RFC 10015

Deprecating Obsolete Key Exchange Methods in TLS 1.2 and DTLS 1.2

📅 published July 2026, from ietf

RFC 10015: Deprecating Obsolete Key Exchange Methods in TLS 1.2 and DTLS 1.2 🎀

Okay bestie, the title block tea ☕: this is from the IETF (Internet Engineering Task Force) 🌈 and the author is N. Aviram 💅. It's dated July 2026 and it's a Standards Track doc, so it's the real deal ✨. The ISSN is 2070-1721. It's RFC 10015 (Request for Comments: 10015) 🦋, and it updates RFCs 4162, 4279, 4346, 4785, 5246, 5288, 5289, 5469, 5487, 5932, 6209, 6347, 6367, 6655, 7905, 8422, and 9325. That's a lot of updates, iykyk 🙈.

Abstract 🌸

Okay so for (D)TLS 1.2 💖, this doc deprecates two key exchanges: Diffie-Hellman (DH) over a finite field, and RSA. It also discourages static Elliptic Curve Diffie-Hellman (ECDH) cipher suites.

These prescriptions only apply to (D)TLS 1.2. That's because (D)TLS 1.0 and TLS 1.1 are deprecated by RFC 8996, and (D)TLS 1.3 either doesn't use the affected algorithms or doesn't share the relevant configuration options. (There is no DTLS version 1.1 🙈.)

This document updates RFCs 4162, 4279, 4346, 4785, 5246, 5288, 5289, 5469, 5487, 5932, 6209, 6347, 6367, 6655, 7905, 8422, and 9325 so they either deprecate or discourage cipher suites using the above key exchange methods in (D)TLS 1.2 connections 🫶.

Status of This Memo 📜

This is an Internet Standards Track document, bestie 💅. It's a product of the IETF and represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). More info on Internet Standards is in Section 2 of RFC 7841 🔍.

For the current status, any errata, and how to send feedback, check https://www.rfc-editor.org/info/rfc10015 🦋.

Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.

This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as in effect on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this doc 📑. Code Components pulled out of this doc must include Revised BSD License text, as described in Section 4.e of the Trust Legal Provisions. They're also provided without warranty, as described in the Revised BSD License 🧾.

Table of Contents 🧚

   1.  Introduction
     1.1.  Requirements Language
   2.  Non-Ephemeral Diffie-Hellman
   3.  Ephemeral Finite Field Diffie-Hellman
   4.  RSA
   5.  Updates to Cipher Suites and TLS ClientCertificateType
           Identifiers
     5.1.  DH Cipher Suites Deprecated by This Document
     5.2.  ECDH Cipher Suites Whose Use Is Discouraged by This
           Document
     5.3.  DHE Cipher Suites Deprecated by This Document
     5.4.  RSA Cipher Suites Deprecated by This Document
     5.5.  TLS ClientCertificateType Identifiers Deprecated by This
           Document
   6.  Updates to RFC 9325
   7.  IANA Considerations
   8.  Security Considerations
   9.  References
     9.1.  Normative References
     9.2.  Informative References
   Acknowledgments
   Author's Address

1. Introduction 🌈

Let's talk about (D)TLS 1.2 🔐. It supports a bunch of key exchange algorithms, including RSA, Diffie-Hellman (DH) over a finite field, and Elliptic Curve Diffie-Hellman (ECDH).

DH key exchange, over any group, comes in two flavours: ephemeral and non-ephemeral 🦋. Non-ephemeral DH uses static DH public keys that live in the authenticating peer's certificate (see [RFC4492] for discussion). Ephemeral DH uses ephemeral DH public keys that get sent in the handshake and are authenticated by the peer's certificate. Ephemeral and non-ephemeral finite field DH algorithms are called DHE and DH (or FFDHE and FFDH), respectively. Ephemeral and non-ephemeral elliptic curve DH algorithms are called ECDHE and ECDH, respectively [RFC4492].

In general, non-ephemeral cipher suites are not recommended due to their lack of forward secrecy 😭. Moreover, as demonstrated by the Raccoon attack [RACCOON] on finite field DH, public key reuse (either via non-ephemeral cipher suites or reused keys with ephemeral cipher suites) can lead to timing side channels that may leak connection secrets. For ECDH, invalid curve attacks similarly exploit secret reuse in order to break security [ICA], which further shows the risk of reusing public keys. Both side channels can be avoided in implementations. Still, experience shows that in practice, implementations may fail to thwart such attacks because of the complexity and number of the required mitigations 💀.

