stop right there.  Don't be led down the garden path.
> 
> Look at the parent page.  Look at
> http://web.archive.org/web/20050205162914/wp.netscape.com/eng/ssl3/


As I previously explained, I went to the Netscape WebServer in 2000
(when we acquired our OEM SSL implementation and I got the job to
make it accessible to our application), and the Netscape site search
sent me straight to the "pretty" SSLv3 spec (HTML and Postscript).

When I found a reference to a SSLv3 spec from November a few
weeks later, google did NOT find the 302 document.

So I searched through the archives of the IETF TLS mailing list,
where I finally found the document, because it had been posted
there in full.


The IETF internet-drafts repository in 1995-1998 kept only the
most recent version of a draft (deleted all previous documents),
and deleted an I-D when it expired.  The possibility to access
old internet draft versions through tools.ietf.org is something
I learned a few weeks ago.


Keeping an old version of a specification around in a MUCH
MORE promentiently fashion for 9 years tells a lot about what
Netscape thought of the draft-302.txt document.

After all, Netscape originally would have loved the IETF to
rubber stamp the original SSLv3 spec -- just that the IETF TLS WG
didn't like the rubber stamping idea in 1995/1996 -- and instead
insisted on defining a protocol named TLS backwards interoperable
with SSLv3.

So the draft302.txt document represents the start of TLSv1.0,
and not the final spec of SSLv3.


-Martin