{"id":2360,"date":"2018-08-13T08:22:46","date_gmt":"2018-08-13T15:22:46","guid":{"rendered":"https:\/\/blog.mozilla.org\/security\/?p=2360"},"modified":"2018-08-13T17:54:12","modified_gmt":"2018-08-14T00:54:12","slug":"tls-1-3-published-in-firefox-today","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/security\/2018\/08\/13\/tls-1-3-published-in-firefox-today\/","title":{"rendered":"TLS 1.3 Published: in Firefox Today"},"content":{"rendered":"

\"\"<\/a><\/p>\n

On friday the IETF published TLS 1.3 as RFC 8446<\/a>. It\u2019s already shipping in Firefox and you can use it today. This version of TLS incorporates significant improvements in both security and speed.<\/p>\n

Transport Layer Security (TLS)<\/a> is the protocol that powers every secure transaction on the Web. The version of TLS in widest use, TLS 1.2<\/a>, is ten years old this month and hasn\u2019t really changed that much from its roots in the Secure Sockets Layer (SSL)<\/a> protocol, designed back in the mid-1990s. Despite the minor number version bump, this isn’t the minor revision it appears to be. TLS 1.3 is a major revision that represents more than 20 years of experience with communication security protocols, and four years of careful work from the standards, security, implementation, and research communities (see Nick Sullivan’s great post<\/a> for the cool details).<\/p>\n

Security<\/h3>\n

TLS 1.3 incorporates a number of important security improvements.<\/p>\n

First, it improves user privacy. In previous versions of TLS, the entire handshake was in the clear which leaked a lot of information, including both the client and server\u2019s identities. In addition, many network middleboxes used this information to enforce network policies and failed if the information wasn\u2019t where they expected it. \u00a0This can lead to breakage when new protocol features are introduced. TLS 1.3 encrypts most of the handshake, which provides better privacy and also gives us more freedom to evolve the protocol in the future.<\/p>\n

Second, TLS 1.3 removes a lot of outdated cryptography. TLS 1.2 included a pretty wide variety of cryptographic algorithms (RSA key exchange, 3DES, static Diffie-Hellman) and this was the cause of real attacks such as FREAK<\/a>, Logjam<\/a>, and Sweet32<\/a>. TLS 1.3 instead focuses on a small number of well understood primitives (Elliptic Curve Diffie-Hellman key establishment, AEAD ciphers, HKDF).<\/p>\n

Finally, TLS 1.3 is designed in cooperation with the academic security community and has benefitted from an extraordinary level of review and analysis. \u00a0This included formal verification of the security properties by multiple independent groups; the TLS 1.3 RFC cites 14 separate papers analyzing the security of various<\/a> aspects<\/a> of the protocol.<\/p>\n

Speed<\/h3>\n

While computers have gotten much faster, the time data takes to get between two network endpoints is limited by the speed of light and so round-trip time is a limiting factor on protocol performance. TLS 1.3\u2019s basic handshake takes one round-trip (down from two in TLS 1.2) and TLS 1.3 incorporates a \u201czero round-trip\u201d mode in which the client can send data to the server in its first set of network packets. Put together, this means faster web page loading.<\/p>\n

What Now?<\/h3>\n

TLS 1.3 is already widely deployed: both Firefox and Chrome have fielded \u201cdraft\u201d versions. Firefox 61 is already shipping draft-28, which is essentially the same as the final published version (just with a different version number). We expect to ship the final version in Firefox 63, scheduled for October 2018. Cloudflare, Google, and Facebook are running it on their servers today. Our telemetry shows that around 5% of Firefox connections are TLS 1.3. Cloudflare reports similar numbers, and Facebook reports<\/a> that an astounding 50+% of their traffic is already TLS 1.3!<\/p>\n

TLS 1.3 was a big effort with a huge number of contributors<\/a>., and it\u2019s great to see it finalized. With the publication of the TLS 1.3 RFC we expect to see further deployments from other browsers, servers and toolkits, all of which makes the Internet more secure for everyone.<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

