7
$\begingroup$

There are some vulnerability such POODLE, that allows the attacker to gain access to encrypted blocks of data and then gain exposure to plain text information using side channels. Another vulnerability is TLS 1.2 which allows the GOLDENDOODLE attack to breach outdated crypto methods.
Is TLS 1.2 still secure and reliable or should we leave it and migrate to 1.3?

$\endgroup$
11
  • 4
    $\begingroup$ Why do you wait for? TLS 1.3 has a huge cleanup. Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3? by removing non-ephemeral key exchanges and limiting only 5 cipher suites to eliminate the archaic mode of operations that tons of problems. $\endgroup$
    – kelalaka
    Commented Jul 18, 2020 at 12:17
  • 4
    $\begingroup$ There are more like Why was AES CBC removed in TLS 1.3? and Why did TLS 1.3 prohibit PGP authentication?, so search for TLS 1.3 in this site :) $\endgroup$
    – kelalaka
    Commented Jul 18, 2020 at 12:27
  • 3
    $\begingroup$ @R1w: TLS 1.3 is 2 years old. Why don't you complain about it? Which of the multiple reasons mentioned in these answers is not sufficient to you to decide to use TLS 1.3? And why you find these reasons as not sufficient? To me you have asked it in the last comment just to ask :) $\endgroup$
    – mentallurg
    Commented Jul 18, 2020 at 13:24
  • 2
    $\begingroup$ TLS Early Data (0RTT) $\endgroup$
    – kelalaka
    Commented Jul 18, 2020 at 13:34
  • 2
    $\begingroup$ @kelalaka: in some use cases, 0RTT is a nice optimization; in others, it's a nice foot cannon. I wouldn't advocate it unless you know it's safe in your scenario... $\endgroup$
    – poncho
    Commented Jul 18, 2020 at 14:44

2 Answers 2

11
$\begingroup$

According to who? According to NCSC (the Dutch center for cyber security) for instance, TLS 1.2 is still considered "good", but it does go on to specify which cipher suites and specific configuration options are still considered "good".

This is kind of the problem with TLS 1.2: it has become a hodgepodge of different algorithms, key agreement schemes, certificate status, signature formats, bulk ciphers, hash algorithms and whatnot. So specifying that TLS 1.2 is good enough is basically hiding all the problems that are associated with it. TLS 1.2 is as good as the options that are chosen, and making sure that all the configuration / implementation pitfalls are avoided.

TLS 1.3 has been defined to strip most if not all of these problems away, and be build upon the best practices for popular encryption algorithms. It is both very similar to TLS 1.2 and different path from 1.2 in that sense. We've come a long way, and it is likely that TLS 1.3 will be more secure for longer than TLS 1.2 in a generic sense.

Is TLS 1.3 perfect? No, problems have and will be found. But it is generally more secure, more performant it has certainly a lot fewer options compared to TLS 1.2 that are certainly not secure or that are likely to become security issues in the future. There are still things like the mentioned 0-RTT and PSK that are relatively dangerous to use. In that sense TLS 1.3 in itself is not a secure solution all by itself either; specific usage scenarios still have to be considered.

That all said, it is certainly possible to configure TLS 1.2 in such a way that the protocol is still considered secure, or at least not broken fundamentally. So in that sense I suppose you could argue that there is no pressing need to move to TLS 1.3, as long as your choices for TLS 1.2 are considered sound.

Do note that this also kind of assumes that the inherent complexity of TLS 1.2 is not a problem in itself, and that's certainly debatable as well.

