Skip to content

Conversation

@woodbe
Copy link

@woodbe woodbe commented Dec 8, 2022

The current text would preclude supporting any updates to 1.2, 1.3 or future releases without an update to the Package. This explicitly precludes the use of anything older than 1.2 but would still allow support for future versions without causing problems that may require special operating modes to block certain functions (and potentially break a lot of access).

From the engineers who helped develop TLS 1.3:

If broadly adopted, this would prevent any further development of TLS. TLS 1.3 required many months of experimentation by major clients & servers to measure the real-world behavior of the internet on port 443. This involved running draft versions of TLS 1.3 and resulted in the strange syntactic presentation of TLS 1.3 on the wire, which happens to make it practically deployable. We recommend that, similar to the server rules in FCS_TLSS_EXT.1.1, that this requirement focus only on older versions of TLS.

The current text would preclude supporting any updates to 1.2, 1.3 or future releases without an update to the Package. This explicitly precludes the use of anything older than 1.2 but would still allow support for future versions without causing problems that may require special operating modes to block certain functions (and potentially break a lot of access).
@woodbe
Copy link
Author

woodbe commented Oct 30, 2024

This is still applicable to the 2.1 version of the package

@rguthrie1324
Copy link
Contributor

Just added this same change (plus another instance of it for DTLS) into branch 50-fcs_tlsc_ext14-updates): 443ff9d

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants