2
$\begingroup$

There are some vulnerability such POODLE, that allows the attacker to gain access to encrypted blocks of data and then gain exposure to plain text information using side channels. Another vulnerability is TLS 1.2 which allows the GOLDENDOODLE attack to breach outdated crypto methods.
Is TLS 1.2 still secure and reliable or should we leave it and migrate to 1.3?

$\endgroup$
11
  • 3
    $\begingroup$ Why do you wait for? TLS 1.3 has a huge cleanup. Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3? by removing non-ephemeral key exchanges and limiting only 5 cipher suites to eliminate the archaic mode of operations that tons of problems. $\endgroup$
    – kelalaka
    Jul 18 '20 at 12:17
  • 4
    $\begingroup$ There are more like Why was AES CBC removed in TLS 1.3? and Why did TLS 1.3 prohibit PGP authentication?, so search for TLS 1.3 in this site :) $\endgroup$
    – kelalaka
    Jul 18 '20 at 12:27
  • 2
    $\begingroup$ @R1w: TLS 1.3 is 2 years old. Why don't you complain about it? Which of the multiple reasons mentioned in these answers is not sufficient to you to decide to use TLS 1.3? And why you find these reasons as not sufficient? To me you have asked it in the last comment just to ask :) $\endgroup$
    – mentallurg
    Jul 18 '20 at 13:24
  • 2
    $\begingroup$ TLS Early Data (0RTT) $\endgroup$
    – kelalaka
    Jul 18 '20 at 13:34
  • 2
    $\begingroup$ @kelalaka: in some use cases, 0RTT is a nice optimization; in others, it's a nice foot cannon. I wouldn't advocate it unless you know it's safe in your scenario... $\endgroup$
    – poncho
    Jul 18 '20 at 14:44
5
$\begingroup$

According to who? According to NCSC (the Dutch center for cyber security) for instance, TLS 1.2 is still considered "good", but it does go on to specify which cipher suites and specific configuration options are still considered "good".

This is kind of the problem with TLS 1.2: it has become a hodgepodge of different algorithms, key agreement schemes, certificate status, signature formats, bulk ciphers, hash algorithms and whatnot. So specifying that TLS 1.2 is good enough is basically hiding all the problems that are associated with it. TLS 1.2 is as good as the options that are chosen, and making sure that all the configuration / implementation pitfalls are avoided.

TLS 1.3 has been defined to strip most if not all of these problems away, and be build upon the best practices for popular encryption algorithms. It is both very similar to TLS 1.2 and different path from 1.2 in that sense. We've come a long way, and it is likely that TLS 1.3 will be more secure for longer than TLS 1.2 in a generic sense.

Is TLS 1.3 perfect? No, problems have and will be found. But it is generally more secure, more performant it has certainly a lot fewer options compared to TLS 1.2 that are certainly not secure or that are likely to become security issues in the future. There are still things like the mentioned 0-RTT and PSK that are relatively dangerous to use. In that sense TLS 1.3 in itself is not a secure solution all by itself either; specific usage scenarios still have to be considered.

That all said, it is certainly possible to configure TLS 1.2 in such a way that the protocol is still considered secure, or at least not broken fundamentally. So in that sense I suppose you could argue that there is no pressing need to move to TLS 1.3, as long as your choices for TLS 1.2 are considered sound.

Do note that this also kind of assumes that the inherent complexity of TLS 1.2 is not a problem in itself, and that's certainly debatable as well.

$\endgroup$
6
  • 1
    $\begingroup$ And that's about as objective as I can get, I suppose. The question is kind of requesting a black / white decision, and I don't think that's really possible at this time. $\endgroup$
    – Maarten Bodewes
    Jul 18 '20 at 15:25
  • $\begingroup$ So, instead of recommendation for migrating to TLS 1.3 for lower options to configure, one still says that you can use TLS 1.2. by providing lost of pitfalls to mitigate! Now, I won't be surprised if Bleichenbacher's CAT has more than 9 lives. $\endgroup$
    – kelalaka
    Jul 18 '20 at 17:08
  • 2
    $\begingroup$ Yep, dangerous territory indeed. But one thing I would not recommend is to use RSA_ ciphersuites, generally you want to go for the ECDHE_ ones. That's one configuration option that you should be shunning. Very basically you do ECDHE + RSA or ECDSA + AES-GCM or ChaCha20 / Poly1305 and a SHA-2 hash algorithm. Then there are of course the "hidden" configuration options in the protocol outside the ciphersuites and the key sizes and whatnot. $\endgroup$
    – Maarten Bodewes
    Jul 18 '20 at 18:43
  • $\begingroup$ I think you should extend this answer with those... $\endgroup$
    – kelalaka
    Jul 18 '20 at 18:50
  • 1
    $\begingroup$ NB I did write them a letter, but right after they got a new version where the most interesting issues had been resolved. They were happy to receive it though, and promised that a next revision should take on the other problematic parts. $\endgroup$
    – Maarten Bodewes
    Sep 22 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.