Additionally, RSA key exchange suffers from security problems that are independent of implementation choices. It also has problems that stem purely from the difficulty of implementing security countermeasures correctly.

Okay, here's a rough glance at what's going on with FFDHE in (D)TLS 1.2 👀:

  1. FFDHE suffers from interoperability problems because there is no mechanism for negotiating the group, and some implementations only support small group sizes (see [RFC7919], Section 1).
  2. FFDHE groups may have small subgroups, which enables several attacks [SUBGROUPS]. When presented with a custom, non-standardized FFDHE group, a handshaking client cannot practically verify that the group chosen by the server doesn't suffer from this problem. There's also no mechanism for such handshakes to fall back to other key exchange parameters that are acceptable to the client. Custom FFDHE groups are widespread (as a result of advice based on [WEAK-DH]). Therefore, clients cannot simply reject handshakes that present custom, and thus potentially dangerous, groups.
  3. In practice, some operators use 1024-bit FFDHE groups, since this is the maximum size that ensures wide support (see [RFC7919], Section 1). This size leaves only a small security margin versus the current discrete log record, which stands at 795 bits [DLOG795].
  4. Expanding on the previous point, just a handful of very large computations allow an attacker to cheaply decrypt a relatively large fraction of FFDHE traffic (namely, traffic encrypted using particular standardized groups) [WEAK-DH].
  5. When secrets are not fully ephemeral, FFDHE suffers from the Raccoon side-channel attack [RACCOON]. (Note that FFDH is inherently vulnerable to the Raccoon attack unless constant-time mitigations are employed.)

And here's the RSA key exchange tea in (D)TLS 1.2 🍵:

  1. RSA key exchange offers no forward secrecy, by construction.
  2. RSA key exchange may be vulnerable to Bleichenbacher's attack [BLEI]. Variants of this attack arise every few years because implementing the relevant countermeasure correctly is difficult (see [ROBOT], [NEW-BLEI], and [DROWN]).
  3. In addition to the above point, there is no convenient mechanism in (D)TLS 1.2 for the domain separation of keys. So a single endpoint that is vulnerable to Bleichenbacher's attack would affect all endpoints sharing the same RSA key (see [XPROT] and [DROWN]).

This document updates [RFC4162], [RFC4279], [RFC4346], [RFC4785], [RFC5246], [RFC5288], [RFC5289], [RFC5469], [RFC5487], [RFC5932], [RFC6209], [RFC6347], [RFC6367], [RFC6655], [RFC7905], [RFC8422], and [RFC9325] to remediate all of the above problems. It does this by deprecating and discouraging the use of affected cipher suites, as listed in Sections 5.2, 5.3, 5.4, and 5.5 ✨.

BCP 195 [RFC8996] [RFC9325] contains the latest IETF recommendations for users of the (D)TLS protocol (and specifically, (D)TLS 1.2). This document updates [RFC9325] in several points. Section 6 details the exact differences. All other recommendations in the BCP documents remain valid 🫶.

1.1. Requirements Language 📖

Okay, so the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this doc get interpreted as described in BCP 14 [RFC2119] [RFC8174]. But only when, and only when, they show up in all capitals, just like here 💜.

2. Non-Ephemeral Diffie-Hellman 💅

No cap: Clients MUST NOT offer and servers MUST NOT select non-ephemeral FFDH cipher suites in (D)TLS 1.2 connections. (Quick side note: (D)TLS 1.0 and TLS 1.1 are deprecated by [RFC8996], and (D)TLS 1.3 does not support FFDH [RFC9846] [RFC9147].) This includes all cipher suites listed in Table 1 in Section 5.1.

Clients SHOULD NOT offer and servers SHOULD NOT select non-ephemeral ECDH cipher suites in (D)TLS 1.2 connections. (This requirement is already present in [RFC9325]. Also, (D)TLS 1.0 and TLS 1.1 are deprecated by [RFC8996], and (D)TLS 1.3 does not support ECDH [RFC9846] [RFC9147].) This includes all cipher suites listed in Table 2 in Section 5.2 🍓.

In addition, to avoid the use of non-ephemeral DH, clients SHOULD NOT use and servers SHOULD NOT accept certificates with fixed DH parameters 🙅‍♀️. These certificate types are rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh, as listed in Section 5.5. These values only apply to (D)TLS versions of 1.2 and below.

