New Protocols Must Require TLS 1.3

Introduction TLS 1.2 is in widespread use and can be configured such that it provides good security properties. However, this protocol version suffers from several deficiencies:

While application layer traffic is always encrypted, most of the handshake messages are not encrypted. Therefore, the privacy provided is suboptimal. This is a protocol issue that cannot be addressed by configuration.
The list of cryptographic primitives specified for the protocol, both in-use primitives and deprecated ones, includes several primitives that were a source for vulnerabilities throughout the years, such as RSA key exchange, CBC cipher suites, and problematic finite-field Diffie-Hellman group negotiation. This deficiency may be addressed through proper configuration; however, experience shows that configuration mistakes are common, especially when deploying cryptography. See for elaboration.
The original protocol, as-is, does not provide security , , . Rather, some extensions are required to provide security.

In contrast, TLS 1.3 is also in widespread use and fixes most known deficiencies with TLS 1.2, such as encrypting more of the traffic so that it is not readable by outsiders and removing most cryptographic primitives considered dangerous. Importantly, TLS 1.3 enjoys robust security proofs and provides excellent security as-is. This document specifies that, since TLS 1.3 use is widespread, new protocols must require and assume its existence. This prescription does not pertain to DTLS (in any DTLS version); it pertains to TLS only.

Implications for post-quantum cryptography Quantum computers, once available, will have a huge impact on TLS. In 2016, the US National Institute of Standards and Technology started a multi-year effort to standardize algorithms that will be "safe" once quantum computers are feasible . First IETF discussions happened around the same time . While the industry is waiting for NIST to finish standardization, the IETF has several efforts underway. A working group was formed in early 2013 to work on use of PQC in IETF protocols, . Several other working groups, including TLS , are working on drafts to support hybrid algorithms and identifiers, for use during a transition from classic to a post-quantum world. For TLS it is important to note that the focus of these efforts is TLS 1.3 or later. TLS 1.2 is WILL NOT be supported (see ). This is one more reason for new protocols to default to TLS 1.3, where post-quantum cryptography is expected to be supported.

TLS Use by Other Protocols Any new protocol that uses TLS MUST specify as its default TLS 1.3 (or a higher TLS version, when one becomes stadardized). For example, QUIC requires TLS 1.3 and specifies that endpoints MUST terminate the connection if an older version is used. If deployment considerations are a concern, the protocol MAY specify TLS 1.2 as an additional, non-default option. As a counter example, the Usage Profile for DNS over TLS specifies TLS 1.2 as the default, while also allowing TLS 1.3. For newer specifications that choose to support TLS 1.2, those preferences are to be reversed.

Security Considerations TLS 1.2 was specified with several cryptographic primitives and design choices that have historically hindered its security. The purpose of this section is to briefly survey several such prominent problems that have affected the protocol. It should be noted, however, that TLS 1.2 can be configured securely; it is merely much more difficult to configure it securely as opposed to using its modern successor, TLS 1.3. See for a more thorough guide on the secure deployment of TLS 1.2. Firstly, the TLS 1.2 protocol, without any extension points, is vulnerable to the renegotiation attack and the Triple Handshake attack. Broadly, these attacks exploit the protocol's support for renegotiation in order to inject a prefix chosen by the attacker into the plaintext stream. This is usually a devastating threat in practice, that allows e.g. obtaining secret cookies in a web setting. Refer to , , for elaboration. In light of the above problems, specifies an extension that prevents this category of attacks. To securely deploy TLS 1.2, either renegotiation must be disabled entirely, or this extension must be present. Additionally, clients must not allow servers to renegotiate the certificate during a connection. Secondly, the original key exchange methods specified for the protocol, namely RSA key exchange and finite field Diffie-Hellman, suffer from several weaknesses. As before, to securely deploy the protocol, these key exchange methods must be disabled. Refer to draft-obsolete-kex for elaboration (TODO I guess we will anyway wait for WGLC for draft-obsolete-kex, so no sense to temporarily refer to the draft.) Thirdly, symmetric ciphers which were widely-used in the protocol, namely RC4 and CBC cipher suites, suffer from several weaknesses. RC4 suffers from exploitable biases in its key stream; see . CBC cipher suites have been a source of vulnerabilities throughout the years. A straightforward implementation of these cipher suites inherently suffers from the Lucky13 timing attack . The first attempt to implement the cipher suites in constant time introduced an even more severe vulnerability . There have been further similar vulnerabilities throughout the years exploiting CBC cipher suites; refer to e.g. for an example and a survey of similar works. And lastly, historically the protocol was affected by several other attacks that TLS 1.3 is immune to: BEAST , Logjam , FREAK , and SLOTH .