TLS 1.3 It has been in the work for four years. Knowing that TLS 1.2 have been implemented only recently on selected products (for those who figured how), when can we expect it will be implemented on XG and other products ?

This is an interessting question :-) Maybe someone of Sophos Staff can give some informations about this.

It is even more interesting considering many large WEB sites and Google Chrome plan to forbid TLS 1.0 and 1.1 very soon (weeks).

Some of those large WEB sites plan to forbid TLS 1.2 anytime next year ...

So ...

Paul Jr

Hi Paul,

Regarding the XG:

Currently, the XG already handles TLS 1.3 traffic with the web proxy. It does a downgrade to TLS 1.2 so as to not break traffic, which is an approach that other vendors have also taken, up until this point in time. 

Native support for TLS 1.3 inspection is tentatively planned to be introduced in SFOS v18. However this could be subject to change at anytime.

Regards,

Thanks for the answer, FLO.

Let assume a TLS connection where the server is up to TLS 1.3 and the client is at TLS 1.1.  If allowed, the server will downgraded to TLS 1.1, right  ?

To my understanding, TLS have always downgraded to earlier version when a client is not at the latest TLS.  This is in TLS specifications.  Unless admins locked out older TLS/SSL.  If I am not wrong, a very serious security was that TLS 1.0 would downgrade to very unsecured SSL 3.0.  TLS 1.1 appeared mostly because of that.

Google tried TLS 1.3 early last year but had to delay a year because too many problems occurred.  Downgrading to older TLS or not.

Technically, a supplier is not TLS if the downgrade mechanism is not implemented.

Question is now, if a user's desktop has TLS 1.2 implemented, if a server has TLS 1.3 ONLY rule, what will happen to XG - in between - trying to scan that traffic ?

Paul Jr

Hey Paul,

In regards to your question:

Big_Buck said:

 

Question is now, if a user's desktop has TLS 1.2 implemented, if a server has TLS 1.3 ONLY rule, what will happen to XG - in between - trying to scan that traffic 

The XG would relay what the server responds with, which would be a TLS error.

Regards,

Thanks.  And when should we expect that XG will be able to inspect TLS 1.3 traffic ?  I haven't seen any road-map mentioning it ...

Paul Jr

Hi Paul,

Below was the feedback I was provided.

FloSupport said:

Native support for TLS 1.3 inspection is tentatively planned to be introduced in SFOS v18. However this could be subject to change at anytime.

TLS 1.3 is available in SFOS v18 (tentative release date 18th Feb) for XG Firewall. :)

Hi,

do you mean GA release or just v18 eap4?

Ian

SSLx (DPI) supports TLS1.3 and does not downgrade the TLS communication to TLS1.2.