Re: [TLS] ban more old crap

Eric Rescorla <ekr@rtfm.com> Thu, 23 July 2015 17:11 UTC

Return-Path: <ekr@rtfm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D43741A87EB for <tls@ietfa.amsl.com>; Thu, 23 Jul 2015 10:11:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.977
X-Spam-Level:
X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xYzJM8zbssaY for <tls@ietfa.amsl.com>; Thu, 23 Jul 2015 10:11:12 -0700 (PDT)
Received: from mail-wi0-f179.google.com (mail-wi0-f179.google.com [209.85.212.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 37A1C1A6EFC for <tls@ietf.org>; Thu, 23 Jul 2015 10:11:11 -0700 (PDT)
Received: by wicmv11 with SMTP id mv11so32986710wic.0 for <tls@ietf.org>; Thu, 23 Jul 2015 10:11:10 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=VwOdm6XpcQeUf9u+jCGhpZZbE9wee9JCJcBP9C7ov+4=; b=YEbYXcN83LVQheoW3atf4Wd21q8hk1CZEHf9h1nDFcHxBtGaBdvlgi6A3JeY5/NoEk iWU9mC//zr6ZGpKXyEouhm5eDgV7ToUYIWOTlUnpwiqJrXkU4iMIpuEFaDP5YRappTcq ytHdp8Z44KAYe9C6zawa3Eto2nsMqWeJ5rcGP+qVzwShk7dYFvMehAhtwBVDqh2IaP4q wJ6OVi8pjPCMaOWpuQhwGumR+/MtMMDCcJ2A9uabkGfUKI99q5lm7jAHgdzEcejXHMtT xDUmjF0JgczK2L2SBdsXE5zRNWZXhODVGs3scjMkNqCCCA0fLiIFOg8yKAa/WMjm7miP 61Rg==
X-Gm-Message-State: ALoCoQl06gYkCqdvHRzi6mcOdmPTajyajGiii6RzXSrHlm0r4mOBA0IYtpGibRDmHGKQBBpGCMG0
X-Received: by 10.180.208.114 with SMTP id md18mr54391964wic.31.1437671469885; Thu, 23 Jul 2015 10:11:09 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.27.85.75 with HTTP; Thu, 23 Jul 2015 10:10:30 -0700 (PDT)
In-Reply-To: <55B11EFC.6070400@cs.tcd.ie>
References: <201507221610.27729.davemgarrett@gmail.com> <1724827.ajpDBsKllU@pintsize.usersys.redhat.com> <201507231143.46288.davemgarrett@gmail.com> <55B11EFC.6070400@cs.tcd.ie>
From: Eric Rescorla <ekr@rtfm.com>
Date: Thu, 23 Jul 2015 19:10:30 +0200
Message-ID: <CABcZeBMbuqKwK2T1e0jHOE6+SJRViBZAny_2Bo5x-eDTp_-b9g@mail.gmail.com>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Content-Type: multipart/alternative; boundary=001a11c37eb8443e6a051b8df9ff
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/x7VVaq_15eCxiFcrxSuaB7bSwcY>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] ban more old crap
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 23 Jul 2015 17:11:15 -0000

On Thu, Jul 23, 2015 at 7:06 PM, Stephen Farrell <stephen.farrell@cs.tcd.ie>
wrote:

>
>
> On 23/07/15 16:43, Dave Garrett wrote:
> > We should just get more serious about banning old crap entirely to
> > make dangerous misconfiguration impossible for TLS 1.3+
> > implementations.
> >
> > Right now, the restrictions section prohibits: RC4, SSL2/3, &
> > EXPORT/NULL entirely (via min bits) and has "SHOULD" use TLS 1.3+
> > compatible with TLS 1.2, if available
>
> A suggestion - could we remove mention of anything that
> is not a MUST or SHOULD ciphersuite from the TLS1.3 document
> and then have someone write a separate draft that adds a
> column to the registry where we can mark old crap as
> deprecated?
>
> Not sure if it'd work though.
>

I'm starting to lean towards this. I don't generally think of TLS 1.3 as a
vehicle
for telling people how to configure use of TLS 1.2, and I think it might be
better
to move all that stuff out.

-Ekr


> S.
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>