Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)
Metadata
- Publisher
- IETF
- Doc Type
- Best Practice
- Pages
- 27
- Abstract
- Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) are widely used to protect data exchanged over application protocols such as HTTP, SMTP, IMAP, POP, SIP, and XMPP. Over the last few years, several serious attacks on TLS have emerged, including attacks on its most commonly used cipher suites and their modes of operation. This document provides recommendations for improving the security of deployed services that use TLS and DTLS. The recommendations are applicable to the majority of use cases.
- Publication Date
- 2015-05-01
- Status Note
- Best Current Practice
- DOI
10.17487/RFC7525- Link
- https://doi.org/10.17487/RFC7525
- Author(s)
- Yaron ShefferRalph HolzPeter Saint-Andre
- Keyword(s)
- TLS, DTLS, SSL
Latest version of IETF RFC 7525
Document Versions — IETF RFC 7525
-
▶ IETF RFC 7525 (2015-05-01)THIS DOC [SUPERSEDED] [LATEST VERSION]
Superseded by:
- RFC9325 NOT IN REGISTRY
Normative Reference(s)
- IETF RFC 2119 [Active*]
- IETF RFC 2818 [Superseded*]
- IETF RFC 3766 [Active*]
- IETF RFC 4492 [Superseded*]
- IETF RFC 4949 [Active*]
- IETF RFC 5246 [Superseded*]
- IETF RFC 5288 [Active*]
- IETF RFC 5289 [Active*]
- IETF RFC 5746 [Active*]
- IETF RFC 6066 [Active*]
- IETF RFC 6125 [Superseded*]
- IETF RFC 6176 [Active*]
- IETF RFC 6347 [Superseded*]
- IETF RFC 7465 [Active*]
Bibliographic Reference(s)
- 10.1007-978-3-642-25385-0_20 — PatersonRS11 EXTERNAL
- 10.1109-SP.2007.8 — DegabrieleP07 EXTERNAL
- IETF.draft-ietf-dane-smtp-with-dane-16 — DANE-SMTP EXTERNAL
- IETF.draft-ietf-dane-srv-14 — DANE-SRV EXTERNAL
- IETF.draft-ietf-tls-session-hash-05 — SESSION-HASH EXTERNAL
- IETF.draft-ietf-tls-sslv3-diediedie-03 — DEP-SSLv3 EXTERNAL
- IETF.draft-ietf-uta-xmpp-07 — TLS-XMPP EXTERNAL
- NIST.SP.800-56A — NIST EXTERNAL
- CA/Browser Forum, "Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates Version 1.1.6", 2013, < https://www.cabforum.org/documents.html >. EXTERNAL
- Smith, B., "Proposal to Change the Default TLS Ciphersuites Offered by Browsers.", 2013, < https://briansmith.org/browser-ciphersuites-01.html >. EXTERNAL
- Soghoian, C. and S. Stamm, "Certified lies: Detecting and defeating government interception attacks against SSL", Proc. 15th Int. Conf. Financial Cryptography and Data Security, 2011. EXTERNAL
- US-CERT, "SSL 3.0 Protocol Vulnerability and POODLE Attack", Alert TA14-290A, October 2014, < https://www.us-cert.gov/ncas/alerts/TA14-290A >. EXTERNAL
- Krawczyk, H., "The Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?)", CRYPTO 01, 2001, < https://www.iacr.org/archive/crypto2001/21390309.pdf >. EXTERNAL
- Heninger, N., Durumeric, Z., Wustrow, E., and J. Halderman, "Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices", Usenix Security Symposium 2012, 2012. EXTERNAL
- IANA, "Transport Layer Security (TLS) Parameters", < http://www.iana.org/assignments/tls-parameters >. EXTERNAL
- Merkle, R. and M. Hellman, "On the security of multiple encryption", Communications of the ACM, Vol. 24, 1981, < http://dl.acm.org/citation.cfm?id=358718 >. EXTERNAL
- Smart, N., "ECRYPT II Yearly Report on Algorithms and Keysizes (2011-2012)", 2012, < http://www.ecrypt.eu.org/ecrypt2/ >. EXTERNAL
- bettercrypto.org, "Applied Crypto Hardening", April 2015, < https://bettercrypto.org/static/ applied-crypto-hardening.pdf >. EXTERNAL
- Kleinjung, T., "Factorization of a 768-Bit RSA modulus", CRYPTO 10, 2010, < https://eprint.iacr.org/2010/006.pdf >. EXTERNAL
- Delignat-Lavaud, A., Bhargavan, K., and A. Pironti, "Triple Handshakes Considered Harmful: Breaking and Fixing Authentication over TLS", 2014, < https://secure-resumption.com/ >. EXTERNAL
- IETF RFC 2026 [Active*]
- IETF RFC 2246 [Superseded*]
- IETF RFC 3602 [Active*]
- IETF RFC 4346 [Superseded*]
- IETF RFC 4347 [Superseded*]
- IETF RFC 5077 [Superseded*]
- IETF RFC 5116 [Active*]
- IETF RFC 5280 [Active, Amended*]
- IETF RFC 6090 [Active*]
- IETF RFC 6101 [Active*]
- IETF RFC 6120 [Active*]
- IETF RFC 6460 [Active*]
- IETF RFC 6698 [Active*]
- IETF RFC 6797 [Active*]
- IETF RFC 6960 [Active*]
- IETF RFC 6961 [Superseded*]
- IETF RFC 6989 [Active*]
- IETF RFC 7435 [Active*]
- IETF RFC 7457 [Active*]
- IETF RFC 7507 [Superseded*]
Source Data (JSON)
Full registry record with provenance metadata. Open directly: /api/doc/RFC7525.json
Reference Tree
Explore all references and references to this document, as a navigable tree.
Open Reference TreeReference this Doc
Plain text (ISO 690 compliant)
Preview:
IETF RFC 7525, Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS). Available at https://doi.org/10.17487/RFC7525
Snippet:
IETF RFC 7525, Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS). Available at https://doi.org/10.17487/RFC7525
HTML (ISO 690 compliant)
Preview:
IETF RFC 7525, Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS). Available at https://doi.org/10.17487/RFC7525
Snippet:
<span class="citation"><cite>IETF RFC 7525</cite>, Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS). Available at <a href="https://doi.org/10.17487/RFC7525" target="_blank" rel="noopener">https://doi.org/10.17487/RFC7525</a></span>
SMPTE's HTML Pub
Preview:
IETF RFC 7525, Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)
doi: 10.17487/RFC7525
url: https://doi.org/10.17487/RFC7525
doi: 10.17487/RFC7525
url: https://doi.org/10.17487/RFC7525
Snippet:
<li> <cite id="bib-rfc7525">IETF RFC 7525</cite>, Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) <span class="doi">10.17487/RFC7525</span> </li>
Referenced By
- IETF RFC 7515 [Active*]
- IETF RFC 7540 [Superseded*]
- IETF RFC 7589 [Active*]
- IETF RFC 7636 [Active*]
- IETF RFC 7696 [Active*]
- IETF RFC 7925 [Active*]
- IETF RFC 8040 [Active*]
- IETF RFC 8085 [Active*]
- IETF RFC 8143 [Active*]
- IETF RFC 8323 [Active*]
- IETF RFC 8915 [Active*]
- IETF RFC 8996 [Active*]
- IETF RFC 9113 [Active*]
- IETF RFC 9190 [Active*]