Server Side TLS v5.0 #183

jvehent · 2017-03-02T12:37:10Z

This is the result of the discussion from #178

It's not ready to merge yet, but summarizes the goals of this new version. Please discuss.

ekr · 2017-03-02T15:47:29Z

Server_Side_TLS.mediawiki

-* HSTS: '''max-age=15768000'''
-* Certificate switching: '''None'''
+* Versions: '''TLSv1.3, TLSv1.2'''
+* TLS curves: '''prime256v1, secp384r1, x25519, x448'''


I'm not sure I would recommend x448, given that Firefox doesn't do it. @davidben, does Chrome?

Nope.

(Is that intended to be a preference order? Putting RFC 7748 after NIST curves is odd.)

Agree on ordering, SafeCurves first please

Even if nothing supports it right now, x448 is our only standard-driven, SafeCurve option above x25519. If the server does not support it, it should just skip over it, but the sooner we start pushing for it, the sooner support will be available on both the server and client side. Given that, if this set of recommendations is not the right place for advocating what's next, then I would understanding delaying its inclusion.

x25519 should be preferred, but it also should be optional

I think that x25519, p256, and p384 are fine here. x448 might be awesome in theory, but it's not awesome in practice and we shouldn't tell people to put the effort in for things that they won't get.

ekr · 2017-03-02T15:48:09Z

Server_Side_TLS.mediawiki

+* TLS curves: '''prime256v1, secp384r1, x25519, x448'''
+* Certificate type: '''ECDSA (recommended) or RSA'''
+* Certificate curve: '''prime256v1, secp384r1'''
+* Certificate signature: '''ecdsa-with-SHA256, ecdsa-with-SHA384, ecdsa-with-SHA512, sha256WithRSAEncryption, sha384WithRSAEncryption, sha512WithRSAEncryption'''


I would nail the curves to the hashes TLS 1.3 style

I wonder if we shouldn't dedicate at least a paragraph to RSA-PSS signatures and certificates...

These here are right; you want these in the certificate, and I think that we can rely on TLS stacks to get the PSS thing right. While text on PSS might help, it's probably not going to get the results you want (we might see PSS certificates, which won't work).

we might see PSS certificates, which won't work

they do work in OpenSSL and GnuTLS already; NSS is also slowly progressing towards that direction

ekr · 2017-03-02T15:48:21Z

Server_Side_TLS.mediawiki

+* Certificate type: '''ECDSA (recommended) or RSA'''
+* Certificate curve: '''prime256v1, secp384r1'''
+* Certificate signature: '''ecdsa-with-SHA256, ecdsa-with-SHA384, ecdsa-with-SHA512, sha256WithRSAEncryption, sha384WithRSAEncryption, sha512WithRSAEncryption'''
+* Certificate transparency: '''required'''


I'm not sure why you're requiring this, but in any case it's not specific enough to tell people what to do.

yes, an explanation what it is and how it's handled is needed

ekr · 2017-03-02T15:50:25Z

Server_Side_TLS.mediawiki

+* Bits of security: '''>=112''' (RSA 2048 and above, P-256, P-384)
+* DH Parameter size: '''2048''' (recommend using [#Pre-defined_DHE_groups Pre-defined DHE groups])
+* HSTS: '''max-age=15768000''' (6 months)
+* HPKP: '''max-age=2589000''' (1 month)


What's your rationale for lowering these values.

Also see comments above which apply here.

+1, don't see a reason to lower them in the intermediate

We shouldn't be recommending HPKP.

I agree with @martinthomson, the world is moving away from HPKP

Ack. I'll remove it altogether.

ekr · 2017-03-02T15:50:52Z

Server_Side_TLS.mediawiki

-* HSTS: '''max-age=15768000'''
-* Certificate switching: '''None'''
+* Ciphersuites: '''ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS'''
+* Versions: '''TLSv1.3, TLSv1.2, TLSv1.1, TLSv1'''


Why needs TLSv1?

For what it's worth, if you are getting rid of TLSv1, consider dropping TLSv1.1 as well given there are very few clients/servers that have a max version of TLSv1.1.

because close to 20% of android phones are still on version that does not enable/support TLS1.2 (that is Android earlier than 4.3): https://www.statista.com/statistics/271774/share-of-android-platforms-on-mobile-devices-with-android-os/

jrchamp · 2017-03-02T17:04:10Z

Server_Side_TLS.mediawiki

-* Certificate switching: '''None'''
+* Ciphersuites: '''ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS'''
+* Versions: '''TLSv1.3, TLSv1.2, TLSv1.1, TLSv1'''
+* TLS curves: '''prime256v1, secp384r1, x25519, x448'''


The curve selection and ordering discussion in Modern applies here as well.