3. Ephemeral Finite Field Diffie-Hellman 🦋

Clients MUST NOT offer and servers MUST NOT select FFDHE cipher suites in (D)TLS 1.2 connections. This includes all cipher suites listed in Table 3 in Section 5.3. (Note that (D)TLS 1.0 and TLS 1.1 are deprecated by [RFC8996].) FFDHE cipher suites in (D)TLS 1.3 do not suffer from the problems presented in Section 1. See [RFC9846] and [RFC9147]. Therefore, clients and servers MAY offer FFDHE cipher suites in (D)TLS 1.3 connections. 🧚

4. RSA 🔥

Clients MUST NOT offer and servers MUST NOT select RSA cipher suites in (D)TLS 1.2 connections. (Note that (D)TLS 1.0 and TLS 1.1 are deprecated by [RFC8996], and (D)TLS 1.3 does not support static RSA [RFC9846] [RFC9147].) This includes all cipher suites listed in Table 4 in Section 5.4. Note that these cipher suites were previously marked as not recommended in the "TLS Cipher Suites" registry [TLS-REGISTRY] 👀.

5. Updates to Cipher Suites and TLS ClientCertificateType Identifiers 👑

The following subsections mention the use of "D" in the "Recommended" column of the "TLS Cipher Suites" and "TLS ClientCertificateType Identifiers" registries [TLS-REGISTRY]. See [RFC9847] for information on the use of the "D" ✨.

~ to be continued in part 2 🫶 ~

5.1. DH Cipher Suites Deprecated by This Document ✨

okay bestie, the tea 🫖 is that IANA went into the "TLS Cipher Suites" registry [TLS-REGISTRY] and set the "Recommended" column to "D" for every DH entry in this list, and added this document as a reference for each one. this section is literally about the suites this document deprecates, so these are the ones getting the glow-down 💀

it's a long table, but every single row matters, so here it is in full 🫶

    +==========================================+=====================+
    | Cipher Suite                             | Reference           |
    +==========================================+=====================+
    | TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA     | [RFC4346]           |
    +------------------------------------------+---------------------+
    | TLS_DH_DSS_WITH_DES_CBC_SHA              | [RFC8996]           |
    +------------------------------------------+---------------------+
    | TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA         | [RFC5246]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA     | [RFC4346]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_WITH_DES_CBC_SHA              | [RFC8996]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA         | [RFC5246]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_EXPORT_WITH_RC4_40_MD5       | [RFC4346] [RFC6347] |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_RC4_128_MD5             | [RFC5246] [RFC6347] |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA    | [RFC4346]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_DES_CBC_SHA             | [RFC8996]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_3DES_EDE_CBC_SHA        | [RFC5246]           |
    +------------------------------------------+---------------------+
    | TLS_DH_DSS_WITH_AES_128_CBC_SHA          | [RFC5246]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_WITH_AES_128_CBC_SHA          | [RFC5246]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_AES_128_CBC_SHA         | [RFC5246]           |
    +------------------------------------------+---------------------+
    | TLS_DH_DSS_WITH_AES_256_CBC_SHA          | [RFC5246]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_WITH_AES_256_CBC_SHA          | [RFC5246]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_AES_256_CBC_SHA         | [RFC5246]           |
    +------------------------------------------+---------------------+
    | TLS_DH_DSS_WITH_AES_128_CBC_SHA256       | [RFC5246]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_WITH_AES_128_CBC_SHA256       | [RFC5246]           |
    +------------------------------------------+---------------------+
    | TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA     | [RFC5932]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA     | [RFC5932]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA    | [RFC5932]           |
    +------------------------------------------+---------------------+
    | TLS_DH_DSS_WITH_AES_256_CBC_SHA256       | [RFC5246]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_WITH_AES_256_CBC_SHA256       | [RFC5246]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_AES_128_CBC_SHA256      | [RFC5246]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_AES_256_CBC_SHA256      | [RFC5246]           |
    +------------------------------------------+---------------------+
    | TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA     | [RFC5932]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA     | [RFC5932]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA    | [RFC5932]           |
    +------------------------------------------+---------------------+
    | TLS_DH_DSS_WITH_SEED_CBC_SHA             | [RFC4162]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_WITH_SEED_CBC_SHA             | [RFC4162]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_SEED_CBC_SHA            | [RFC4162]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_WITH_AES_128_GCM_SHA256       | [RFC5288]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_WITH_AES_256_GCM_SHA384       | [RFC5288]           |
    +------------------------------------------+---------------------+
    | TLS_DH_DSS_WITH_AES_128_GCM_SHA256       | [RFC5288]           |
    +------------------------------------------+---------------------+
    | TLS_DH_DSS_WITH_AES_256_GCM_SHA384       | [RFC5288]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_AES_128_GCM_SHA256      | [RFC5288]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_AES_256_GCM_SHA384      | [RFC5288]           |
    +------------------------------------------+---------------------+
    | TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256  | [RFC5932]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256  | [RFC5932]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256 | [RFC5932]           |
    +------------------------------------------+---------------------+
    | TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256  | [RFC5932]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256  | [RFC5932]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 | [RFC5932]           |
    +------------------------------------------+---------------------+
    | TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256      | [RFC6209]           |
    +------------------------------------------+---------------------+
    | TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384      | [RFC6209]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256      | [RFC6209]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384      | [RFC6209]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_ARIA_128_CBC_SHA256     | [RFC6209]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_ARIA_256_CBC_SHA384     | [RFC6209]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256      | [RFC6209]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384      | [RFC6209]           |
    +------------------------------------------+---------------------+
    | TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256      | [RFC6209]           |
    +------------------------------------------+---------------------+
    | TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384      | [RFC6209]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_ARIA_128_GCM_SHA256     | [RFC6209]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_ARIA_256_GCM_SHA384     | [RFC6209]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256  | [RFC6367]           |
    +------------------------------------------+---------------------+
    | TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384  | [RFC6367]           |
    +------------------------------------------+---------------------+
    | TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256  | [RFC6367]           |
    +------------------------------------------+---------------------+
    | TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384  | [RFC6367]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256 | [RFC6367]           |
    +------------------------------------------+---------------------+
    | TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384 | [RFC6367]           |
    +------------------------------------------+---------------------+

