Subject: Re: [TLS] drop obsolete SSL 2 backwards compatibility from TLS 1.3 draft

From: [email-masked] (Martin Rex)
Date: Sat, 3 Jan 2015 13:30:36 +0100 (CET)

Dave Garrett wrote:
> 
> The newest version of TLS should not be have to be written to accommodate
> an 8 year old EOL Java version's default settings.

While Android seems to use OpenSSL (native code) rather than the SSL from
the JDK, Android 4.1 through 4.3 (Jelly Bean) and Android 4.4 (KitKat)
seem to all be using Java 6.  And its not like end uses would have
a choice to perform an upgrade themselves.

Java 7 is limited to Android 5, and that is mostly vaporware for what
was sold during the 2014 Xmas sales.  Pretty much all brand new sales
are Android 4.x with Java 6.

-Martin

---

From: "Salz, Rich" <[email-masked]>
Date: Sat, 3 Jan 2015 10:49:25 -0500

A TLS 1.3 server can get the hello, and if it fails to parse it, retry it as a pre-1.3 Hello.  No?  Then it's not a TLS 1.3 server, is it.

Will we always have to accommodate all the installed base with a protocol that's like a decade old?

--  
Principal Security Engineer, Akamai Technologies
IM: [email-masked] Twitter: RichSalz