On friday the IETF published TLS 1.3 as RFC 8446. It\u2019s already shipping in Firefox and you can use it today. This version of TLS incorporates significant improvements in both … Read more<\/a><\/p>\n","protected":false},"author":1590,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[69],"tags":[],"coauthors":[320790],"yoast_head":"\nTLS 1.3 Published: in Firefox Today - Mozilla Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/security\/2018\/08\/13\/tls-1-3-published-in-firefox-today\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Eric Rescorla\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2018\/08\/13\/tls-1-3-published-in-firefox-today\/\",\"url\":\"https:\/\/blog.mozilla.org\/security\/2018\/08\/13\/tls-1-3-published-in-firefox-today\/\",\"name\":\"TLS 1.3 Published: in Firefox Today - Mozilla Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2018\/08\/13\/tls-1-3-published-in-firefox-today\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2018\/08\/13\/tls-1-3-published-in-firefox-today\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/blog.mozilla.org\/security\/files\/2018\/08\/TLS1.3-Badge-Horizontal-Color-1024px-252x54.png\",\"datePublished\":\"2018-08-13T15:22:46+00:00\",\"dateModified\":\"2018-08-14T00:54:12+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/d7c6be5f71d0f9fe53dbf12167ba6722\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2018\/08\/13\/tls-1-3-published-in-firefox-today\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/security\/2018\/08\/13\/tls-1-3-published-in-firefox-today\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2018\/08\/13\/tls-1-3-published-in-firefox-today\/#primaryimage\",\"url\":\"https:\/\/blog.mozilla.org\/security\/files\/2018\/08\/TLS1.3-Badge-Horizontal-Color-1024px.png\",\"contentUrl\":\"https:\/\/blog.mozilla.org\/security\/files\/2018\/08\/TLS1.3-Badge-Horizontal-Color-1024px.png\",\"width\":1024,\"height\":220},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2018\/08\/13\/tls-1-3-published-in-firefox-today\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/security\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"TLS 1.3 Published: in Firefox Today\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/security\/\",\"name\":\"Mozilla Security Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/d7c6be5f71d0f9fe53dbf12167ba6722\",\"name\":\"Eric Rescorla\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/6035346f726234b1bb974365f782f182\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e5f9acbf6d67bc10e02f6289a4afd588?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e5f9acbf6d67bc10e02f6289a4afd588?s=96&d=identicon&r=g\",\"caption\":\"Eric Rescorla\"},\"description\":\"Eric is CTO of the Firefox team at Mozilla.\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"TLS 1.3 Published: in Firefox Today - Mozilla Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/security\/2018\/08\/13\/tls-1-3-published-in-firefox-today\/","twitter_misc":{"Written by":"Eric Rescorla","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/security\/2018\/08\/13\/tls-1-3-published-in-firefox-today\/","url":"https:\/\/blog.mozilla.org\/security\/2018\/08\/13\/tls-1-3-published-in-firefox-today\/","name":"TLS 1.3 Published: in Firefox Today - Mozilla Security Blog","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/security\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.mozilla.org\/security\/2018\/08\/13\/tls-1-3-published-in-firefox-today\/#primaryimage"},"image":{"@id":"https:\/\/blog.mozilla.org\/security\/2018\/08\/13\/tls-1-3-published-in-firefox-today\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.mozilla.org\/security\/files\/2018\/08\/TLS1.3-Badge-Horizontal-Color-1024px-252x54.png","datePublished":"2018-08-13T15:22:46+00:00","dateModified":"2018-08-14T00:54:12+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/d7c6be5f71d0f9fe53dbf12167ba6722"},"breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/security\/2018\/08\/13\/tls-1-3-published-in-firefox-today\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/security\/2018\/08\/13\/tls-1-3-published-in-firefox-today\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/security\/2018\/08\/13\/tls-1-3-published-in-firefox-today\/#primaryimage","url":"https:\/\/blog.mozilla.org\/security\/files\/2018\/08\/TLS1.3-Badge-Horizontal-Color-1024px.png","contentUrl":"https:\/\/blog.mozilla.org\/security\/files\/2018\/08\/TLS1.3-Badge-Horizontal-Color-1024px.png","width":1024,"height":220},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/security\/2018\/08\/13\/tls-1-3-published-in-firefox-today\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/security\/"},{"@type":"ListItem","position":2,"name":"TLS 1.3 Published: in Firefox Today"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/security\/#website","url":"https:\/\/blog.mozilla.org\/security\/","name":"Mozilla Security Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/d7c6be5f71d0f9fe53dbf12167ba6722","name":"Eric Rescorla","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/6035346f726234b1bb974365f782f182","url":"https:\/\/secure.gravatar.com\/avatar\/e5f9acbf6d67bc10e02f6289a4afd588?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e5f9acbf6d67bc10e02f6289a4afd588?s=96&d=identicon&r=g","caption":"Eric Rescorla"},"description":"Eric is CTO of the Firefox team at Mozilla."}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/2360"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/users\/1590"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/comments?post=2360"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/2360\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/media?parent=2360"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/categories?post=2360"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/tags?post=2360"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/coauthors?post=2360"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}