RFC 4346

RFC 4346
Title	RFC 4346
Issued	2006-04
Status	Historic
Authors	Paul Hoffman, Eric Rescorla
Pages	114
Category	Internet Standard

RFC 4346 is the specification that defines a revision of the Transport Layer Security protocol, commonly known as TLS, published in April 2006. It describes the protocol document that updates, clarifies, and replaces parts of earlier work to improve interoperability, privacy, and cryptographic robustness across implementations such as those by vendors and projects in the Internet Engineering Task Force and the Internet Architecture Board. The specification impacted deployments from enterprise networks run by companies like Microsoft and Cisco Systems to open-source projects such as Mozilla and OpenSSL.

Background and Purpose

RFC 4346 was produced within the context of efforts by the Internet Engineering Task Force and the Internet Research Task Force to strengthen application-layer security following prior documents authored by the Internet Architecture Board and contributors linked to RSA Security and Netscape Communications Corporation. The work addressed recommendations emerging from meetings of working groups such as the TLS Working Group and drew on incidents examined by organizations including CERT Coordination Center and research from universities like Stanford University and Massachusetts Institute of Technology. The purpose was to document a coherent protocol update for implementers at companies such as Oracle Corporation, IBM, and Google while responding to cryptanalysis reported by teams at University of California, Berkeley and laboratories like Bell Labs.

Technical Overview

The document specifies handshake negotiation, record layer processing, and cipher suite selection that underpins secure channels used by applications like Apache HTTP Server, Nginx, and Postfix. It defines message flows between endpoints that reference X.509 certificate handling used by entities such as CAs including VeriSign and Let's Encrypt in subsequent ecosystems. The specification integrates cryptographic primitives established in standards from bodies like National Institute of Standards and Technology and algorithms standardized by consortia such as IETF Crypto Forum Research Group and vendors like Intel Corporation. Conformance touches on interoperability testing used in events at organizations such as MITRE Corporation and labs at University College London.

Protocol Changes from TLS 1.0

RFC 4346 documents revisions that modify negotiation semantics and remove legacy constructs present in earlier protocol versions ratified alongside historical efforts by Tim Berners-Lee-era initiatives and proposals discussed in forums involving representatives from Sun Microsystems and HP. It updates cipher suite negotiation to prefer stronger suites supported by contributors including FIPS-aligned implementations and alters signature-hash combinations influenced by analyses from researchers at ETH Zurich and Georgia Institute of Technology. The changes also refine compression and padding behaviors relevant to vulnerabilities reported by teams at Carnegie Mellon University and laboratories such as SRI International.

Security Considerations

The specification emphasizes protection against active attacks studied in conferences like USENIX and Black Hat and cites threats evaluated by research groups at Google Security and academic teams from University of Oxford and Imperial College London. It mandates behaviors intended to mitigate risks such as chosen-ciphertext and downgrade attacks observed in real-world incidents involving products from Juniper Networks and Checkpoint Software Technologies. The document’s recommendations intersect with best practices promoted by standards bodies such as ISO and IEC and influence compliance programs at entities like Payment Card Industry Security Standards Council.

Implementation and Adoption

Adoption involved major software projects and corporations—implementations in OpenSSL, GnuTLS, and proprietary stacks from Microsoft and Apple Inc. were updated to comply with the revision. Interoperability testing occurred at consortium events organized by bodies like the IETF and testing labs run by ETSI, with deployments in services operated by Amazon (company), Facebook, and financial institutions such as Goldman Sachs. Vendor firmware and appliance updates were produced by manufacturers including Fortinet and Palo Alto Networks to reflect conformance to the updated handshake and cipher suite semantics.

Known Issues and Errata

Post-publication errata were tracked by editorial groups within the standards community and by maintainers of implementations such as OpenSSL and GnuTLS, addressing ambiguities that affected interop in environments using hardware accelerators from Broadcom and Qualcomm. Subsequent vulnerability disclosures and academic analyses from researchers at University of Cambridge and Technische Universität Darmstadt prompted guidance and errata notices leading to patches and, in some ecosystems, migration to later revisions and profiles developed by IETF working groups. Implementers have cataloged interoperability notes and bug reports in trackers maintained by organizations such as GitHub and SourceForge.

Category:Internet standards