bk99.de entertain the web since 1997

bk99.de
RFC · TLSStandard explained

RFC 8446: TLS 1.3: Less legacy, a faster handshake

Summary

RFC 8446 defines TLS 1.3 with modern algorithms, forward secrecy and a simplified handshake. RFC 8446 was superseded by RFC 9846. Removing insecure choices improves both security and ease of implementation.

Ideas

  • Outdated cipher suites are dropped.
  • Ephemeral keys provide forward secrecy.
  • A regular handshake needs fewer round trips.

Insights

  • 0-RTT trades lower latency for replay risks.

Remarks

  • RFC 8446 has the status “Proposed Standard”; current errata and successor documents should also be checked.

Recommendations

  • Prefer TLS 1.3 and keep TLS 1.2 only for compatibility.
  • Allow 0-RTT only for repeatable operations.

References

Read the RFC at the RFC Editor

Search the Web Archive

RFC · 2026

RFC 9846: TLS 1.3: The consolidated current specification

RFC 9846 replaces RFC 8446 and consolidates TLS 1.3 with the corrections and updates published up to then. Security standards occasionally need a consolidated new edition instead of many scattered updates. Superseding the document changes the reference, not the goal of a smaller, secure protocol.

RFC · 2026

RFC 9849: TLS Encrypted ClientHello

RFC 9849 encrypts most of the TLS ClientHello and thereby protects destination and negotiation data that used to be visible. Content encryption alone does not hide all metadata of a connection. More privacy changes troubleshooting and network filtering.

RFC · 2008

RFC 5246: TLS 1.2: Encrypted transport connections

RFC 5246 standardises TLS 1.2 and shaped encrypted communication on the web for many years. RFC 5246 was superseded by RFC 8446. Protocol security also depends on algorithm selection and implementation.