Re: [TLS] TLS1.2 vs TLS1.0

[Hanno Böck <[e-mail]>]

On Mon, 20 May 2013 13:47:08 -0700
Ulrich Herberg <[e-mail]> wrote:

> I am participating in another SDO on a standard for automated Demand
> Response, called OpenADR (www.openadr.org), an application for the
> smart grid. The application is basically a web service, exchanging XML
> over HTTP over public networks, and using TLS (with RSA and ECDSA /
> SHA1 ciphers for TLS 1.0 and SHA2 for TLS1.2). Currently, the draft
> allows for TLS1.0 and 1.1, but recommends using 1.2 (and requires
> vendors to provide a migration plan in case TLS1.0 is obsoleted) .
> TLS1.0 and 1.1 RFCs have been obsoleted by the IETF; but I am not sure
> about the best current practice. Is it absolutely discouraged to use
> them? The argument in the OpenADR alliance is that many libraries and
> programming languages do not support TLS1.2, so they recommend to
> start the handshake with 1.2 and then downgrade - if required - to
> 1.0. I read that NIST disallows SHA1 after 2013; which would also
> affect TLS1.0, which does not support SHA2.
> 
> What would be your recommendation in this case? Mandate TLS1.2 and
> disallow TLS1.0? Or just strongly recommend ("SHOULD") to use TLS1.2
> and SHA2 ciphers, and otherwise to use TLS1.0?

The biggest security issue with TLS 1.0/1.1 is less the use of sha1 and
more the use of CBC+hmac in a very wacky combination.
From what I'm aware, the use of SHA1 in HMAC shouldn't affect its
security. Still it's a good idea to avoid sha1 - it just isn't the most
pressing security issue.

You should definitely require TLS 1.2 and avoid CBC-ciphersuites if
possible if you want high security. The AEAD-ciphersuites (i.e.
everything with AES-GCM) in TLS 1.2 are the thing you want to use.

The issue with libraries not supporting TLS 1.2 isn't as severe as it
may seem. OpenSSL supports TLS 1.2 since a while, GnuTLS also does,
the MS-provided ssl libs since Windows 7 as well. nss has no support
yet, but there are experimental patches and it's expected to come quite
soon. So unless you have a very strong need to use outdated versions of
crypto libraries (which is generally not a good idea), it shouldn't be
much of an issue.

cu,
-- 
Hanno Böck		mail/jabber: [e-mail]
GPG: BBB51E42		http://www.hboeck.de/