Deprecating Secure Sockets Layer Version 3.0
draft-ietf-tls-sslv3-diediedie-03
Revision differences
Document history
Date | Rev. | By | Action |
---|---|---|---|
2015-06-23
|
03 | (System) | RFC Editor state changed to AUTH48-DONE from AUTH48 |
2015-06-23
|
03 | (System) | RFC Editor state changed to AUTH48 from AUTH48-DONE |
2015-06-23
|
03 | (System) | RFC Editor state changed to AUTH48-DONE from AUTH48 |
2015-05-26
|
03 | (System) | RFC Editor state changed to AUTH48 from IESG |
2015-05-25
|
03 | Stephen Farrell | Intended Status changed to Proposed Standard from Best Current Practice |
2015-05-22
|
03 | (System) | RFC Editor state changed to IESG from AUTH48 |
2015-05-21
|
03 | (System) | RFC Editor state changed to AUTH48 from RFC-EDITOR |
2015-05-21
|
03 | (System) | RFC Editor state changed to RFC-EDITOR from EDIT |
2015-04-16
|
03 | Tero Kivinen | Closed request for Last Call review by SECDIR with state 'No Response' |
2015-04-14
|
03 | Amy Vezza | IESG state changed to RFC Ed Queue from Approved-announcement sent |
2015-04-14
|
03 | (System) | RFC Editor state changed to EDIT |
2015-04-14
|
03 | (System) | Announcement was received by RFC Editor |
2015-04-13
|
03 | (System) | IANA Action state changed to No IC |
2015-04-13
|
03 | Amy Vezza | IESG state changed to Approved-announcement sent from Approved-announcement to be sent::Point Raised - writeup needed |
2015-04-13
|
03 | Amy Vezza | IESG has approved the document |
2015-04-13
|
03 | Amy Vezza | Closed "Approve" ballot |
2015-04-13
|
03 | Amy Vezza | Ballot approval text was generated |
2015-04-13
|
03 | Amy Vezza | Ballot writeup was changed |
2015-04-10
|
03 | Martin Thomson | IANA Review state changed to Version Changed - Review Needed from IANA OK - No Actions Needed |
2015-04-10
|
03 | Martin Thomson | New version available: draft-ietf-tls-sslv3-diediedie-03.txt |
2015-04-09
|
02 | Cindy Morgan | IESG state changed to Approved-announcement to be sent::Point Raised - writeup needed from IESG Evaluation |
2015-04-09
|
02 | Jari Arkko | [Ballot Position Update] New position, No Objection, has been recorded for Jari Arkko |
2015-04-09
|
02 | Martin Stiemerling | [Ballot Position Update] New position, Yes, has been recorded for Martin Stiemerling |
2015-04-08
|
02 | Deborah Brungard | [Ballot Position Update] New position, No Objection, has been recorded for Deborah Brungard |
2015-04-08
|
02 | Cindy Morgan | Changed consensus to Yes from Unknown |
2015-04-08
|
02 | Alia Atlas | [Ballot Position Update] New position, No Objection, has been recorded for Alia Atlas |
2015-04-08
|
02 | Alvaro Retana | [Ballot Position Update] New position, No Objection, has been recorded for Alvaro Retana |
2015-04-07
|
02 | Ben Campbell | [Ballot Position Update] New position, Yes, has been recorded for Ben Campbell |
2015-04-07
|
02 | Barry Leiba | [Ballot comment] The abstract says (as it should) that this updates all versions of TLS... yet the metadata only updates 1.2. For most situations I'd … [Ballot comment] The abstract says (as it should) that this updates all versions of TLS... yet the metadata only updates 1.2. For most situations I'd think that appropriate (no need to update the ones that are obsoleted), but in this case the deployment of earlier versions is sufficiently widespread (and, after all, you do have them as normative references) that I think we should add 2246 and 4346 to the "updates" list. Note, though, that this is not a DISCUSS, so I'll leave it to y'all to decide what's best. I think prohibiting-rc4 doesn't need to be a normative reference; I'd make it informative. I think the same is true for RFC 4492. -- Section 3 -- Pretty short litany, here, really. I guess it's not the whole megillah. Jus' sayin'. |
2015-04-07
|
02 | Barry Leiba | [Ballot Position Update] New position, Yes, has been recorded for Barry Leiba |
2015-04-06
|
02 | Joel Jaeggli | [Ballot Position Update] New position, Yes, has been recorded for Joel Jaeggli |
2015-04-06
|
