Re: [TLS] Prohibiting SSL 3.0

[Manuel Pégourié-Gonnard <[e-mail]>]

On 29/10/2014 12:30, Manuel Pégourié-Gonnard wrote:
> On 29/10/2014 12:18, Florian Weimer wrote:
>> * Hubert Kario:
>>
>>> Even the TLS 1.3 draft says that a client SHOULD NOT send a SSLv2 compatible 
>>> client hello with server support being stated as MAY. Similarly, the value for 
>>> SSL 3.0 for record layer in client hello is mentioned as the backwards 
>>> compatible option with no mention of recommendation against it.
>>>
>>> I'd say an RFC that updates them to a MUST NOT/SHOULD NOT (respectively for 
>>> SSLv2 and SSLv3, at the very least) is not entirely out of scope...
>>
>> I think the SSLv2 compatible client hello is unrelated to the protocol
>> version advertised by the client, but I might be mistaken about that.
>>
> Unless I'm mistaken, there is no point for a client to send a SSLv2 compatible
> ClientHello unless the client is prepared to actually negotiate SSLv2. If think
> if fair to say that client MUST NOT do that.
> 
> OTOH, accepting an SSLv2 ClientHello on the server makes sense even if the
> server will never negotiate SSLv2. So I guess the MAY here is ok.
> 
... which is exactly what RFC 6176 says (thanks Bodo for mentioning it, I
totally forgot about it). So maybe the TLS 1.3 draft should just be updated to
refer to RFC 6176 here?

Manuel.