                                 Table 1

that's every single row, no skipping, no cap 🌸

5.2. ECDH Cipher Suites Whose Use Is Discouraged by This Document ✨

okay bestie, so [RFC9325] says implementations SHOULD NOT negotiate the cipher suites below 💅 That's why they were sitting there with "N" in the "Recommended" column of the IANA "TLS Cipher Suites" registry [TLS-REGISTRY]. Now this document tells IANA to flip each one to "D" so they line up with [RFC9847] (and this doc gets added as a reference for every single one) 🦋 It also explains why these suites are getting the side-eye, and it points at earlier analyses and attacks that show the risks (see Section 8) 🔥

+=============================================+=====================+
| Cipher Suite                                | Reference           |
+=============================================+=====================+
| TLS_ECDH_ECDSA_WITH_NULL_SHA                | [RFC8422]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_ECDSA_WITH_RC4_128_SHA             | [RFC8422]           |
|                                             | [RFC6347]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA        | [RFC8422]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA         | [RFC8422]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA         | [RFC8422]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_RSA_WITH_NULL_SHA                  | [RFC8422]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_RSA_WITH_RC4_128_SHA               | [RFC8422]           |
|                                             | [RFC6347]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA          | [RFC8422]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_RSA_WITH_AES_128_CBC_SHA           | [RFC8422]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_RSA_WITH_AES_256_CBC_SHA           | [RFC8422]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_anon_WITH_NULL_SHA                 | [RFC8422]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_anon_WITH_RC4_128_SHA              | [RFC8422]           |
|                                             | [RFC6347]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA         | [RFC8422]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_anon_WITH_AES_128_CBC_SHA          | [RFC8422]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_anon_WITH_AES_256_CBC_SHA          | [RFC8422]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256      | [RFC5289]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384      | [RFC5289]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256        | [RFC5289]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384        | [RFC5289]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256      | [RFC5289]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384      | [RFC5289]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256        | [RFC5289]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384        | [RFC5289]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256     | [RFC6209]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384     | [RFC6209]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256       | [RFC6209]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384       | [RFC6209]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256     | [RFC6209]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384     | [RFC6209]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256       | [RFC6209]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384       | [RFC6209]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 | [RFC6367]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 | [RFC6367]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256   | [RFC6367]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384   | [RFC6367]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 | [RFC6367]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 | [RFC6367]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256   | [RFC6367]           |
+---------------------------------------------+---------------------+
| TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384   | [RFC6367]           |
+---------------------------------------------+---------------------+

