RFC 8446

RFC 8446
Title	RFC 8446
Type	IETF RFC
Status	Standard
Published	August 2018
Authors	Eric Rescorla et al.
Pages	101
Replaces	RFC 5246

RFC 8446 is the Internet Engineering Task Force specification that defines the Transport Layer Security version 1.3 protocol, a major revision to the TLS family that updates cryptographic primitives, handshake mechanics, and privacy protections for the Internet. The document was produced by contributors associated with organizations and projects active in Internet standards such as the Internet Engineering Task Force, the Internet Architecture Board, Mozilla, Google, and Microsoft, and it follows a lineage of protocols and standards including predecessors and related documents like RFC 5246 and documents from the Internet Assigned Numbers Authority. RFC 8446's publication intersects with broader technology developments involving major software projects, hardware vendors, and standards bodies.

Background and Purpose

TLS 1.3 was developed to address long-standing concerns raised in the context of protocol evolution exemplified by discussions in venues like the Internet Engineering Task Force, the Internet Architecture Board, the World Wide Web Consortium, and the IETF TLS Working Group, and to supersede earlier protocol versions whose deployments involved work by authors affiliated with organizations such as Netscape, Microsoft, Apple, Google, and Mozilla. The purpose was to simplify and harden secure transport in the wake of cryptanalytic advances reported by research groups at institutions including MIT, Stanford, Carnegie Mellon University, ETH Zurich, and UC Berkeley, and to reflect operational experience from deployments by companies like Amazon, Facebook, Cloudflare, Akamai, and Fastly. The background also references interoperability lessons drawn from implementations in projects such as OpenSSL, BoringSSL, NSS, GnuTLS, LibreSSL, and wolfSSL, and from measurement studies conducted by academic groups and industry labs like Google Research, ICSI, and RIPE.

Cryptographic Design and Protocol Changes

The cryptographic design replaces legacy constructions criticized in analyses by researchers at institutions including École Polytechnique Fédérale de Lausanne, Princeton University, and the University of Cambridge, and it standardizes modern algorithms promoted by cryptographers at NIST, IACR contributors, and contributors connected to projects such as libsodium and NaCl. Key changes include adoption of AEAD algorithms like AES-GCM and ChaCha20-Poly1305 used by implementations developed by teams at Intel, ARM, Qualcomm, and Broadcom, and key agreement via elliptic curves such as X25519 and P-256 championed by contributors at Mozilla, Google, and Cloudflare. The protocol removes or strongly deprecates features implicated in historic vulnerabilities associated with deployments by vendors like Cisco and Juniper and discussed in research from teams at Microsoft Research, IBM Research, and Google Project Zero. The design decisions reflect input from standards stakeholders including ETSI, 3GPP, and the IETF Transport Area.

Handshake and Record Layer Specifications

The handshake changes reduce round trips and modify transcript handling, building on cryptographic techniques studied by groups at University College London, ETH Zurich, and INRIA, and on prior designs from projects such as IKEv2 and SSH implementations from OpenSSH and PuTTY. Handshake messages and state machines are specified in a manner compatible with implementations from OpenSSL, BoringSSL, NSS, and WolfSSL, and with testing frameworks used by projects like TLS-Tester and Interop WG events organized by the IETF. The record layer refines record framing and AEAD usage informed by analyses from labs and standards bodies including NIST, the IETF Crypto Forum Research Group, and academic conferences such as IEEE S&P and ACM CCS. Certificate and authentication mechanisms reference ecosystems involving Certificate Authorities like Let’s Encrypt, DigiCert, GlobalSign, Entrust, and policies discussed at the CA/Browser Forum.

Security Considerations and Threat Model

Security considerations address active and passive attackers studied by research teams at institutions such as UC San Diego, Harvard, and Columbia, and by industry groups including Google Threat Analysis, Microsoft Threat Intelligence, and Cloudflare Research. The threat model includes protocol-level attacks analyzed in papers presented at venues like USENIX Security, Eurocrypt, and NDSS, and operational threats observed in incident reports from companies such as Equifax and SolarWinds and audits by organizations like the Open Web Application Security Project. Mitigations and recommendations draw on cryptanalysis from IACR publications, advice from NIST, and ecosystem practices advocated by the Internet Society and the OpenSSL project.

Implementation and Deployment

Implementations of the specification appear across major libraries and products including OpenSSL, BoringSSL, NSS, GnuTLS, LibreSSL, wolfSSL, Apple Secure Transport, Microsoft SChannel, and Java's JSSE, as well as in browsers like Chrome, Firefox, Safari, Edge, and Opera. Deployment efforts involve infrastructure providers such as Akamai, Cloudflare, Amazon Web Services, Google Cloud Platform, Microsoft Azure, Fastly, and DigitalOcean, and testing and interoperability work coordinated through events and projects organized by the IETF, the TLS Working Group, and community groups like the OpenSSL community and the Mozilla security team. Operational guidance incorporates practices from SRE teams at Google, Netflix, and Facebook and compliance perspectives from regulators and standards agencies including NIST and ETSI.

Interoperability and Extensions

Interoperability guidance and extension points support mechanisms for extension negotiation and backward compatibility debated in forums including the IETF TLS Working Group, the IETF Internet Research Task Force, and the IETF Applications Area, and implemented by vendors such as Cisco, Juniper, F5 Networks, and Palo Alto Networks. The specification enables future extensions via defined registries maintained by IANA and encourages cross-project cooperation among open source communities like OpenSSL, BoringSSL, NSS, GnuTLS, and language ecosystems including the Java Community Process, the GNU project, and the Python Software Foundation. Extensions and experimentation are tracked through mailing lists, interop testbeds, and academic collaborations involving universities such as Stanford, MIT, and UC Berkeley.

Category:Internet security standards