RFC 9851: TLS 1.2 is in Feature Freeze

RFC 9851: TLS 1.2 is in Feature Freeze(rfc-editor.org)

19 points by Jimmc414 2 hours ago | 6 comments

mcpherrinm 2 hours ago |

This shouldn’t be too much of a surprise, as TLS 1.3 has been out for many years and is widely adopted.

I haven’t paid too much attention to the TLS WG lately (for obvious reasons if you look at their mailing list), but I assume this is mostly a “if you want Post-Quantum cryptography, you need 1.3”.

pavon 1 hour ago |

I assume this is in contest with RFC10015 which proposes "Deprecating Obsolete Key Exchange Methods in TLS 1.2 and DTLS 1.2"[1]. Both are Proposed Standards submitted in July, by the same author. HN discussion[2]

[1]https://www.rfc-editor.org/rfc/rfc10015.html

[2]https://news.ycombinator.com/item?id=49139711

BobbyTables2 1 hour ago |

I don’t get it. Were there revisions or optional features of v1.2?

I thought the 1.2 spec was the frozen spec.

ekr____ 46 minutes ago | |

TLS is an extensible protocol. For instance, you can add new key establishment algorithms or cipher suites. What this specification is saying is that the IETF will not be publishing such extensions for TLS 1.2. For example, they will not be adding post-quantum key establishment.

kijin 1 hour ago |

Makes sense. Nobody wants to deal with "this user-agent claims to support TLS 1.2, except this extension that was added in 2026" anymore.

If you're going to add or remove features, follow semver and bump that number.

ekr____ 19 minutes ago | |

This isn't quite how TLS feature negotiation works.

Version numbers are negotiated and some of the parameters are carried along with the version, but a lot of functionality (e.g., cipher suites) is individually negotiated and to some extent orthogonal to the version. This of course also allows you to add new features to an existing version.

What this draft is saying is that the IETF will not be adding new features targeted at TLS 1.2.