EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Hacker News·Aug 1·5 min read
RFC 10015: Deprecating Obsolete Key Exchange Methods in TLS 1.2 and DTLS 1.2
TL;DR
RFC 10015 deprecates the use of outdated key exchange methods in TLS 1.2 and DTLS 1.2, specifically Diffie-Hellman and RSA. This update aims to enhance security by discouraging static ECDH cipher suites.
✦ Why It Matters
Review and update your systems to eliminate deprecated key exchange methods in TLS 1.2.
Key Takeaways
- Deprecate non-ephemeral DH and RSA cipher suites in TLS 1.2.
- Adopt ephemeral key exchanges for improved security.
- Review and update existing implementations to align with RFC 10015.
- Stay informed about the latest IETF recommendations for secure protocols.
Full Summary
RFC 10015 addresses security vulnerabilities in TLS 1.2 and DTLS 1.2 by deprecating two key exchange methods: Diffie-Hellman (DH) over finite fields and RSA. These methods have been found to lack forward secrecy and are susceptible to various attacks, such as the Raccoon attack on DH and Bleichenbacher's attack on RSA.
The document updates multiple existing RFCs to reflect these changes and recommends that clients and servers avoid using non-ephemeral DH and RSA cipher suites. Instead, it encourages the adoption of ephemeral key exchanges, which provide better security guarantees.
The implications of this update are significant, as it aims to improve the overall security posture of TLS 1.2 connections by phasing out outdated and insecure practices.