RFC 10015: Deprecating Obsolete Key Exchange Methods in TLS 1.2 and DTLS 1.2

1. Introduction

(D)TLS 1.2 supports a assortment of cardinal speech algorithms, including RSA, Diffie-Hellman (DH) over a finite field, and Elliptic Curve Diffie-Hellman (ECDH).¶

DH cardinal exchange, complete immoderate group, comes successful ephemeral and non-ephemeral varieties. Non-ephemeral DH algorithms usage fixed DH nationalist keys included in the authenticating peer's certificate; spot [RFC4492] for discussion. In contrast, ephemeral DH algorithms usage ephemeral DH nationalist keys sent successful the handshake and authenticated by the peer's certificate. Ephemeral and non-ephemeral finite section DH algorithms are called DHE and DH (or FFDHE and FFDH), respectively, and ephemeral and non-ephemeral elliptic curve DH algorithms are called ECDHE and ECDH, respectively [RFC4492].¶

In general, non-ephemeral cipher suites are not recommended owed to their deficiency of forward secrecy. Moreover, arsenic demonstrated by the Raccoon onslaught [RACCOON] connected finite section DH, nationalist cardinal reuse (either via non-ephemeral cipher suites aliases reused keys with ephemeral cipher suites) tin lead to timing broadside channels that whitethorn leak connection secrets. For ECDH, invalid curve attacks likewise utilization secret reuse successful bid to break information [ICA], further demonstrating the consequence of reusing public keys. While some broadside channels tin beryllium avoided successful implementations, experience shows that successful practice, implementations whitethorn neglect to thwart specified attacks owed to the complexity and number of the required mitigations.¶

Additionally, RSA cardinal speech suffers from information problems that are independent of implementation choices arsenic good arsenic problems that stem purely from the difficulty of implementing information countermeasures correctly.¶

At a unsmooth glance, the problems affecting FFDHE successful (D)TLS 1.2 are arsenic follows:¶

1. FFDHE suffers from interoperability problems because location is nary system for negotiating the group, and immoderate implementations only support mini group sizes (see [RFC7919], Section 1).¶

2. FFDHE groups whitethorn person mini subgroups, which enables respective attacks [SUBGROUPS]. When presented pinch a custom, non-standardized FFDHE group, a handshaking customer cannot practically verify that the group chosen by the server does not suffer from this problem. There is besides nary system for specified handshakes to autumn backmost to different cardinal speech parameters that are acceptable to the client. Custom FFDHE groups are wide (as a consequence of proposal based connected [WEAK-DH]). Therefore, clients cannot simply cull handshakes that coming custom, and frankincense perchance dangerous, groups.¶

3. In practice, immoderate operators usage 1024-bit FFDHE groups since this is the maximum size that ensures wide support (see [RFC7919], Section 1). This size leaves only a mini information separator versus the existent discrete log record, which stands astatine 795 bits [DLOG795].¶

4. Expanding connected the erstwhile point, conscionable a fistful of very ample computations allow an attacker to cheaply decrypt a comparatively ample fraction of FFDHE traffic (namely, postulation encrypted utilizing peculiar standardized groups) [WEAK-DH].¶

5. When secrets are not afloat ephemeral, FFDHE suffers from the Raccoon side-channel onslaught [RACCOON]. (Note that FFDH is inherently susceptible to the Raccoon attack unless constant-time mitigations are employed.)¶

The problems affecting RSA cardinal speech successful (D)TLS 1.2 are arsenic follows:¶

1. RSA cardinal speech offers nary guardant secrecy, by construction.¶

2. RSA cardinal speech whitethorn beryllium susceptible to Bleichenbacher's onslaught [BLEI]. Experience shows that variants of this onslaught originate each fewer years because implementing the applicable countermeasure correctly is difficult (see [ROBOT], [NEW-BLEI], and [DROWN]).¶

3. In summation to the supra point, location is nary convenient system successful (D)TLS 1.2 for the domain separation of keys. Therefore, a azygous endpoint that is susceptible to Bleichenbacher's onslaught would impact each endpoints sharing the aforesaid RSA cardinal (see [XPROT] and [DROWN]).¶

This archive updates [RFC4162], [RFC4279], [RFC4346], [RFC4785], [RFC5246], [RFC5288], [RFC5289], [RFC5469], [RFC5487], [RFC5932], [RFC6209], [RFC6347], [RFC6367], [RFC6655], [RFC7905], [RFC8422], and [RFC9325] to remediate the supra problems, by deprecating and discouraging the usage of affected cipher suites, arsenic listed successful Sections 5.2, 5.3, 5.4, and 5.5.¶

BCP 195 [RFC8996] [RFC9325] contains the latest IETF recommendations for users of the (D)TLS protocol (and specifically, (D)TLS 1.2), and this document updates [RFC9325] successful respective points. Section 6 specifications the nonstop differences. All different recommendations successful the BCP documents stay valid.¶

9. References