RFC 10015: Deprecating Obsolete Key Exchange Methods in TLS 1.2 and DTLS 1.2

2 comments

• sidewndr46 1 hour ago
  Couldn't folks just use TLS 1.3?
  [-]
  • mjevans 46 minutes ago
    I think the entire point is so that many with devices that will never see updates can still continue to use those devices.
    [-]
    • ImPostingOnHN 26 minutes ago
      what stops folks from continuing to use them as-is, aside from this threat to break TLS 1.2 for them?

      if a service runs TLS 1.2, and a client runs TLS 1.2, and they can talk to each other right now, why change the language?

      if you released a thing, and people are choosing not to use it, is the right move really to enshittify their current choice to force them off it?
  • 0ckpuppet 1 hour ago
    These prescriptions apply only to (D)TLS 1.2, since (D)TLS 1.0 and TLS 1.1 are deprecated by RFC 8996 and (D)TLS 1.3 either does not use the affected algorithms or does not share the relevant configuration options. (There is no DTLS version 1.1.)
  • ImPostingOnHN 1 hour ago
    better to break tons of existing installations and require confusing, arcane config file modifications just for folks to get things back to where they were before being broken