At long last, TLS
1.2 has been published:
1.2. Major Differences from TLS 1.1 This document is a revision of the TLS 1.1 [TLS1.1] protocol which contains improved flexibility, particularly for negotiation of cryptographic algorithms. The major changes are: - The MD5/SHA-1 combination in the pseudorandom function (PRF) has been replaced with cipher-suite-specified PRFs. All cipher suites in this document use P_SHA256. - The MD5/SHA-1 combination in the digitally-signed element has been replaced with a single hash. Signed elements now include a field that explicitly specifies the hash algorithm used. - Substantial cleanup to the client's and server's ability to specify which hash and signature algorithms they will accept. Note that this also relaxes some of the constraints on signature and hash algorithms from previous versions of TLS. - Addition of support for authenticated encryption with additional data modes. - TLS Extensions definition and AES Cipher Suites were merged in from external [TLSEXT] and [TLSAES]. - Tighter checking of EncryptedPreMasterSecret version numbers. - Tightened up a number of requirements. - Verify_data length now depends on the cipher suite (default is still 12). - Cleaned up description of Bleichenbacher/Klima attack defenses. - Alerts MUST now be sent in many cases. - After a certificate_request, if no certificates are available, clients now MUST send an empty certificate list. - TLS_RSA_WITH_AES_128_CBC_SHA is now the mandatory to implement cipher suite. - Added HMAC-SHA256 cipher suites. - Removed IDEA and DES cipher suites. They are now deprecated and will be documented in a separate document. - Support for the SSLv2 backward-compatible hello is now a MAY, not a SHOULD, with sending it a SHOULD NOT. Support will probably become a SHOULD NOT in the future. - Added limited "fall-through" to the presentation language to allow multiple case arms to have the same encoding. - Added an Implementation Pitfalls sections - The usual clarifications and editorial work.
V-T day!
Leave a comment