Table 2

5.3. DHE Cipher Suites Deprecated by This Document 💔

okay bestie, this is the big one 😭🫶 IANA has set the "Recommended" column to "D" and added this document as a reference for the following entries in the "TLS Cipher Suites" registry [TLS-REGISTRY] 🦋

    +===========================================+=====================+
    | Cipher Suite                              | Reference           |
    +===========================================+=====================+
    | TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA     | [RFC4346]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_DSS_WITH_DES_CBC_SHA              | [RFC8996]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA         | [RFC5246]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA     | [RFC4346]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_DES_CBC_SHA              | [RFC8996]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA         | [RFC5246]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_NULL_SHA                 | [RFC4785]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_DSS_WITH_AES_128_CBC_SHA          | [RFC5246]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_AES_128_CBC_SHA          | [RFC5246]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_DSS_WITH_AES_256_CBC_SHA          | [RFC5246]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_AES_256_CBC_SHA          | [RFC5246]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_DSS_WITH_AES_128_CBC_SHA256       | [RFC5246]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA     | [RFC5932]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA     | [RFC5932]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_AES_128_CBC_SHA256       | [RFC5246]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_DSS_WITH_AES_256_CBC_SHA256       | [RFC5246]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_AES_256_CBC_SHA256       | [RFC5246]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA     | [RFC5932]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA     | [RFC5932]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_RC4_128_SHA              | [RFC4279] [RFC6347] |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA         | [RFC4279]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_AES_128_CBC_SHA          | [RFC4279]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_AES_256_CBC_SHA          | [RFC4279]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_DSS_WITH_SEED_CBC_SHA             | [RFC4162]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_SEED_CBC_SHA             | [RFC4162]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_AES_128_GCM_SHA256       | [RFC5288]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_AES_256_GCM_SHA384       | [RFC5288]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_DSS_WITH_AES_128_GCM_SHA256       | [RFC5288]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_DSS_WITH_AES_256_GCM_SHA384       | [RFC5288]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_AES_128_GCM_SHA256       | [RFC5487]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_AES_256_GCM_SHA384       | [RFC5487]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_AES_128_CBC_SHA256       | [RFC5487]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_AES_256_CBC_SHA384       | [RFC5487]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_NULL_SHA256              | [RFC5487]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_NULL_SHA384              | [RFC5487]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256  | [RFC5932]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256  | [RFC5932]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256  | [RFC5932]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256  | [RFC5932]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256      | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384      | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256      | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384      | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256      | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384      | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256      | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384      | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256      | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384      | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256      | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384      | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256  | [RFC6367]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384  | [RFC6367]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256  | [RFC6367]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384  | [RFC6367]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256  | [RFC6367]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384  | [RFC6367]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256  | [RFC6367]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384  | [RFC6367]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_AES_128_CCM              | [RFC6655]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_AES_256_CCM              | [RFC6655]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_AES_128_CCM_8            | [RFC6655]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_AES_256_CCM_8            | [RFC6655]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_AES_128_CCM              | [RFC6655]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_AES_256_CCM              | [RFC6655]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | [RFC7905]           |
    +-------------------------------------------+---------------------+
    | TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 | [RFC7905]           |
    +-------------------------------------------+---------------------+
    | TLS_PSK_DHE_WITH_AES_128_CCM_8            | [RFC6655]           |
    +-------------------------------------------+---------------------+
    | TLS_PSK_DHE_WITH_AES_256_CCM_8            | [RFC6655]           |
    +-------------------------------------------+---------------------+

                                  Table 3

5.4. RSA Cipher Suites Deprecated by This Document 🎀

okay so IANA went and set the "Recommended" column to "D" 💅 and added this document as a reference for the following entries in the "TLS Cipher Suites" registry [TLS-REGISTRY]:

