crypto/tls: make TLS 1.3 opt-out for Go 1.13 #30055

rsc · 2019-02-01T16:02:41Z

It seems clear from the history of filed issues that some users will experience minor disruptions when switching to TLS 1.3. For disruptive changes like that, we typically do one or more releases in which the new feature is opt-in, with a prominent announcement about when it will turn on by default. Then we do at least one release with the feature opt-out. (Past examples include HTTP/2, vendor directories, and modules.)

Especially given how central TLS is to so many Go users (any HTTPS client or server!), it seems like we should do that for TLS 1.3 too:

Make TLS 1.3 available in Go 1.12 but opt-in (off by default).
Make clear in the release notes and package docs how to turn on TLS 1.3.
Make clear in the release notes that TLS 1.3 will turn on by default in Go 1.13.
Make TLS 1.3 in Go 1.13 opt-out (on by default).

Following the HTTP/2 example my suggestion would be to use GODEBUG=tls13=1 for opt-in now, and GODEBUG=tls13=0 for opt-out later.

/cc @FiloSottile

The text was updated successfully, but these errors were encountered:

bradfitz · 2019-02-01T16:09:56Z

Following the HTTP/2 example my suggestion would be to use GODEBUG=tls13=1 for opt-in now

That's fine as long as there's also a way to enable it in code. Via tls.Config somehow? (MaxVersion and MinVersion both seem wrong.) Or at least with os.Setenv at runtime, but that means crypto/tls would need to keep calling Getenv. New bool on tls.Config would be kinda unfortunate, but maybe?

neild · 2019-02-01T16:23:21Z

Should this apply to RSA-PSS as well?

mvdan · 2019-02-01T16:39:24Z

New bool on tls.Config would be kinda unfortunate, but maybe?

A perhaps less specific version could be Debug []string, e.g. tlsConfig.Debug = []string{"tls13=1"}. Then it can be reused for more on/off switches in future Go releases, and its behavior is consistent with GODEBUG.

FiloSottile · 2019-02-01T16:45:06Z

MaxVersion feels wrong semantically, and in practice it would lock applications to TLS 1.3 when TLS 1.4 ever comes out. I'm worried that tlsConfig.Debug would be a slippery slope, we get requests all the time to add all kinds of knobs which are inconsistent with the simplicity goal of crypto/tls, and that would provide an extra avenue for them.

How about GODEBUG=tls13=1, read once per tls.Config? It would allow os.Setenv in code, it would probably have acceptable performance, and still let applications test canaries without modifying code. It would probably have to be inherited via GetConfigForClient if one os.Getenv per connection is unacceptable.

bradfitz · 2019-02-01T17:03:04Z

MaxVersion = 0xFFFF would be my vote. Or some other unused constant to mean MaxBeta.

bradfitz · 2019-02-01T17:04:24Z

But users likely wouldn't be able to reach all such configs so the environment way probably best if Setenv works.

gopherbot · 2019-02-04T15:49:39Z

Change https://golang.org/cl/160998 mentions this issue: crypto/tls: disable RSA-PSS in TLS 1.2

gopherbot · 2019-02-04T15:49:40Z

Change https://golang.org/cl/160997 mentions this issue: crypto/tls: make TLS 1.3 opt-in

FiloSottile · 2019-02-04T15:51:37Z

CL 160997 just uses os.Getenv at every connection. On Unix it takes a brief lock but uses an internal view of the environment, so there is no syscall. On Windows it makes a syscall. We can test the performance before adding complexity the day before the RC.

Updates #30055 Change-Id: If68615c8e9daa4226125dcc6a6866f29f3cfeef1 Reviewed-on: https://go-review.googlesource.com/c/160997 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>

Most of the issues that led to the decision on #30055 were related to incompatibility with or faulty support for RSA-PSS (#29831, #29779, v1.5 signatures). RSA-PSS is required by TLS 1.3, but is also available to be negotiated in TLS 1.2. Altering TLS 1.2 behavior based on GODEBUG=tls13=1 feels surprising, so just disable RSA-PSS entirely in TLS 1.2 until TLS 1.3 is on by default, so breakage happens all at once. Updates #30055 Change-Id: Iee90454a20ded8895e5302e8bcbcd32e4e3031c2 Reviewed-on: https://go-review.googlesource.com/c/160998 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Adam Langley <agl@golang.org>

FiloSottile · 2019-02-07T18:36:49Z

Done for Go 1.12, milestoned to Go 1.13 to switch to opt-out.

crvv · 2019-02-13T10:29:54Z

I think it is worth to document how to use os.Setenv to set this environment variable.

I guess this might work

os.Setenv("GODEBUG", os.Getenv("GODEBUG")+",tls13=1")

But os.Setenv("GODEBUG", "tls13=1") will overwrite other GODEBUG like GODEBUG=http2server=0.

If some other goroutines are also setting GODEBUG, there can be a race condition.

