LANGUAGES Signal 270
RFC 10015: Deprecating Obsolete Key Exchange Methods in TLS 1.2 and DTLS 1.2
Engineers maintaining TLS 1.2 endpoints should plan to phase out these key exchange methods, as they carry inherent weaknesses including lack of forward secrecy and susceptibility to timing side-channel attacks like Raccoon. The impact is tangible because custom FFDHE groups are widespread in practice and RSA key exchange remains commonly used, meaning many deployments will need configuration or code changes.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Finite-field DH and RSA key exchanges are deprecated for (D)TLS 1.2 due to security flaws that include timing side-channel attacks and implementation difficulty of necessary mitigations.
Static ECDH cipher suites are discouraged but not fully deprecated, primarily because they lack forward secrecy and are vulnerable to invalid curve attacks when keys are reused.
These prescriptions target only (D)TLS 1.2, since earlier versions are already deprecated and (D)TLS 1.3 does not use the affected algorithms or share the relevant configuration options.
THE CLUSTER