    +===========================================+=====================+
    | Cipher Suite                              | Reference           |
    +===========================================+=====================+
    | TLS_RSA_WITH_NULL_MD5                     | [RFC5246]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_NULL_SHA                     | [RFC5246]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_EXPORT_WITH_RC4_40_MD5            | [RFC4346] [RFC6347] |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_RC4_128_MD5                  | [RFC5246] [RFC6347] |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_RC4_128_SHA                  | [RFC5246] [RFC6347] |
    +-------------------------------------------+---------------------+
    | TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5        | [RFC4346]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_IDEA_CBC_SHA                 | [RFC8996]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_EXPORT_WITH_DES40_CBC_SHA         | [RFC4346]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_DES_CBC_SHA                  | [RFC8996]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_3DES_EDE_CBC_SHA             | [RFC5246]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_NULL_SHA                 | [RFC4785]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_AES_128_CBC_SHA              | [RFC5246]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_AES_256_CBC_SHA              | [RFC5246]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_NULL_SHA256                  | [RFC5246]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_AES_128_CBC_SHA256           | [RFC5246]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_AES_256_CBC_SHA256           | [RFC5246]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA         | [RFC5932]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA         | [RFC5932]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_RC4_128_SHA              | [RFC4279] [RFC6347] |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA         | [RFC4279]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_AES_128_CBC_SHA          | [RFC4279]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_AES_256_CBC_SHA          | [RFC4279]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_SEED_CBC_SHA                 | [RFC4162]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_AES_128_GCM_SHA256           | [RFC5288]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_AES_256_GCM_SHA384           | [RFC5288]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_AES_128_GCM_SHA256       | [RFC5487]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_AES_256_GCM_SHA384       | [RFC5487]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_AES_128_CBC_SHA256       | [RFC5487]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_AES_256_CBC_SHA384       | [RFC5487]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_NULL_SHA256              | [RFC5487]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_NULL_SHA384              | [RFC5487]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256      | [RFC5932]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256      | [RFC5932]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_ARIA_128_CBC_SHA256          | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_ARIA_256_CBC_SHA384          | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_ARIA_128_GCM_SHA256          | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_ARIA_256_GCM_SHA384          | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256      | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384      | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256      | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384      | [RFC6209]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256      | [RFC6367]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384      | [RFC6367]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256  | [RFC6367]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384  | [RFC6367]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256  | [RFC6367]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384  | [RFC6367]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_AES_128_CCM                  | [RFC6655]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_AES_256_CCM                  | [RFC6655]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_AES_128_CCM_8                | [RFC6655]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_WITH_AES_256_CCM_8                | [RFC6655]           |
    +-------------------------------------------+---------------------+
    | TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 | [RFC7905]           |
    +-------------------------------------------+---------------------+

                                  Table 4

5.5. TLS ClientCertificateType Identifiers Deprecated by This Document 🦋

same energy here, bestie ✨ IANA set the "Recommended" column to "D" and added this document as a reference for these entries in the "TLS ClientCertificateType Identifiers" registry [TLS-REGISTRY]:

              +=======================+=====================+
              | Certificate Type      | Reference           |
              +=======================+=====================+
              | rsa_fixed_dh (3)      | [RFC5246] [RFC9847] |
              +-----------------------+---------------------+
              | dss_fixed_dh (4)      | [RFC5246] [RFC9847] |
              +-----------------------+---------------------+
              | rsa_fixed_ecdh (65)   | [RFC8422] [RFC9847] |
              +-----------------------+---------------------+
              | ecdsa_fixed_ecdh (66) | [RFC8422] [RFC9847] |
              +-----------------------+---------------------+

                                  Table 5

6. Updates to RFC 9325 🌸

okay this one is giving "we're fixing the homework from last time" 📚 This document updates [RFC9325] with respect to the use of (D)TLS 1.2, and Table 6 lists the exact changes. All of these changes are made in Section 4.1 of [RFC9325].

         +============================+=============+============+
         |                            | RFC 9325    |  RFC 10015 |
         +============================+=============+============+
         | Non-ephemeral FFDH         | SHOULD NOT  |   MUST NOT |
         +----------------------------+-------------+------------+
         | Non-ephemeral ECDH         | SHOULD NOT  |  No change |
         +----------------------------+-------------+------------+
         | Fixed DH certificate types | Unspecified | SHOULD NOT |
         +----------------------------+-------------+------------+
         | Ephemeral FFDH             | SHOULD NOT  |   MUST NOT |
         +----------------------------+-------------+------------+
         | Static RSA                 | SHOULD NOT  |   MUST NOT |
         +----------------------------+-------------+------------+

                                  Table 6

7. IANA Considerations 🧚

so for the registry paperwork 📝 The "TLS Cipher Suites" and "TLS ClientCertificateType Identifiers" registries both live inside the "Transport Layer Security (TLS) Parameters" registry group [TLS-REGISTRY]. IANA has updated entries in the "TLS Cipher Suites" registry [TLS-REGISTRY] as indicated in Sections 5.1, 5.2, 5.3, and 5.4. IANA has also updated entries in the "TLS ClientCertificateType Identifiers" registry as indicated in Section 5.5.