Alternately, maybe using another env is better. And os.Setenv("GOTLS13", "1") is mostly OK.

crvv · 2019-02-13T10:40:02Z

According to #13611
GODEBUG usage should also be documented in https://tip.golang.org/pkg/runtime/

bradfitz · 2019-02-13T16:16:04Z

@crvv, I sent https://go-review.googlesource.com/c/go/+/162360

Updates golang#30055 Change-Id: If68615c8e9daa4226125dcc6a6866f29f3cfeef1 Reviewed-on: https://go-review.googlesource.com/c/160997 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>

Most of the issues that led to the decision on golang#30055 were related to incompatibility with or faulty support for RSA-PSS (golang#29831, golang#29779, v1.5 signatures). RSA-PSS is required by TLS 1.3, but is also available to be negotiated in TLS 1.2. Altering TLS 1.2 behavior based on GODEBUG=tls13=1 feels surprising, so just disable RSA-PSS entirely in TLS 1.2 until TLS 1.3 is on by default, so breakage happens all at once. Updates golang#30055 Change-Id: Iee90454a20ded8895e5302e8bcbcd32e4e3031c2 Reviewed-on: https://go-review.googlesource.com/c/160998 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Adam Langley <agl@golang.org>

gopherbot · 2019-02-19T21:06:58Z

Change https://golang.org/cl/163039 mentions this issue: [release-branch.go1.12] crypto/tls: don't select RSA-PSS for client certificates in TLS 1.2

Updates golang#30055 Change-Id: If68615c8e9daa4226125dcc6a6866f29f3cfeef1 Reviewed-on: https://go-review.googlesource.com/c/160997 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>

Most of the issues that led to the decision on golang#30055 were related to incompatibility with or faulty support for RSA-PSS (golang#29831, golang#29779, v1.5 signatures). RSA-PSS is required by TLS 1.3, but is also available to be negotiated in TLS 1.2. Altering TLS 1.2 behavior based on GODEBUG=tls13=1 feels surprising, so just disable RSA-PSS entirely in TLS 1.2 until TLS 1.3 is on by default, so breakage happens all at once. Updates golang#30055 Change-Id: Iee90454a20ded8895e5302e8bcbcd32e4e3031c2 Reviewed-on: https://go-review.googlesource.com/c/160998 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Adam Langley <agl@golang.org>

gopherbot · 2019-02-20T19:19:35Z

Change https://golang.org/cl/163080 mentions this issue: Revert "crypto/tls: disable RSA-PSS in TLS 1.2"

gopherbot · 2019-02-20T19:19:36Z

Change https://golang.org/cl/163081 mentions this issue: crypto/tls: enable TLS 1.3 by default

…ertificates in TLS 1.2 In https://golang.org/cl/160998, RSA-PSS was disabled for (most of) TLS 1.2. One place where we can't disable it is in a Client Hello which offers both TLS 1.2 and 1.3: RSA-PSS is required by TLS 1.3, so to offer TLS 1.3 we need to offer RSA-PSS, even if the server might select TLS 1.2. The good news is that we want to disable RSA-PSS mostly when we are the signing side, as that's where broken crypto.Signer implementations will bite us. So we can announce RSA-PSS in the Client Hello, tolerate the server picking TLS 1.2 and RSA-PSS for their signatures, but still not do RSA-PSS on our side if asked to provide a client certificate. Client-TLSv12-ClientCert-RSA-PSS-Disabled changed because it was indeed actually using RSA-PSS. Updates #30055 Change-Id: I5ecade744b666433b37847abf55e1f08089b21d4 Reviewed-on: https://go-review.googlesource.com/c/163039 Reviewed-by: Andrew Bonventre <andybons@golang.org> Reviewed-by: Adam Langley <agl@golang.org>

In Go 1.13 we will enable RSA-PSS in TLS 1.2 at the same time as we make TLS 1.3 enabled by default. This reverts commit 7ccd358. Updates #30055 Change-Id: I6f2ddf7652d1172a6b29f4e335ff3a71a89974bc Reviewed-on: https://go-review.googlesource.com/c/163080 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Adam Langley <agl@golang.org>

Updates #30055 Change-Id: I3e79dd7592673c5d76568b0bcded6c391c3be6b3 Reviewed-on: https://go-review.googlesource.com/c/163081 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Adam Langley <agl@golang.org>

…ertificates in TLS 1.2 In https://golang.org/cl/160998, RSA-PSS was disabled for (most of) TLS 1.2. One place where we can't disable it is in a Client Hello which offers both TLS 1.2 and 1.3: RSA-PSS is required by TLS 1.3, so to offer TLS 1.3 we need to offer RSA-PSS, even if the server might select TLS 1.2. The good news is that we want to disable RSA-PSS mostly when we are the signing side, as that's where broken crypto.Signer implementations will bite us. So we can announce RSA-PSS in the Client Hello, tolerate the server picking TLS 1.2 and RSA-PSS for their signatures, but still not do RSA-PSS on our side if asked to provide a client certificate. Client-TLSv12-ClientCert-RSA-PSS-Disabled changed because it was indeed actually using RSA-PSS. Updates golang#30055 Change-Id: I5ecade744b666433b37847abf55e1f08089b21d4 Reviewed-on: https://go-review.googlesource.com/c/163039 Reviewed-by: Andrew Bonventre <andybons@golang.org> Reviewed-by: Adam Langley <agl@golang.org>

