Re: [TLS] drop obsolete SSL 2 backwards compatibility from TLS 1.3 draft

[Kurt Roeckx <[e-mail]>]

On Mon, Dec 22, 2014 at 07:45:35PM -0500, Dave Garrett wrote:
> I've submitted a straightforward PR to remove the SSL 2 backwards compatibility 
> section from the current TLS 1.3 draft:
> 
> https://github.com/tlswg/tls13-spec/pull/105
> 
> SSL 2.0 backwards compatibility was previously deprecated in TLS 1.2 (2008) and 
> was warned to be "phased out with all due haste". RFC 6176 (2011) prohibits it 
> entirely. It's a section of obsolete complexity still in the draft.
> 
> The PR replaces the section with a simple "MUST NOT" send or accept for TLS 1.3 
> implementations.

I'm having mixed feelings about this.

It's saying that you should refuse a connection from a client that
supports TLS 1.0 but set it up using a SSLv2 compatible client
hello.  If TLS 1.0 is still acceptable, why would you refuse such
a connection?

On the other hand if you do receive such a client hello you're
likely talking to old software that most likely isn't support
anymore and might have various security issues.  It might be a
good indication of clients you prefer not to talk to.


PS: I recently actually removed all the SSLv2 support from OpenSSL
(in master) except for supporting receiving an SSLv2 compatible
client hello.


Kurt