Cheat sheet update/refactor proposal: TLS_Cipher_String_Cheat_Sheet - TLSv1.3

[0xb4lint]

Hello OWASP!

First of all, thanks for migrating Cheat Sheet Series to GitHub. 😉

I'd like to get a statement from your side about the TLSv1.3 topic.
Currently the OWASP Cipher String 'A+' uses TLSv1.2 protocol.

In September 2018 OpenSSL released the final TLSv1.3 support in the 1.1.1 version.
Firefox 61 (June 2018) has been released with on-by-default support for TLSv1.3.
Chrome 70 (October 2018) has been released with on-by-default support for TLSv1.3.

There are open issues in Mozilla SSL Generator in this topic: mozilla/server-side-tls#217,
mozilla/server-side-tls#191.

I'd be happy if OWASP releases an update for the recommended TLS (1.3) cipher strings.
Then I can update nginxconfig.io with the new rulesets (digitalocean/nginxconfig.io#42).

[righettod]

Hi,
You are welcome 😃
I accept your proposal, thanks you very much for it.

[righettod]

Done in PR #15

[0xb4lint]

@righettod I think #15 is a whole different story.
This issue is about TLSv1.3.

[righettod]

Each PR need to have a issue associated to it, so this issue is not related to the PR #15 ?
I have re-added the images to restore the state.

[0xb4lint]

I'm sorry, my mistake.
I've just started to dig about TLSv1.3 and the ciphers table came into picture and made a quick PR about it.

Anyway, let's focus to TLSv1.3. 😉
How does this work at OWASP? Is there a roadmap about updating the TLS cipher string scenarios? Or are you open to open source contributions?

[righettod]

Don't worry, there no problem at all 😃
We have moved the project to GH in order to allow open source contributions so feel free to made PR(s) to update the content of the TLS CS if you want to focus on this topic...

[righettod]

OK I consider this issue closed in order to keep a clean state, you will open another issue when you will submit TLS v1.3 content on the CS.