Subject: [Uta] Martin Vigoureux's No Objection on draft-ietf-uta-tls-for-email-04: (with COMMENT)

From: Martin Vigoureux via Datatracker <[email-masked]>
Date: Mon, 17 Feb 2020 05:06:41 -0800

Martin Vigoureux has entered the following ballot position for
draft-ietf-uta-tls-for-email-04: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-uta-tls-for-email/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Hi

In the updates it proposes, this document seems to still allow for the
use/support of 1.0 and 1.1 but draft-ietf-tls-oldversions-deprecate-06 says
MUST NOT use for these.

I'm surely missing something obvious or I'm simply incorrectly interpreting the
text, but shedding light on this would be greatly appreciated.

Thanks
-m

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 17 Feb 2020 13:10:32 +0000

Hi Martin,

RFC 8314 (the document being updated) already disallows TLS 1.0 and this 
document disallows TLS 1.1

Best Regards,

Alexey

---

From: Martin Vigoureux <[email-masked]>
Date: Tue, 18 Feb 2020 14:30:56 +0100

Hi Alexey

> document disallows TLS 1.1

indeed, but my question is with regards to those sentences:
   "However, an MSP may find it necessary to
    make exceptions to accommodate some legacy systems that support only
    earlier versions of TLS or only cleartext."

   "Earlier TLS and SSL versions MAY also be supported"

As said maybe I'm reading them incorrectly, but they seem in 
contradiction with the intention of the draft itself (i.e., disallow 
1.1) and with draft-ietf-tls-oldversions-deprecate-06 (which is 
normatively referenced) which says MUST NOT use 1.1.

best regards,
martin