0
1
IETF Approves TLS 1.3 as Internet Standard
The Internet Engineering Task Force (IETF) —the organization that approves proposed Internet standards and protocols— has formally approved TLS 1.3 as the next major version of the Transport Layer Security (TLS) protocol.
The decision comes after four years of discussions and 28 protocol drafts, with the 28th being selected as the final version.
TLS 1.3 is now expected to become the standard method in which a client and server establish an encrypted communications channel across the Internet —aka HTTPS connections.
TLS 1.3 brings better crypto, less latency
The protocol has several advantages over its previous version —TLS 1.2. The biggest feature is that TLS 1.3 ditches older encryption and hashing algorithms (such as MD5 and SHA-224) for newer and harder to crack alternatives (such as ChaCha20, Poly1305, Ed25519, x25519, and x448).
Second, TLS 1.3 is also much faster at negotiating the initial handshake between the client and the server, reducing the connection latency that many companies cited when justifying not supporting HTTPS over HTTP.
Third, TLS 1.3 will also support features like TLS False Start and Zero Round Trip Time (0-RTT) also help cut down the time needed to establish encryption handshakes with hosts to which the client has talked before.
Fourth, TLS 1.3 is also superior to previous TLS versions because it comes with protection against downgrade attacks that prevent an attacker from tricking a server into using an older version of the protocol, susceptible to known vulnerabilities.
IETF avoids efforts to insert backdoor
All in all, TLS 1.3 is a serious boost to Internet security, being considered nigh impossible to crack, at least with today’s resources.
IETF members voted the protocol unanimously, even after members of the financial sector asked for the introduction of a backdoor in the protocol’s structure, so financial institutions could decrypt TLS 1.3 traffic inside internal networks.
The proposal was laughed off by experts, who pointed out that the backdoor would effectively make TLS 1.3 useless in the first place.
The middlebox problem
Browsers like Chrome, Edge, Firefox, and Pale Moon have already rolled out support for earlier versions of the TLS 1.3 draft, and are now expected to update this support to the official standard.
While browsers will be the quickest ones to implement TLS 1.3, the major problem relies with older Internet middlebox equipment that will need to receive firmware updates to support the new protocol.
A Cloudflare survey carried out in December 2017 revealed that TLS 1.3 accounted for only 0.06% of Internet HTTPS traffic and that the main reason for this puny market share was that many middleboxes were intentionally downgrading traffic, as they could not support it.
These old and aging Internet middleboxes were also at the heart of an incident in February 2017 when over 50,000 Chromebooks experienced various issues because Google gave TLS 1.3 a more primary role in Chrome OS, leading to flickering screens and bricked devices. Google eventually rolled back TLS 1.3 support in Chrome OS to fix the problem.
To read the original article
https://www.bleepingcomputer.com/news/security/ietf-approves-tls-13-as-internet-standard/