tomato42 · 2017-03-08T12:04:56Z

Server_Side_TLS.mediawiki

-* HSTS: '''max-age=15768000'''
-* Certificate switching: '''None'''
+* Versions: '''TLSv1.3, TLSv1.2'''
+* TLS curves: '''prime256v1, secp384r1, x25519, x448'''


x25519 should be preferred, but it also should be optional

tomato42 · 2017-03-08T12:10:15Z

Server_Side_TLS.mediawiki

-* HSTS: '''max-age=15768000'''
-* Certificate switching: '''None'''
+* Ciphersuites: '''ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS'''
+* Versions: '''TLSv1.3, TLSv1.2, TLSv1.1, TLSv1'''


because close to 20% of android phones are still on version that does not enable/support TLS1.2 (that is Android earlier than 4.3): https://www.statista.com/statistics/271774/share-of-android-platforms-on-mobile-devices-with-android-os/

tomato42 · 2017-03-08T12:11:23Z

Server_Side_TLS.mediawiki

+* Ciphersuites: '''ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS'''
+* Versions: '''TLSv1.3, TLSv1.2, TLSv1.1, TLSv1'''
+* TLS curves: '''prime256v1, secp384r1, x25519, x448'''
+* Certificate type: '''ECDSA (recommended) or RSA'''


for intermediate, I think we should recommend ECDSA and RSA - dual cert deployment - or RSA alone

tomato42 · 2017-03-08T12:12:12Z

Server_Side_TLS.mediawiki

+* Bits of security: '''>=112''' (RSA 2048 and above, P-256, P-384)
+* DH Parameter size: '''2048''' (recommend using [#Pre-defined_DHE_groups Pre-defined DHE groups])
+* HSTS: '''max-age=15768000''' (6 months)
+* HPKP: '''max-age=2589000''' (1 month)


+1, don't see a reason to lower them in the intermediate

tomato42 · 2017-03-08T12:14:08Z

Server_Side_TLS.mediawiki

+* HPKP: '''max-age=34387200''' (13 months)
+* Certificate Validity: '''<=398 days''' (13 months)
+* OCSP Stapling: '''required'''
+* CAA: '''recommended'''


CAA is not explained in the document

tomato42 · 2017-03-08T12:15:01Z

Server_Side_TLS.mediawiki

+* Certificate type: '''ECDSA (recommended) or RSA'''
+* Certificate curve: '''prime256v1, secp384r1'''
+* Certificate signature: '''ecdsa-with-SHA256, ecdsa-with-SHA384, ecdsa-with-SHA512, sha256WithRSAEncryption, sha384WithRSAEncryption, sha512WithRSAEncryption'''
+* Certificate transparency: '''required'''


yes, an explanation what it is and how it's handled is needed

tomato42 · 2017-03-08T12:17:00Z

Server_Side_TLS.mediawiki

 </source>

 Rationale:
 * ChaCha20 is prefered as the fastest and safest in-software cipher, followed by AES128. Unlike the modern configuration, we do not assume clients support AESNI and thus do not prioritize AES256 above 128 and ChaCha20. There has been discussions ([http://www.mail-archive.com/dev-tech-crypto@lists.mozilla.org/msg11247.html 1], [http://www.mail-archive.com/dev-tech-crypto@lists.mozilla.org/msg12398.html 2]) on whether AES256 extra security was worth its computing cost in software (without AESNI), and the results are far from obvious. At the moment, AES128 is preferred, because it provides good security, is really fast, and seems to be more resistant to timing attacks.
-* DES-CBC3-SHA and EDH-RSA-DES-CBC3-SHA are maintained for backward compatibility with clients that do not support AES.
+* DHE is removed entirely because it is slow in comparison with ECDHE, and all modern clients support elliptic curve key exchanges.


As I said in #178 (comment) use of DHE can be valid.

ghost · 2017-04-12T15:41:04Z

Server_Side_TLS.mediawiki

+* Certificate signature: '''ecdsa-with-SHA256, ecdsa-with-SHA384, ecdsa-with-SHA512, sha256WithRSAEncryption, sha384WithRSAEncryption, sha512WithRSAEncryption'''
+* Certificate transparency: '''optional'''
+* Bits of security: '''>=112''' (RSA 2048 and above, P-256, P-384)
+* DH Parameter size: '''2048''' (recommend using [#Pre-defined_DHE_groups Pre-defined DHE groups])


Do we still need to use DH parameters, even though we don't use DHE in the intermediate level anymore?

martinthomson

Time to think about shipping this. TLS 1.3 is going to RFC very soon.

martinthomson · 2018-08-09T04:33:30Z

Server_Side_TLS.mediawiki

+* Bits of security: '''>=112''' (RSA 2048 and above, P-256, P-384)
+* DH Parameter size: '''2048''' (recommend using [#Pre-defined_DHE_groups Pre-defined DHE groups])
+* HSTS: '''max-age=15768000''' (6 months)
+* HPKP: '''max-age=2589000''' (1 month)


We shouldn't be recommending HPKP.

