[TLS] SSL 2 CLIENT-HELLO backwards compatibility compromise

[Dave Garrett <[e-mail]>]

The previous consensus is in the draft now, so resuming discussion on
what to do with the SSL 2 CLIENT-HELLO format as was planned.

https://github.com/tlswg/tls13-spec/issues/113

I'd like to say there are roughly 3 options on how to deal with SSL 2
CLIENT-HELLO backwards compatibility in TLS 1.3 implementations.
(to reiterate, we're talking about the format defined in
https://tools.ietf.org/html/rfc5246#appendix-E.2 )


Option #0) Current draft
v2 format MUST NOT be sent ever
v2 format MUST NOT be used at all for TLS 1.3+
v2 format NOT RECOMMENDED to accept for TLS 1.0-1.2

Option #1) Ditch the format that has been deprecated for 20 years
v2 format MUST NOT be sent or accepted for any reason

Option #2) Restrict to TLS 1.0
v2 format MUST NOT be sent ever
v2 format MUST NOT be used at all for TLS 1.1+
v2 format NOT RECOMMENDED to accept for TLS 1.0


The reason I frame the choices like this is that the TLS 1.0 case was of primary discussion. The TLS 1.2 case was brought up, but seems to have way less justification. Recent discussion also suggested setting TLS 1.1 as allowed and TLS 1.2 as not, however I think focusing only on the primary case of TLS 1.0 could be much better.

There has been some limited discussion on how to proceed with deprecating TLS 1.0, and TLS 1.1 has been said to be sufficiently improved as such to not necessarily deprecate it with it. With option #2, once TLS 1.0 is dropped, then for remaining supported TLS versions the situation is the same as option #1; the v2 format is completely prohibited after that point. I think option #2 is a reasonable compromise if enough people are sadly against option #1.

Opinions?


Dave