Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RFC 9851: TLS 1.2 is in Feature Freeze

rfc-editor.org

Post reply on HN
Print view View original

1–10 of 30 posts

Re: RFC 9851: TLS 1.2 is in Feature Freeze

#3

Post by mcpherrinm »

This shouldn’t be too much of a surprise, as TLS 1.3 has been out for many years and is widely adopted.

I haven’t paid too much attention to the TLS WG lately (for obvious reasons if you look at their mailing list), but I assume this is mostly a “if you want Post-Quantum cryptography, you need 1.3”.

Re: RFC 9851: TLS 1.2 is in Feature Freeze

#4

Post by kijin »

Makes sense. Nobody wants to deal with "this user-agent claims to support TLS 1.2, except this extension that was added in 2026" anymore.

If you're going to add or remove features, follow semver and bump that number.

Re: RFC 9851: TLS 1.2 is in Feature Freeze

#6

Post by pavon »

I assume this is in contest with RFC10015 which proposes "Deprecating Obsolete Key Exchange Methods in TLS 1.2 and DTLS 1.2"[1]. Both are Proposed Standards submitted in July, by the same author. HN discussion[2]

[1]https://www.rfc-editor.org/rfc/rfc10015.html

[2]https://news.ycombinator.com/item?id=49139711

Re: RFC 9851: TLS 1.2 is in Feature Freeze

#9

Post by ekr____ »

BobbyTables2 wrote: post #5

I don’t get it. Were there revisions or optional features of v1.2? I thought the 1.2 spec was the frozen spec.

TLS is an extensible protocol. For instance, you can add new key establishment algorithms or cipher suites. What this specification is saying is that the IETF will not be publishing such extensions for TLS 1.2. For example, they will not be adding post-quantum key establishment.

Re: RFC 9851: TLS 1.2 is in Feature Freeze

#10

Post by ekr____ »

kijin wrote: post #4

Makes sense. Nobody wants to deal with "this user-agent claims to support TLS 1.2, except this extension that was added in 2026" anymore. If you're going to add or remove features, follow semver and bump that number.

This isn't quite how TLS feature negotiation works.

Version numbers are negotiated and some of the parameters are carried along with the version, but a lot of functionality (e.g., cipher suites) is individually negotiated and to some extent orthogonal to the version. This of course also allows you to add new features to an existing version.

What this draft is saying is that the IETF will not be adding new features targeted at TLS 1.2.

Post reply on HN