Work on the next version of TLS is wrapping up and it\u2019s expected to be finalized in early 2017. What\u2019s left is mainly small decisions about fine-tuning the protocol’s design. But one major thing that has not been decided on is the name.<\/p>\n
Since the first draft was published, it was assumed that this next version of TLS would be named TLS 1.3. The current version is TLS 1.2, and all the TLS versions have followed .1 increments since TLS 1.0 was released in 1999.<\/p>\n
So this should be easy, right? Just name it TLS 1.3 and be done with it.<\/p>\n
But there is disagreement within the community, which predates the release of TLS 1.0.<\/p>\n
As you may know, the protocol was originally named Secure Sockets Layer, or SSL, by Netscape, who originally invented it. The name was changed to TLS when the Internet Engineer Task Force (IETF) took over development, mainly to satisfy egos<\/a>.<\/p>\n The full version history goes like this: SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2.<\/p>\n The jump from SSL 3.0 to TLS 1.0 has always been cited as a source of confusion. For most system administrators and webmasters, keeping up with the release histories of every protocol isn\u2019t on the top of their to-do list. So they assume that SSL 3.0 is newer because it has the highest version number, and enable that version (in the worst case scenario, they enable it instead of TLS 1.2).<\/p>\n This confusion is made worse by the fact that \u201cSSL\u201d still has more name recognition and is more widely used even though it is no longer the protocol’s official name. This is partially our own industry’s fault, as many major players have kept the SSL name, such as OpenSSL (the most widely used SSL\/TLS library) and even our own website.<\/p>\n So now that the next version of TLS is almost out, some in the community want a chance to fix the confusion. Two popular alternate names to TLS 1.3 have been proposed: \u201cTLS 4\u201d and \u201cTLS 2017.\u201d Both names hope to address the version number conflict and give the newest version the biggest number.<\/p>\n The surprising part is that there are pretty convincing arguments for all three.<\/p>\n Sticking with TLS 1.3 \u2018rocks the boat\u2019 the least, and has lots of support for that very reason. While it\u2019s likely that TLS 1.3 will continue the same version confusion, more sensible security settings make this less of an issue than it was a decade ago. For instance, because all the major web browsers are fairly proactive in disabling insecure options (like SSL 3.0) the server\u2019s configuration is no longer as important. New versions of server software are unlikely to even have SSL 3.0 compatibility, so this versioning issue will sort itself out once SSL 3.0 is no longer around.<\/p>\n