For each entry listed in Sections 5.1, 5.2, 5.3, 5.4, and 5.5, IANA has set the "Recommended" column to "D" and updated the entry's Reference column to refer to this document. For information about the use of "D" in the "Recommended" column, see [RFC9847]. 💜

8. Security Considerations 🔥

Okay bestie, this is the serious part, so pay attention 🫶 Non-ephemeral finite field DH cipher suites (TLS_DH_*) are prohibited 🚫, and so is reusing ephemeral keys for finite field DH cipher suites, all because of the Raccoon attack [RACCOON]. Both are already considered bad practice since they don't give you forward secrecy 😭. Plus, the Raccoon attack showed that timing side channels in processing TLS premaster secrets can be exploited to reveal the encrypted premaster secret 💀.

Now for non-ephemeral ECDH cipher suites (TLS_ECDH_*) 👀 Skipping forward secrecy doesn't just allow retroactive decryption if the key gets compromised. It can also enable a whole category of attacks where the attacker exploits key reuse to keep querying one cryptographic secret over and over 🙈

This category includes, but isn't necessarily limited to, these examples:

  1. Invalid curve attacks, where the attacker exploits key reuse to repeatedly query and eventually learn the key itself. These attacks have been shown to be practical against real-world TLS implementations [ICA].
  2. Side-channel attacks, where the attacker exploits key reuse and an additional side channel to learn a cryptographic secret. For an example of such an attack, refer to [MAY4].
  3. Fault attacks, where the attacker exploits key reuse and incorrect calculations to learn a cryptographic secret. For an example of such an attack, see [PARIS256].

Such attacks are often implementation-dependent, including the examples above. Still, these examples show that building a system that reuses keys and avoids this category of attacks is difficult in practice 😩 In contrast, avoiding key reuse not only prevents decryption in the event of key compromise, it also precludes this category of attacks altogether ✨ Therefore, this document discourages the reuse of ECDH public keys 🦋

As for ephemeral finite field DH in (D)TLS 1.2 (TLS_DHE_* and TLS_PSK_DHE_*), as explained above, clients have no practical way to support these cipher suites while making sure they only negotiate security parameters that are acceptable to them 🥺 In (D)TLS 1.2, the server chooses the DH group, and custom groups are prevalent. So once the client includes these cipher suites in its handshake and the server presents a custom group, the client cannot complete the handshake while ensuring security. Verifying the group structure is prohibitively expensive for the client. Using a safelist of known-good groups is also impractical, since server operators were encouraged to generate their own custom group. Further, there is no mechanism for the handshake to fall back to other parameters that are acceptable to both the client and server. Main character energy? Nope, the handshake is just stuck 💀

🚨 Bottom line: key reuse and custom DH groups are where things get messy, so avoid both if you can!

9. References ✨

9.1. Normative References

9.2. Informative References ✨

Okay bestie, this is where the receipts live 🧾💅 These are the informative references, the extra reading the doc points to, with every single detail intact 🤓

