2
$\begingroup$

There are some vulnerability such POODLE, that allows the attacker to gain access to encrypted blocks of data and then gain exposure to plain text information using side channels. Another vulnerability is TLS 1.2 which allows the GOLDENDOODLE attack to breach outdated crypto methods.
Is TLS 1.2 still secure and reliable or should we leave it and migrate to 1.3?

$\endgroup$
  • 3
    $\begingroup$ Why do you wait for? TLS 1.3 has a huge cleanup. Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3? by removing non-ephemeral key exchanges and limiting only 5 cipher suites to eliminate the archaic mode of operations that tons of problems. $\endgroup$ – kelalaka Jul 18 at 12:17
  • 4
    $\begingroup$ There are more like Why was AES CBC removed in TLS 1.3? and Why did TLS 1.3 prohibit PGP authentication?, so search for TLS 1.3 in this site :) $\endgroup$ – kelalaka Jul 18 at 12:27
  • 2
    $\begingroup$ @R1w: TLS 1.3 is 2 years old. Why don't you complain about it? Which of the multiple reasons mentioned in these answers is not sufficient to you to decide to use TLS 1.3? And why you find these reasons as not sufficient? To me you have asked it in the last comment just to ask :) $\endgroup$ – mentallurg Jul 18 at 13:24
  • 2
    $\begingroup$ TLS Early Data (0RTT) $\endgroup$ – kelalaka Jul 18 at 13:34
  • 2
    $\begingroup$ @kelalaka: in some use cases, 0RTT is a nice optimization; in others, it's a nice foot cannon. I wouldn't advocate it unless you know it's safe in your scenario... $\endgroup$ – poncho Jul 18 at 14:44
4
$\begingroup$

According to who? According to NCSC (the Dutch center for cyber security) for instance, TLS 1.2 is still considered "good", but it does go on to specify which cipher suites and specific configuration options are still considered "good".

This is kind of the problem with TLS 1.2: it has become a hodgepodge of different algorithms, key agreement schemes, certificate status, signature formats, bulk ciphers, hash algorithms and whatnot. So specifying that TLS 1.2 is good enough is basically hiding all the problems that are associated with it. TLS 1.2 is as good as the options that are chosen, and making sure that all the configuration / implementation pitfalls are avoided.

TLS 1.3 has been defined to strip most if not all of these problems away, and be build upon the best practices for popular encryption algorithms. It is both very similar to TLS 1.2 and different path from 1.2 in that sense. We've come a long way, and it is likely that TLS 1.3 will be more secure for longer than TLS 1.2 in a generic sense.

Is TLS 1.3 perfect? No, problems have and will be found. But it is generally more secure, more performant it has certainly a lot fewer options compared to TLS 1.2 that are certainly not secure or that are likely to become security issues in the future. There are still things like the mentioned 0-RTT and PSK that are relatively dangerous to use. In that sense TLS 1.3 in itself is not a secure solution all by itself either; specific usage scenarios still have to be considered.

That all said, it is certainly possible to configure TLS 1.2 in such a way that the protocol is still considered secure, or at least not broken fundamentally. So in that sense I suppose you could argue that there is no pressing need to move to TLS 1.3, as long as your choices for TLS 1.2 are considered sound.

Do note that this also kind of assumes that the inherent complexity of TLS 1.2 is not a problem in itself, and that's certainly debatable as well.

| improve this answer | |
$\endgroup$
  • 1
    $\begingroup$ And that's about as objective as I can get, I suppose. The question is kind of requesting a black / white decision, and I don't think that's really possible at this time. $\endgroup$ – Maarten Bodewes Jul 18 at 15:25
  • $\begingroup$ So, instead of recommendation for migrating to TLS 1.3 for lower options to configure, one still says that you can use TLS 1.2. by providing lost of pitfalls to mitigate! Now, I won't be surprised if Bleichenbacher's CAT has more than 9 lives. $\endgroup$ – kelalaka Jul 18 at 17:08
  • 2
    $\begingroup$ Yep, dangerous territory indeed. But one thing I would not recommend is to use RSA_ ciphersuites, generally you want to go for the ECDHE_ ones. That's one configuration option that you should be shunning. Very basically you do ECDHE + RSA or ECDSA + AES-GCM or ChaCha20 / Poly1305 and a SHA-2 hash algorithm. Then there are of course the "hidden" configuration options in the protocol outside the ciphersuites and the key sizes and whatnot. $\endgroup$ – Maarten Bodewes Jul 18 at 18:43
  • $\begingroup$ I think you should extend this answer with those... $\endgroup$ – kelalaka Jul 18 at 18:50
  • $\begingroup$ I'd rather not. I wanted to keep my answer as void from that kind of advice as possible, as it ages in time, and I'm not keeping a list of answers to update now and then. This is my general issue with questions that ask: "is X secure now?". And really, there are various security agencies that already create lists like these (I'll still have to fix a few minor bugs in the Dutch one, of course, I'll write them a letter :) ) $\endgroup$ – Maarten Bodewes Jul 18 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.