martinthomson · 2018-08-09T04:37:42Z

Server_Side_TLS.mediawiki

-* HSTS: '''max-age=15768000'''
-* Certificate switching: '''None'''
+* Versions: '''TLSv1.3, TLSv1.2'''
+* TLS curves: '''prime256v1, secp384r1, x25519, x448'''


I think that x25519, p256, and p384 are fine here. x448 might be awesome in theory, but it's not awesome in practice and we shouldn't tell people to put the effort in for things that they won't get.

martinthomson · 2018-08-09T04:39:10Z

Server_Side_TLS.mediawiki

+* TLS curves: '''prime256v1, secp384r1, x25519, x448'''
+* Certificate type: '''ECDSA (recommended) or RSA'''
+* Certificate curve: '''prime256v1, secp384r1'''
+* Certificate signature: '''ecdsa-with-SHA256, ecdsa-with-SHA384, ecdsa-with-SHA512, sha256WithRSAEncryption, sha384WithRSAEncryption, sha512WithRSAEncryption'''


These here are right; you want these in the certificate, and I think that we can rely on TLS stacks to get the PSS thing right. While text on PSS might help, it's probably not going to get the results you want (we might see PSS certificates, which won't work).

jrchamp · 2018-08-09T13:31:15Z

Is it too soon to mention EdDSA? It seems like a very good option, for software that provides it as an option.

ekr · 2018-08-09T13:59:24Z

Does any common CA issue EdDSA certs?

…

On Thu, Aug 9, 2018 at 6:36 AM, Jonathan Champ ***@***.***> wrote: Is it too soon to mention EdDSA <https://tools.ietf.org/html/rfc8410>? It seems like a very good option, for software that provides it as an option. — You are receiving this because your review was requested. Reply to this email directly, view it on GitHub <#183 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABD1oanZNIblVmX0T-ETBo1LE56UhhB0ks5uPDrngaJpZM4MQ7x-> .

clintwilson · 2018-08-09T14:06:48Z

Not for public trust certs at least; Edwards curves aren't approved in the BRs yet.

ekr · 2018-08-09T14:13:19Z

In that case, yes, I think it's premature/

…

On Thu, Aug 9, 2018 at 7:06 AM, Clint Wilson ***@***.***> wrote: Not for public trust certs at least; Edwards curves aren't approved in the BRs yet. — You are receiving this because your review was requested. Reply to this email directly, view it on GitHub <#183 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABD1oXzLhvj8QBnhyEs-blL3TreKx0Meks5uPEH7gaJpZM4MQ7x-> .

tomato42 · 2018-09-06T13:45:11Z

now it's about 4.4% of Android phones that can't connect to TLS 1.2 servers, and with the recent discussions on IETF TLS WG ML, we may actually be able to push for TLS 1.1 and TLS 1.0 deprecation (allow them only in "Old")

april · 2019-06-26T15:22:56Z

Mind if I close this in favor of #255?

april · 2019-06-28T15:50:10Z

Closing due to obsolescence.

jvehent added 14 commits March 2, 2017 06:16

Remove 3DES from intermediate level

1c9eace

Remove DHE from intermediate level

ffbaed3

Allow ECDSA and RSA in modern level

d47479f

Bump max version to TLS1.3 for all levels

31300e0

Remove p-521 from modern level

bfc13e8

Specific bits of security for all levels

e2ec851

Recommend ECDSA in intermediate level

bce70cb

Bump HSTS to 13 months in modern level

cb97b9b

Add certificate validity recommendation to all levels

7e21080

Add recommendation for OCSP Stapling to all levels

c94d1dc

Make recommendation for HPKP on all levels

f06de08

Make recommendation on certificate transparency on all levels

42f06a8

Require OCSP stapling in intermediate level

be74fcd

Make recommendation on CAA on all levels

e904417

jvehent self-assigned this Mar 2, 2017

jvehent requested review from april, tomato42 and ekr March 2, 2017 12:37

ekr suggested changes Mar 2, 2017

View reviewed changes

jrchamp reviewed Mar 2, 2017

View reviewed changes

tomato42 requested changes Mar 8, 2017

View reviewed changes

ghost reviewed Apr 12, 2017

View reviewed changes

martinthomson reviewed Aug 9, 2018

View reviewed changes

captn3m0 mentioned this pull request Sep 5, 2018

It is time to add support for TLS 1.3 #217

Closed

april closed this Jun 28, 2019

Server Side TLS v5.0 #183

Server Side TLS v5.0 #183

Conversation

jvehent commented Mar 2, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jrchamp Mar 2, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

martinthomson left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jrchamp commented Aug 9, 2018

ekr commented Aug 9, 2018 via email

clintwilson commented Aug 9, 2018

ekr commented Aug 9, 2018 via email

tomato42 commented Sep 6, 2018

april commented Jun 26, 2019

april commented Jun 28, 2019

jrchamp Mar 2, 2017 •

edited

Loading