02 | Spencer Dawkins | [Ballot comment] Thank you for writing this. Even the transport dorks know it matters. I wish you had used the word "die" in the draft … [Ballot comment] Thank you for writing this. Even the transport dorks know it matters. I wish you had used the word "die" in the draft name more than three times, but you're the experts :-) I'm not parsing this text the way I think you want me to: The predecessor of SSLv3, SSL version 2 [RFC6101], is no longer considered secure [RFC6176]. SSLv3 now follows. I'm struggling with "is no longer considered secure" in the present tense, describing an action taken several years ago. Is the point that negotiating SSLv2 was prohibited in 2011 because SSLv2 was no longer considered secure, and negotiating SSLv3 is now being prohibited in the same way, for the reasons listed in this document? If so, saying something like that might be clearer ... |
2015-04-06
|
02 | Spencer Dawkins | [Ballot Position Update] New position, No Objection, has been recorded for Spencer Dawkins |
2015-04-06
|
02 | Terry Manderson | [Ballot Position Update] New position, No Objection, has been recorded for Terry Manderson |
2015-04-06
|
02 | Brian Haberman | [Ballot Position Update] New position, Yes, has been recorded for Brian Haberman |
2015-03-31
|
02 | Kathleen Moriarty | [Ballot Position Update] New position, Yes, has been recorded for Kathleen Moriarty |
2015-03-31
|
02 | Stephen Farrell | Placed on agenda for telechat - 2015-04-09 |
2015-03-31
|
02 | Stephen Farrell | IESG state changed to IESG Evaluation from Waiting for Writeup |
2015-03-31
|
02 | Stephen Farrell | Ballot has been issued |
2015-03-31
|
02 | Stephen Farrell | [Ballot Position Update] New position, Yes, has been recorded for Stephen Farrell |
2015-03-31
|
02 | Stephen Farrell | Created "Approve" ballot |
2015-03-31
|
02 | Stephen Farrell | Ballot writeup was changed |
2015-03-30
|
02 | (System) | IESG state changed to Waiting for Writeup from In Last Call |
2015-03-28
|
02 | Gunter Van de Velde | Request for Last Call review by OPSDIR Completed: Ready. Reviewer: Fred Baker. |
2015-03-21
|
02 | Gunter Van de Velde | Request for Last Call review by OPSDIR is assigned to Fred Baker |
2015-03-21
|
02 | Gunter Van de Velde | Request for Last Call review by OPSDIR is assigned to Fred Baker |
2015-03-20
|
02 | (System) | IANA Review state changed to IANA OK - No Actions Needed from IANA - Review Needed |
2015-03-20
|
02 | Amanda Baber | IESG/Authors/WG Chairs: IANA has reviewed draft-ietf-tls-sslv3-diediedie-02, which is currently in Last Call, and has the following comments: We understand that this document doesn't require … IESG/Authors/WG Chairs: IANA has reviewed draft-ietf-tls-sslv3-diediedie-02, which is currently in Last Call, and has the following comments: We understand that this document doesn't require any IANA actions. While it is helpful for the IANA Considerations section of the document to remain in place upon publication, if the authors prefer to remove it, IANA doesn't object. If this assessment is not accurate, please respond as soon as possible. |
2015-03-19
|
02 | Jean Mahoney | Request for Last Call review by GENART is assigned to Tom Taylor |
2015-03-19
|
02 | Jean Mahoney | Request for Last Call review by GENART is assigned to Tom Taylor |
2015-03-19
|
02 | Tero Kivinen | Request for Last Call review by SECDIR is assigned to Sandra Murphy |
2015-03-19
|
02 | Tero Kivinen | Request for Last Call review by SECDIR is assigned to Sandra Murphy |
2015-03-16
|
02 | Cindy Morgan | IANA Review state changed to IANA - Review Needed |
2015-03-16
|
