RFC 10015: Deprecating Obsolete Key Exchange Methods in TLS 1.2 and DTLS 1.2
3 hours ago
- RFC 10015 deprecates Diffie-Hellman (DH) over finite fields and RSA key exchanges in (D)TLS 1.2, and discourages static Elliptic Curve Diffie-Hellman (ECDH) cipher suites.
- Non-ephemeral DH algorithms lack forward secrecy and are vulnerable to attacks like Raccoon (timing side channel) and invalid curve attacks due to key reuse.
- Ephemeral FFDHE in (D)TLS 1.2 has interoperability issues, small subgroups, weak 1024-bit groups, and Raccoon vulnerability, with no mechanism for secure fallback.
- RSA key exchange is deprecated in (D)TLS 1.2 due to lack of forward secrecy and vulnerability to Bleichenbacher attacks, which are difficult to mitigate.
- The document updates the IANA TLS Cipher Suites registry to set the 'Recommended' column to 'D' for deprecated cipher suites, affecting RFCs 4162, 4279, 4346, etc.
- It updates RFC 9325 by changing requirements: non-ephemeral FFDH from SHOULD NOT to MUST NOT, ephemeral FFDH from SHOULD NOT to MUST NOT, and static RSA from SHOULD NOT to MUST NOT.