Description
TLS 1.0 and TLS 1.1 are legacy versions of TLS with significant robustness and complexity issues. They use SHA-1 in the handshake and they don't support AEAD cipher suites, meaning they require Encrypt-then-MAC CBC cipher suites that are vulnerable to side channel attacks. TLS 1.0 requires clunky countermeasures for attacks against CBC cipher suites.
TLS 1.2 was standardized in 2008. RFC 8996 strongly deprecated TLS 1.0 and TLS 1.1. All modern browsers removed support for TLS 1.0 and TLS 1.1 in 2020. PCI compliance has required TLS 1.2 since 2018. NIST guidelines require TLS 1.1 since 2014 and TLS 1.2 since 2019.
In terms of how the real world looks like, SSL Pulse says that only 0.7% of surveyed sites only support TLS 1.0. No websites supports TLS 1.1 but not TLS 1.2. Note that this data is not weighted by popularity. Since browsers removed TLS 1.0 and TLS 1.1 support, there are no connections numbers, but it was significantly lower before turndown.
On the client side the landscape is not as bright. Can I use says only 98.16% of web clients support TLS 1.2. I remember server-side connection numbers to be a little better, but not as good as client-side numbers.
There is also generally a qualitative difference between TLS 1.0 clients and TLS 1.0 servers. The former imply an outdated device, which can be expensive to replace, but possibly still serviceable. The latter implies a catastrophically out of date server which is not safe to use and must be updated.
Based on this, I propose a multi-stage plan for turning off and eventually removing TLS 1.0 and TLS 1.1.
I am requesting approval for the first stage, and will go through the proposal process again for each successive stage.
Stage 1
When zero, Config.MinVersion is changed to default to VersionTLS12 on the client side.
This can be overridden by setting Config.MinVersion (or with a temporary GODEBUG value).
Pre-announce this in Go 1.17, implement it in Go 1.18, remove the GODEBUG switch in Go 1.19.
Stage 2
When zero, Config.MinVersion is changed to default to VersionTLS12 on the server side.
This can be overridden by setting Config.MinVersion (or with a temporary GODEBUG value).
Pre-announce this in TBD, implement it in TBD+1, remove the GODEBUG switch in TBD+2.
(Stage 2, whenever it comes, might also be a good time to disable by default TLS 1.0-correlated ciphersuites like 3DES.)
Stage 3
TLS 1.0 and TLS 1.1 are turned off.
This can be temporarily overridden by both setting Config.MinVersion and a GODEBUG value simultaneously.
Pre-announce this in TBD, implement it in TBD+1, remove the GODEBUG switch and all TLS 1.0 and TLS 1.1 code in TBD+2.
(Stage 3, whenever it comes, might also be a good time to remove other off-by-default things like RC4 and 3DES.)