02 | Cindy Morgan | The following Last Call announcement was sent out: From: The IESG To: IETF-Announce CC: Reply-To: ietf@ietf.org Sender: Subject: Last Call: (Deprecating Secure Sockets Layer Version … The following Last Call announcement was sent out: From: The IESG To: IETF-Announce CC: Reply-To: ietf@ietf.org Sender: Subject: Last Call: (Deprecating Secure Sockets Layer Version 3.0) to Best Current Practice The IESG has received a request from the Transport Layer Security WG (tls) to consider the following document: - 'Deprecating Secure Sockets Layer Version 3.0' as Best Current Practice The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2015-03-30. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract Secure Sockets Layer version 3.0 (SSLv3) is no longer secure. This document requires that SSLv3 not be used. The replacement versions, in particular Transport Layer Security (TLS) 1.2, are considerably more secure and capable protocols. This document updates the backward compatibility sections of the TLS RFCs to prohibit fallback to SSLv3. The file can be obtained via http://datatracker.ietf.org/doc/draft-ietf-tls-sslv3-diediedie/ IESG discussion can be tracked via http://datatracker.ietf.org/doc/draft-ietf-tls-sslv3-diediedie/ballot/ No IPR declarations have been submitted directly on this I-D. - ID nits says we should say in the abstract that we're updating 5246 and that prohibiting-rc4 is now RFC 7465. It also wants us to add the usual 2119 boilerplate. Those will be taken care of after IETF LC. |
2015-03-16
|
02 | Cindy Morgan | IESG state changed to In Last Call from Last Call Requested |
2015-03-16
|
02 | Stephen Farrell | Last call was requested |
2015-03-16
|
02 | Stephen Farrell | Ballot approval text was generated |
2015-03-16
|
02 | Stephen Farrell | Ballot writeup was generated |
2015-03-16
|
02 | Stephen Farrell | IESG state changed to Last Call Requested from Publication Requested |
2015-03-16
|
02 | Stephen Farrell | Last call announcement was changed |
2015-03-16
|
02 | Stephen Farrell | Last call announcement was generated |
2015-03-02
|
02 | Joseph Salowey | 1. Summary Joseph Salowey is the document shepherd and Stephen Farrell is the responsible AD for this document. This document is a standards track document … 1. Summary Joseph Salowey is the document shepherd and Stephen Farrell is the responsible AD for this document. This document is a standards track document that deprecates the use of SSLv3 as it has significant security flaws. 2. Review and Consensus This document has been actively reviewed by the TLS working group. There is strong community consensus behind the document. Many deployments and implementations have already started disabling SSLv3. 3. Intellectual Property No IPR declarations have been filed and none are expected. 4. Other Points The document contains downrefs to versions of TLS documents. This follows what was done in RFC 6176 (Prohibiting Secure Sockets Layer (SSL) Version 2.0). |
2015-03-02
|
02 | Joseph Salowey | Responsible AD changed to Stephen Farrell |
2015-03-02
|
02 | Joseph Salowey | IETF WG state changed to Submitted to IESG for Publication from WG Consensus: Waiting for Write-Up |
2015-03-02
|
02 | Joseph Salowey | IESG state changed to Publication Requested |
2015-03-02
|
02 | Joseph Salowey | IESG process started in state Publication Requested |
2015-03-02
|
02 | Joseph Salowey | Tag Revised I-D Needed - Issue raised by WGLC cleared. |
2015-03-01
|
02 | Joseph Salowey | Changed document writeup |
2015-03-01
|
02 | Martin Thomson | New version available: draft-ietf-tls-sslv3-diediedie-02.txt |
2015-03-01
|
01 | Martin Thomson | New version available: draft-ietf-tls-sslv3-diediedie-01.txt |
2015-03-01
|
00 | Joseph Salowey | Tag Revised I-D Needed - Issue raised by WGLC set. |
2015-03-01
|
00 | Joseph Salowey | IETF WG state changed to WG Consensus: Waiting for Write-Up from Waiting for WG Chair Go-Ahead |
2015-02-17
|
00 | Joseph Salowey | IETF WG state changed to Waiting for WG Chair Go-Ahead from In WG Last Call |
2015-01-23
|
00 | Joseph Salowey | This document now replaces draft-thomson-sslv3-diediedie instead of None |
2015-01-23
|
00 | Joseph Salowey | Intended Status changed to Best Current Practice from None |
2015-01-23
|
00 | Joseph Salowey | Notification list changed to "Joseph A. Salowey" <joe@salowey.net> |
2015-01-23
|
00 | Joseph Salowey | Document shepherd changed to Joseph A. Salowey |
2015-01-23
|
00 | Joseph Salowey | IETF WG state changed to In WG Last Call from WG Document |
2014-12-09
|
00 | Martin Thomson | New version available: draft-ietf-tls-sslv3-diediedie-00.txt |