  • [BLEI] Bleichenbacher, D., "Chosen Ciphertext Attacks against Protocols Based on the RSA Encryption Standard PKCS #1", Advances in Cryptology -- CRYPTO'98, Lecture Notes in Computer Science, vol. 1462, pp. 1-12, DOI 10.1007/BFb0055716, 1998, <https://doi.org/10.1007/BFb0055716>.
  • [DLOG795] Boudot, F., Gaudry, P., Guillevic, A., Heninger, N., Thomé, E., and P. Zimmermann, "Comparing the difficulty of factorization and discrete logarithm: a 240-digit experiment", Cryptology ePrint Archive, Paper 2020/697, DOI 10.1007/978-3-030-56880-1_3, 17 August 2020, <https://eprint.iacr.org/2020/697>.
  • [DROWN] Aviram, N., Schinzel, S., Somorovsky, J., Heninger, N., Dankel, M., Steube, J., Valenta, L., Adrian, D., Halderman, J. A., Dukhovni, V., Käsper, E., Cohney, S., Engels, S., Paar, C., and Y. Shavitt, "DROWN: Breaking TLS using SSLv2", Proceedings of the 25th USENIX Security Symposium, August 2016, <https://drownattack.com/drown-attack-paper.pdf>.
  • [ICA] Jager, T., Schwenk, J., and J. Somorovsky, "Practical invalid curve attacks on TLS-ECDH", ESORICS 2015, Part I, Lecture Notes in Computer Science, vol. 9326, pp. 407-425, DOI 10.1007/978-3-319-24174-6_21, 21 September 2015, <https://link.springer.com/content/pdf/10.1007/978-3-319-24174-6_21.pdf>.
  • [MAY4] Genkin, D., Valenta, L., and Y. Yarom, "May the Fourth Be With You: A Microarchitectural Side Channel Attack on Several Real-World Applications of Curve25519", Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, DOI 10.1145/3133956.3134029, 30 October 2017, <https://dl.acm.org/doi/pdf/10.1145/3133956.3134029>.
  • [NEW-BLEI] Meyer, C., Somorovsky, J., Weiss, E., Schwenk, J., Schinzel, S., and E. Tews, "Revisiting SSL/TLS Implementations: New Bleichenbacher Side Channels and Attacks", Proceedings of the 23rd USENIX Security Symposium, August 2014, <https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-meyer.pdf>.
  • [PARIS256] Devlin, S. and F. Valsorda, "The PARIS256 Attack", 8 August 2018, <https://i.blackhat.com/us-18/Wed-August-8/us-18-Valsorda-Squeezing-A-Key-Through-A-Carry-Bit-wp.pdf>.
  • [RACCOON] Merget, R., Brinkmann, M., Aviram, N., Somorovsky, J., Mittmann, J., and J. Schwenk, "Raccoon Attack: Finding and Exploiting Most-Significant-Bit-Oracles in TLS-DH(E)", 9 September 2020, <https://raccoon-attack.com/RacoonAttack.pdf>.
  • [RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and B. Moeller, "Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS)", RFC 4492, DOI 10.17487/RFC4492, May 2006, <https://www.rfc-editor.org/info/rfc4492>.
  • [ROBOT] Boeck, H., Somorovsky, J., and C. Young, "Return Of Bleichenbacher's Oracle Threat (ROBOT)", Proceedings of the 27th USENIX Security Symposium, August 2018, <https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-bock.pdf>.
  • [SUBGROUPS] Valenta, L., Adrian, D., Sanso, A., Cohney, S., Fried, J., Hastings, M., Halderman, J. A., and N. Heninger, "Measuring small subgroup attacks against Diffie-Hellman", Cryptology ePrint Archive, Paper 2016/995, 17 October 2016, <https://eprint.iacr.org/2016/995/20161017:193515>.
  • [TLS-REGISTRY] IANA, "Transport Layer Security (TLS) Parameters", <https://www.iana.org/assignments/tls-parameters>.
  • [WEAK-DH] Adrian, D., Bhargavan, K., Durumeric, Z., Gaudry, P., Green, M., Halderman, J. A., Heninger, N., Springall, D., Thomé, E., Valenta, L., VanderSloot, B., Wustrow, E., Zanella-Béguelin, S., and P. Zimmermann, "Weak Diffie-Hellman and the Logjam Attack", October 2015, <https://weakdh.org/>.
  • [XPROT] Jager, T., Schwenk, J., and J. Somorovsky, "On the Security of TLS 1.3 and QUIC Against Weaknesses in PKCS#1 v1.5 Encryption", Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, pp. 1185-1196, DOI 10.1145/2810103.2813657, October 2015, <https://doi.org/10.1145/2810103.2813657>.

Acknowledgments 🫶

Carrie Bartle 💖 deserves a huge shoutout! She wrote much of the prose and presented it several times at the IETF TLS WG 🎀 This document really includes so many important contributions from her.

The document was inspired by discussions on the TLS WG mailing list 📬 and by a suggestion from Filippo Valsorda after the release of the Raccoon attack [RACCOON] 🦝✨ Thanks to Christopher A. Wood for writing up the initial draft of this document 🌸 Thanks also to Thomas Fossati, Sean Turner, Joe Salowey, Yaron Sheffer, Christian Buchgraber, John Preuß Mattsson, and Manuel Pégourié-Gonnard for their comments and suggestions 🙌

Author's Address 💌

Nimrod Aviram

Email: nimrod.aviram@gmail.com

📦 where this page comes from