FiloSottile · 2019-04-29T19:59:56Z

Milestoned to 1.14 to remove the opt-out.

gopherbot · 2019-08-27T22:11:10Z

Change https://golang.org/cl/191999 mentions this issue: crypto/tls: remove TLS 1.3 opt-out

Fixes golang#30055 Change-Id: If757c43b52fc7bf62b0afb1c720615329fb5569d Reviewed-on: https://go-review.googlesource.com/c/go/+/191999 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

rsc added this to the Go1.12 milestone Feb 1, 2019

rsc added the release-blocker label Feb 1, 2019

FiloSottile modified the milestones: Go1.12, Go1.13 Feb 7, 2019

marten-seemann mentioned this issue Feb 8, 2019

use TLS 1.3 libp2p/go-libp2p-tls#3

Closed

mholt mentioned this issue Feb 12, 2019

caddytls: add TLS 1.3 support caddyserver/caddy#2399

Merged

4 tasks

bcmills changed the title ~~crypto/tls: make TLS 1.3 opt-in for Go 1.12~~ crypto/tls: make TLS 1.3 opt-out for Go 1.13 Mar 1, 2019

bcmills added the NeedsFix The path to resolution is known, but the work has not been done. label Mar 1, 2019

lysu mentioned this issue Apr 25, 2019

server: fix TestTLS when use RSA-PSS pingcap/tidb#10274

Merged

FiloSottile modified the milestones: Go1.13, Go1.14 Apr 29, 2019

bradfitz assigned FiloSottile Apr 29, 2019

FiloSottile mentioned this issue Jun 4, 2019

crypto/tls: back RSA-PSS out of TLS 1.2 in Go 1.13 #32425

Closed

na-- mentioned this issue Jun 27, 2019

Whether K6 supports TLS 1.3 ? grafana/k6#1061

Closed

bcebere mentioned this issue Jun 28, 2019

TLS hardening coredns/coredns#2938

Merged

eclipseo mentioned this issue Jul 30, 2019

apimachinery: Golang 1.13 requires bigger keys kubernetes/kubernetes#80733

Closed

gopherbot closed this as completed in a8c2e5c Aug 27, 2019

ivandeex mentioned this issue Oct 5, 2019

1.49.4 is slow (uploading) vs 1.48 ? rclone/rclone#3578

Closed

szuecs mentioned this issue Oct 12, 2019

Add tls1.3 support zalando/skipper#745

Closed

4 tasks

golang locked and limited conversation to collaborators Aug 26, 2020

gopherbot added the FrozenDueToAge label Aug 26, 2020

rsc unassigned FiloSottile Jun 23, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

crypto/tls: make TLS 1.3 opt-out for Go 1.13 #30055

crypto/tls: make TLS 1.3 opt-out for Go 1.13 #30055

rsc commented Feb 1, 2019

bradfitz commented Feb 1, 2019

neild commented Feb 1, 2019

mvdan commented Feb 1, 2019

FiloSottile commented Feb 1, 2019 •

edited

bradfitz commented Feb 1, 2019

bradfitz commented Feb 1, 2019

gopherbot commented Feb 4, 2019

gopherbot commented Feb 4, 2019

FiloSottile commented Feb 4, 2019

FiloSottile commented Feb 7, 2019

crvv commented Feb 13, 2019

crvv commented Feb 13, 2019

bradfitz commented Feb 13, 2019

gopherbot commented Feb 19, 2019

gopherbot commented Feb 20, 2019

gopherbot commented Feb 20, 2019

FiloSottile commented Apr 29, 2019

gopherbot commented Aug 27, 2019

crypto/tls: make TLS 1.3 opt-out for Go 1.13 #30055

crypto/tls: make TLS 1.3 opt-out for Go 1.13 #30055

Comments

rsc commented Feb 1, 2019

bradfitz commented Feb 1, 2019

neild commented Feb 1, 2019

mvdan commented Feb 1, 2019

FiloSottile commented Feb 1, 2019 • edited

bradfitz commented Feb 1, 2019

bradfitz commented Feb 1, 2019

gopherbot commented Feb 4, 2019

gopherbot commented Feb 4, 2019

FiloSottile commented Feb 4, 2019

FiloSottile commented Feb 7, 2019

crvv commented Feb 13, 2019

crvv commented Feb 13, 2019

bradfitz commented Feb 13, 2019

gopherbot commented Feb 19, 2019

gopherbot commented Feb 20, 2019

gopherbot commented Feb 20, 2019

FiloSottile commented Apr 29, 2019

gopherbot commented Aug 27, 2019

FiloSottile commented Feb 1, 2019 •

edited