Re: [TLS] Deprecating SSLv3

[Nikos Mavrogiannopoulos <[e-mail]>]

----- Original Message -----
> Yes, I would be sad if we couldn't say anything more definitive about
> the use of TLS on the big 'I' Internet.  People are of course welcome
> to use rot13 to protect their proprietary communications, noting that
> they won't remain proprietary long if they do.  The same applies here.
> I merged Alfredo's text, and though I've proposed some minor
> grammatical changes, you can see the results live here:
>   https://unicorn-wg.github.io/sslv3-diediedie/

I believe that comparison is way out of proportion, for the following reasons:
* First SSL 3.0 is still in use - at least my experience shows many
SSL 3.0 only services on a typical network (it did only take few hours to get
the first bug report when SSL 3.0 was disabled in the development branch of Fedora),
* there is no new attack on SSLv3 (the attack poodle uses on SSLv3 was already known 10
years ago), and the TLS protocol negotiation is still considered secure enough to
negotiate the latest version supported between two parties
* SSLv3 is orders of magnitude better than plaintext (or rot13).

The latter shows the actual dilema many face at the moment, which is not whether to replace 
SSL 3.0 with TLS 1.2, but what to do to interoperate with the services that can only use 
SSL 3.0 or plaintext. You may choose to ignore them of course but that would also render
that draft not applicable to them.

Note here that I am not advocating the use of SSL 3.0, but it would be beneficial for 
everyone if that draft also described a path which leads to the abolishment of SSL 3.0
in a secure way, for the ones that cannot avoid its use. That highlights the main difference 
with SSL 2.0 and rfc6176; there were no SSL 2.0-only services when it was published.

regards,
Nikos