If someone tells me their service uses TLS 1.2 or higher, how much 'guaranteed' security does this provide?
Is it possible to correctly claim to be using TLS 1.2 or 1.3 and still be insecure? For example, using a correctly implimented TLS handshake but with a weak cipher?
If it is possible to 'correctly' impliment TLS insecurly, using the above example, what would be examples of ciphers that are acceptable in the TLS standards but are actually insecure?
Is it possible to correctly claim to be using TLS 1.2 or 1.3 and still be insecure?
Absolutely. Even discounting deliberate attempts to be insecure, an implementation could have an implementation error that would:
Select their premaster secret (for TLS 1.2 RSA-based ciphersuites) with poor entropy
Select their (EC)DH private values with poor entropy
Select their CBC or GCM IVs poorly
Not properly validating the certificate
what would be examples of ciphers that are acceptable in the TLS standards but are actually insecure?
TLS 1.2 has a number of 'not-very-secure' ciphersuites (as it inherited all of the TLS 1.0 ciphersuites). In TLS 1.3, they reduced the number of supported ciphersuites to 5, none of which are horrid (I'm not thrilled with the CCM_8 based one, but even that isn't that bad).
On the other hand, even in TLS 1.2, both sides would have to agree to use a 'not-very-secure' ciphersuite; for the possible implementation flaws I listed above, the other side would have no good way of checking on them.
