Comment by ekr____

5 months ago

The situation is additionally confused by the fact that the version numbers do not give a good clue to how different the protocols were. Specifically:

SSLv2 was the first widely deployed version of SSL, but as this post indicates, had a number of issues.

SSLv3 is a more or less completely new protocol

TLS 1.0 is much like SSLv3 but with some small revisions made during the IETF standardization process.

TLS 1.1 is a really minor revision to TLS 1.0 to address some issues with the way block ciphers were used.

TLS 1.2 is a moderately sized revision to TLS 1.1 to adjust to advances in cryptography, specifically adding support for newer hashes in response to weaknesses in MD5 and SHA-1 and adding support for AEAD cipher suites such as AES-GCM.

TLS 1.3 is mostly a new protocol though it reuses some pieces of TLS 1.2 and before.

Each of these protocols has been designed so that you could automatically negotiate versions, thus allowing for clients and servers to independently upgrade without loss of connectivity.

56 comments

ekr____

Reply
nextgens  5 months ago

TLS1.0 introduced modularity via the concept of "extensions". It's everything but a minor evolution of the protocol.

One of the many things it brought is session tickets, enabling server-side session resumption without requiring servers to keep synced-up state. Another is Server Name Indication, enabling servers to use more than one certificate.

cortesoft  5 months ago

> Each of these protocols has been designed so that you could automatically negotiate versions, thus allowing for clients and servers to independently upgrade without loss of connectivity.

And ensuring decades of various downgrade attacks

  • mcpherrinm  5 months ago

    The downgrade attacks on TLS are only really present in the case of client behaviour where, on failing to achieve one version, they retry a new connection without it.

    This was necessary to bypass various broken server side implementations, and broken middleboxes, but wasn’t necessarily a flaw in TLS itself.

    But from the learnings of this issue preventing 1.2 deployment, TLS 1.3 goes out of its way to look very similar on the wire to 1.2

    • matthewdgreen  5 months ago

      This isn't really accurate historically. TLS has both ciphersuite and version negotiation. Logjam (2015) [1] was a downgrade attack on the former that's now fixed, but is an extension of an attack that was first noticed way back in 1996 [2]. Similar problems occurred with the FREAK attack, though that was actually a client vulnerability. TLS 1.3 goes out of its way to fix all of this using a better negotiation mechanism, and by reducing agility.

      [1] https://en.wikipedia.org/wiki/Logjam_(computer_security) [2] https://www.usenix.org/legacy/publications/library/proceedin...

    • ekr____  5 months ago

      Moreover, there's not really much in the way of choices here. If you don't have this kind of automatic version negotiation then it's essentially impossible to deploy a new version.

      26 replies →

    • frollogaston  5 months ago

      If a protocol is widely used wrongly, I consider it a flaw in the protocol. But overall, SSL standardization has gone decently well. I always bring it up as a good example to contrast with XMPP as a bad example.

      10 replies →

    • sjducb  5 months ago

      Man in the middle interfering with TLS handshakes?

      The handshake is unencrypted so you can modify the messages to make it look like the server only supports broken ciphers. Then the man in the middle can read all of the encrypted data because it was badly encrypted.

      A surprising number of servers still support broken ciphers due to legacy uses or incompetence.

      7 replies →

  • jackgavigan  5 months ago

    It also enabled cipher strength "step up". Back during the '90s and early 2000s (I'm not sure when it stopped, tbh), the US government restricted the export of strong cryptography, with certain exceptions (e.g. for financial services).

    If you fell under one of those exceptions, you could get a special certificate for your website (from, e.g. Verisign) that allowed the webserver to "step up" the encryption negotiation with the browser to stronger algorithms and/or key lengths.

da_chicken  5 months ago

They still should have just called it TLS v4.0 instead of v1.0.

I'm halfway convinced that they have made subsequent versions v1.1, v1.2, and v1.3 in an outrageously stubborn refusal to admit that they were objectively incorrect to reset the version number.

  • ekr____  5 months ago

    As I noted below, there was real discussion around the version number for TLS 1.3. I don't recall any such discussion for 1.1 and 1.2.