$\endgroup$
6
  • 1
    $\begingroup$ And that's about as objective as I can get, I suppose. The question is kind of requesting a black / white decision, and I don't think that's really possible at this time. $\endgroup$
    – Maarten Bodewes
    Commented Jul 18, 2020 at 15:25
  • 2
    $\begingroup$ Yep, dangerous territory indeed. But one thing I would not recommend is to use RSA_ ciphersuites, generally you want to go for the ECDHE_ ones. That's one configuration option that you should be shunning. Very basically you do ECDHE + RSA or ECDSA + AES-GCM or ChaCha20 / Poly1305 and a SHA-2 hash algorithm. Then there are of course the "hidden" configuration options in the protocol outside the ciphersuites and the key sizes and whatnot. $\endgroup$
    – Maarten Bodewes
    Commented Jul 18, 2020 at 18:43
  • 1
    $\begingroup$ I think you should extend this answer with those... $\endgroup$
    – kelalaka
    Commented Jul 18, 2020 at 18:50
  • 1
    $\begingroup$ I'd rather not. I wanted to keep my answer as void from that kind of advice as possible, as it ages in time, and I'm not keeping a list of answers to update now and then. This is my general issue with questions that ask: "is X secure now?". And really, there are various security agencies that already create lists like these (I'll still have to fix a few minor bugs in the Dutch one, of course, I'll write them a letter :) ) $\endgroup$
    – Maarten Bodewes
    Commented Jul 18, 2020 at 18:52
  • 1
    $\begingroup$ NB I did write them a letter, but right after they got a new version where the most interesting issues had been resolved. They were happy to receive it though, and promised that a next revision should take on the other problematic parts. $\endgroup$
    – Maarten Bodewes
    Commented Sep 22, 2021 at 21:51
1
$\begingroup$

Although I find @Maarten Bodewes answer just perfect, and also @poncho and @kelalaka comments are challenging and helpful, I want to do something and have to try for the second time to answer one of my posts with a little bit of useful information to add to this post.

Major Differences from TLS 1.2

The following is a list of the major functional differences between TLS 1.2 and TLS 1.3. It is not intended to be exhaustive, and there are many minor differences.

  • The list of supported symmetric encryption algorithms has been pruned of all algorithms that are considered legacy. Those that remain are all Authenticated Encryption with Associated Data (AEAD) algorithms. The cipher suite concept has been changed to separate the authentication and key exchange mechanisms from the record protection algorithm (including secret key length) and a hash to be used with both the key derivation function and handshake message authentication code (MAC).

  • A zero round-trip time (0-RTT) mode was added, saving a round trip at connection setup for some application data, at the cost of certain security properties.

  • Static RSA and Diffie-Hellman cipher suites have been removed; all public-key based key exchange mechanisms now provide forward secrecy.

  • All handshake messages after the ServerHello are now encrypted. The newly introduced EncryptedExtensions message allows various extensions previously sent in the clear in the ServerHello to also enjoy confidentiality protection.

  • The key derivation functions have been redesigned. The new design allows easier analysis by cryptographers due to their improved key separation properties. The HMAC-based Extract-and-Expand Key Derivation Function (HKDF) is used as an underlying primitive.

  • The handshake state machine has been significantly restructured to be more consistent and to remove superfluous messages such as ChangeCipherSpec (except when needed for middlebox compatibility).

  • Elliptic curve algorithms are now in the base spec, and new signature algorithms, such as EdDSA, are included. TLS 1.3 removed point format negotiation in favor of a single point format for each curve.

  • Other cryptographic improvements were made, including changing the RSA padding to use the RSA Probabilistic Signature Scheme (RSASSA-PSS), and the removal of compression, the Digital Signature Algorithm (DSA), and custom Ephemeral Diffie-Hellman (DHE) groups.

  • The TLS 1.2 version negotiation mechanism has been deprecated in favor of a version list in an extension. This increases compatibility with existing servers that incorrectly implemented version negotiation.

  • Session resumption with and without server-side state as well as the PSK-based cipher suites of earlier TLS versions have been replaced by a single new PSK exchange.

P.S This answer is part of RFC 8446 The Transport Layer Security (TLS) Protocol Version 1.3

These two links from A10networks also could be informative.

Key differences Between TLS 1.2 and TLS 1.3

TLS 1.3 – Status, Concerns & Impact

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.