FAPI2-Baseline - has the time come to recommend/require TLS 1.3?

The current TLS restrictions in https://openid.net/specs/fapi-2_0-baseline-ID1.html#name-network-layer-protections are a little weaker than FAPI1-Adv, in particular FAPI2-Baseline allows the user of various ciphers known to be insecure.

We could make this much easier (and arguably, considerably more secure in the face of both correct and incorrect configuration given the many security improvements in TLS1.3) by just requiring the use of TLS 1.3. However I’m not sure we’re quite at that point yet?

It feels like TLS 1.3 support should at least be a ‘should’. And we should probably add that language from FAPI1-Adv that reduces the ciphers that can be used in TLS 1.2.

‌

For browser support, see: https://caniuse.com/tls1-3

It seems TLS 1.3 support is relatively recent in Windows: https://docs.microsoft.com/en-us/windows/win32/secauthn/protocols-in-tls-ssl--schannel-ssp-

And it seems like Azure may not support TLS 1.3 as of today, and I couldn’t find anything saying if they have a plan to enable it: https://stackoverflow.com/questions/61927225/is-tls-1-3-available-on-azure-app-services/61927285#61927285

I didn’t do an exhaustive search but it seems like the other major cloud providers generally support TLS 1.3, although support for it in some AWS services was only enabled in the last few months: https://aws.amazon.com/about-aws/whats-new/2021/10/aws-network-load-balancer-supports-tls-1-3/

‌

Comments (13)