- Published on
Deprecating Obsolete Key Exchange Methods in TLS 1.2 and DTLS 1.2
- Authors
- Name
- DeepHorus
The Internet Engineering Task Force (IETF) has published RFC 10015, an Internet Standards Track document that formally deprecates the use of RSA and finite-field Diffie-Hellman (DH) key exchange methods in TLS 1.2 and DTLS 1.2 connections. The document also discourages the use of static Elliptic Curve Diffie-Hellman (ECDH) cipher suites. This move is part of an ongoing effort to phase out obsolete cryptographic algorithms that no longer meet modern security requirements.
TLS 1.2, still widely deployed, relies on a variety of key exchange algorithms, including RSA, finite-field DH, and ECDH. Unlike ephemeral variants such as DHE and ECDHE, non-ephemeral algorithms use static public keys embedded in certificates, which fail to provide forward secrecy. RFC 10015 updates seventeen earlier RFCs—including RFC 5246, RFC 4346, and RFC 8422—to reflect the deprecation or discouragement of cipher suites using the affected methods in (D)TLS 1.2.
The deprecation applies only to TLS 1.2 and DTLS 1.2, as TLS 1.0 and 1.1 were already deprecated by RFC 8996, and TLS 1.3 either does not use these algorithms or does not share the same configuration options. The document specifically calls out the Raccoon attack, which exploits timing side channels in finite-field DH when public keys are reused, and invalid curve attacks against ECDH that similarly break security through secret reuse. These attacks demonstrate that even ephemeral cipher suites can be vulnerable if keys are not properly managed.
The security issues with RSA key exchange are both implementation-independent and implementation-dependent, making the algorithm particularly problematic. In addition, finite-field DH in TLS 1.2 suffers from interoperability issues, as there is no standardized mechanism for negotiating groups, and some implementations only support small group sizes. Small subgroups also enable several attacks, further complicating the use of these deprecated methods.
The IETF represents the consensus of its community, and RFC 10015 has received public review and approval by the Internet Engineering Steering Group (IESG). The document provides a clear signal to vendors and network operators that continued use of RSA and finite-field DH key exchange in TLS 1.2 is strongly discouraged. The IETF Trust retains copyright, and the document is subject to BCP 78 and the Trust Legal Provisions.
The publication of RFC 10015 is likely to accelerate the migration to TLS 1.3 and to ephemeral cipher suites such as ECDHE and DHE with proper group negotiation. Organizations that must remain on TLS 1.2 are advised to prioritize forward secrecy and avoid static key reuse. As the IETF continues to harden internet standards, further deprecations of legacy algorithms are expected.
