Re: [TLS] Working Group Last Call for draft-ietf-tls-sslv3-diediedie-00
Hubert Kario <hkario@redhat.com> Thu, 29 January 2015 10:18 UTC
Return-Path: <hkario@redhat.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D25E1A0149 for <tls@ietfa.amsl.com>; Thu, 29 Jan 2015 02:18:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.912
X-Spam-Level:
X-Spam-Status: No, score=-6.912 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NuZ7GPxtWbXS for <tls@ietfa.amsl.com>; Thu, 29 Jan 2015 02:18:47 -0800 (PST)
Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 524C91A00E4 for <tls@ietf.org>; Thu, 29 Jan 2015 02:18:47 -0800 (PST)
Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id t0TAIkg2004295 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL) for <tls@ietf.org>; Thu, 29 Jan 2015 05:18:46 -0500
Received: from pintsize.usersys.redhat.com (dhcp-0-172.brq.redhat.com [10.34.0.172]) by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t0TAIjZN016530 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NO) for <tls@ietf.org>; Thu, 29 Jan 2015 05:18:46 -0500
From: Hubert Kario <hkario@redhat.com>
To: tls@ietf.org
Date: Thu, 29 Jan 2015 11:18:44 +0100
Message-ID: <1504300.ArI2OzS8We@pintsize.usersys.redhat.com>
User-Agent: KMail/4.14.3 (Linux/3.17.8-200.fc20.x86_64; KDE/4.14.3; x86_64; ; )
In-Reply-To: <20150128231009.GA25284@roeckx.be>
References: <9A043F3CF02CD34C8E74AC1594475C73AAF694DD@uxcn10-tdc05.UoA.auckland.ac.nz> <20150128231009.GA25284@roeckx.be>
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"
X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/rjGJbcvLTMv4hO_3HBkjywc53WE>
Subject: Re: [TLS] Working Group Last Call for draft-ietf-tls-sslv3-diediedie-00
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 29 Jan 2015 10:18:49 -0000
On Thursday 29 January 2015 00:10:09 Kurt Roeckx wrote: > On Wed, Jan 28, 2015 at 08:06:32AM +0000, Peter Gutmann wrote: > > Dave Garrett <davemgarrett@gmail.com> writes: > > >Is it at all practical to publish an TLS RFC stating intent to deprecate > > >TLS 1.0/1.1 within some fixed timeframe? I think everyone would rather > > >phase it out then have to "be the hitman" each time. > > > > I'm happy to have 1.0 phased out, but I'd make the baseline 1.1, not 1.2. > > 1.1 fixes the major issues with SSL (no support for extensions, no > > per-message IV) without being a major rewrite like 1.2 is. There's an > > awful lot of stuff outside of the browser world that can move to 1.1 if > > it isn't there already, but that's going to take a long, long time to > > move to 1.2 if it ever does. Killing 1.0 (which is really just SSL > > IETF-ised) is a pretty straightforward step if you're already getting rid > > of SSL because it has most of the same problems, but deprecating 1.1 is > > going a bit too far. > > For > some reason 1.2 actually seems to better support than 1.1. There > are a strange set of servers out there that support 1.0 and 1.2 > but not 1.1. bug in openssl, SSL_OP_ALL from OpenSSL 1.0.0 did include SSL_OP_NO_TLSv1_1 when run against OpenSSL 1.0.1: https://rt.openssl.org/Ticket/Display.html?id=2802&user=guest&pass=guest which you should know, given that you have submitted the above bug report ;) -- Regards, Hubert Kario
- [TLS] Working Group Last Call for draft-ietf-tls-… Joseph Salowey
- Re: [TLS] Working Group Last Call for draft-ietf-… Andrei Popov
- Re: [TLS] Working Group Last Call for draft-ietf-… Xiaoyin Liu
- Re: [TLS] Working Group Last Call for draft-ietf-… Martin Thomson
- Re: [TLS] Working Group Last Call for draft-ietf-… Geoffrey Keating
- Re: [TLS] Working Group Last Call for draft-ietf-… Dave Garrett
- Re: [TLS] Working Group Last Call for draft-ietf-… Martin Thomson
- Re: [TLS] Working Group Last Call for draft-ietf-… Stephen Checkoway
- Re: [TLS] Working Group Last Call for draft-ietf-… Aaron Zauner
- Re: [TLS] Working Group Last Call for draft-ietf-… Martin Thomson
- Re: [TLS] Working Group Last Call for draft-ietf-… Dave Garrett
- Re: [TLS] Working Group Last Call for draft-ietf-… Yuhong Bao
- Re: [TLS] Working Group Last Call for draft-ietf-… Hanno Böck
- Re: [TLS] Working Group Last Call for draft-ietf-… Aaron Zauner
- Re: [TLS] Working Group Last Call for draft-ietf-… Dave Garrett
- Re: [TLS] Working Group Last Call for draft-ietf-… Michael Clark
- Re: [TLS] Working Group Last Call for draft-ietf-… Peter Gutmann
- Re: [TLS] Working Group Last Call for draft-ietf-… Kurt Roeckx
- Re: [TLS] Working Group Last Call for draft-ietf-… Martin Rex
- Re: [TLS] Working Group Last Call for draft-ietf-… Joe Hall
- Re: [TLS] Working Group Last Call for draft-ietf-… Hubert Kario
- Re: [TLS] Working Group Last Call for draft-ietf-… Kurt Roeckx
- Re: [TLS] Working Group Last Call for draft-ietf-… Hubert Kario
- Re: [TLS] Working Group Last Call for draft-ietf-… Peter Gutmann
- Re: [TLS] Working Group Last Call for draft-ietf-… Bodo Moeller
- Re: [TLS] Working Group Last Call for draft-ietf-… Martin Thomson
- Re: [TLS] Working Group Last Call for draft-ietf-… Stephen Checkoway
- Re: [TLS] Working Group Last Call for draft-ietf-… Joseph Salowey
- Re: [TLS] Working Group Last Call for draft-ietf-… Erik Nygren
- Re: [TLS] Working Group Last Call for draft-ietf-… Martin Thomson
- Re: [TLS] Working Group Last Call for draft-ietf-… Joseph Salowey
- Re: [TLS] Working Group Last Call for draft-ietf-… Martin Thomson
- Re: [TLS] Working Group Last Call for draft-ietf-… Martin Rex
- Re: [TLS] Working Group Last Call for draft-ietf-… Watson Ladd