IETF Logo Mail Archive

Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1.1"

Peter Gutmann <pgut001@cs.auckland.ac.nz> Fri, 03 May 2019 17:30 UTC

Return-Path: <pgut001@cs.auckland.ac.nz>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 037B11202D0 for <tls@ietfa.amsl.com>; Fri, 3 May 2019 10:30:47 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.2
X-Spam-Level:
X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uRzpWyo9-2rA for <tls@ietfa.amsl.com>; Fri, 3 May 2019 10:30:45 -0700 (PDT)
Received: from mx4-int.auckland.ac.nz (mx4-int.auckland.ac.nz [130.216.125.246]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA42B1202C9 for <tls@ietf.org>; Fri, 3 May 2019 10:30:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1556904645; x=1588440645; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=FktJ5CKG1hb4l3jmBZWxB2ow8YQ7N59w78OvKzXt3ao=; b=BgHsETv3KuHcn0a9q5RwNpfbhc9fM2eVSsHRe9uQy2TZDQmIwKznbcZW JbuxgDrAsMEj0hpZQ7w1f72d+1CiWQxcT/Imauuga6/M+qBq8gxfimCsC F8HZ/wg2N/rdaPwpVL0WRI1nPa6bvLA8cXcPzzhlVHSLzCM/4rZb0kN8X eGOS1RDQW2VKtuK8AXPpae5TGdze3439911Wb6DbYCqE1AYw8RZRG4sID FFn5Uc7h5tbC6alE+54RlPQ9BQtv68VwnQaA+bDNNCo7gbTCdKE7A3/Qz /7XzbPgma2rhtDYFkC3pMrGTMtRX5OBUHScCt30gDEl/rmTWZjeke3b4n Q==;
X-IronPort-AV: E=Sophos;i="5.60,426,1549882800"; d="scan'208";a="60192461"
X-Ironport-HAT: MAIL-SERVERS - $RELAYED
X-Ironport-Source: 10.6.2.3 - Outgoing - Outgoing
Received: from smtp.uoa.auckland.ac.nz (HELO uxcn13-ogg-b.UoA.auckland.ac.nz) ([10.6.2.3]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 04 May 2019 05:30:39 +1200
Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-ogg-b.UoA.auckland.ac.nz (10.6.2.3) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Sat, 4 May 2019 05:30:39 +1200
Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.5]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.5]) with mapi id 15.00.1395.000; Sat, 4 May 2019 05:30:38 +1200
From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: Benjamin Kaduk <bkaduk@akamai.com>
CC: Hubert Kario <hkario@redhat.com>, "tls@ietf.org" <tls@ietf.org>, "mrex@sap.com" <mrex@sap.com>
Thread-Topic: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1.1"
Thread-Index: AQHU+8+QtjVLqWiyz0WqN1BpourjtKZM43YAgADkD4CAAGW4gIADRbgAgAMrEACAA/7YAIABDIIe//8+0QCAAMtvyg==
Date: Fri, 03 May 2019 17:30:38 +0000
Message-ID: <1556904629782.23087@cs.auckland.ac.nz>
References: <28511b10-8f6a-4394-95a9-5188130f7b58@www.fastmail.com> <7d37f7ca-e253-4c95-9cf7-2d16b0b6a0aa@www.fastmail.com> <20190430234952.21F5C404C@ld9781.wdf.sap.corp> <5441930.X76MtM1CnQ@pintsize.usersys.redhat.com> <1556902416424.28526@cs.auckland.ac.nz>,<20190503172022.GH4464@akamai.com>
In-Reply-To: <20190503172022.GH4464@akamai.com>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [130.216.158.4]
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/wKVnx4L0SKspqmipfykkrJ2Wktw>
Subject: Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1.1"
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 03 May 2019 17:30:47 -0000

Benjamin Kaduk <bkaduk@akamai.com> writes:

>I'll make the obligatory note that SHA-2 is fine

Sure, and that was the really strange thing with TLS 1.2, why not just say
SHA-2 or better only, rather than adding mechanisms that were much, much
weaker than its predecessors?  So the simple fix is just to use SHA-2 only for
TLS 1.2.

>if someone does change their system, are really going to recommend they go to
>TLS 1.0 with MD5||SHA1 rather than TLS 1.2 with SHA2?

That would be one argument for an RFC, MUST SHA-2 only or MUST NOT MD5 and
SHA-1 in 1.2.  Which is pretty much what TLS-LTS says.  Or at least it takes
the SHA-2-suites-mandatory path which implies no MD5 or SHA-1, I guess I
should also add an explicit MUST NOT MD5 and SHA-1.

Having said that, given an RFC saying MUST NOT 1.0 and 1.1 which is what the
original discussion was about, why not also add MUST NOT MD5 and SHA1 in TLS
1.2 to the text?

Peter.

v2.23.0 | Report a Bug | By Email