Re: [TLS] consensus on backwards compatibility changes

[Florian Weimer <[e-mail]>]

On 01/27/2015 12:31 AM, Dave Garrett wrote:
> With regard to this topic, please see the previous discussion on list. (the "drop obsolete
> SSL 2 backwards compatibility" thread) Implementers have specifically pushed back against
> dropping all SSL 2 stuff, in particular because they think it is valid to still negotiate TLS 1.2
> using an SSL version 2.0 client hello.

But if you do this, the handshake uses SHA-1 only, per section 7.4.1.4.
 So while it was possible to negotiate a fully-fledged TLS 1.1
connection starting from an SSL 2.0 Client Hello, that's no longer
possible with TLS 1.2—you'll end up with likely weaker handshakes in
some cases (OID || SHA-1 in the ServerKeyExchange signature vs MD5 ||
SHA-1 in TLS 1.1 and earlier or, say, OID || SHA-256 with the extension
and TLS 1.2).  Sending the supported_signature_algorithms extension is
optional according to the specification, but not optional in the spirit.

-- 
Florian Weimer / Red Hat Product Security