I am looking at all the green and red boxes here, and am wondering what it would look like if one were to "implement TLS" today? What should you implement if you were to implement TLS today?
- Do you need to implement all of the previous versions? (SSL 1-3, TLS 1.0-1.3)
- Do you need to implement all the cryptography algorithms, or just the TLS 1.3 ones? (RSA is not used in TLS 1.3 it looks like, but is the standard for HTTPS as far as I know, for example).
- Do you need to implement all the ciphers, or just the TLS 1.3 ones?
Rather than trying to describe what needs to be implemented in order to support TLS today, the simpler question is do browsers support TLS 1.3? If not, why not? This leads to the above questions, plus...
In order to fetch "older" websites, do you need to support older TLS protocols? Or can you have, let's say, a brand new TLS 1.3 implementation that only implements the following, and be good to go in terms of communicating with "older" sites and services? Basically TLS 1.3 seems to only implement:
- AES GCM
- AES CCM
That's only 7 things, meanwhile there are about 20 key exchange algorithms in the full range of TLS/SSL versions from SSL 1.0 to TLS 1.3, and about 20 ciphers, and 6 data integrity algorithms.
Basically, in order to support browsing the web if TLS was implemented today in a new open source project for example, would it only need to write the code for those 7 things, or all 20 + 20 + 6 ~ 46 algorithms, basically supporting all SSL and TLS versions of the past?
I am basically confused as to what needs to be implemented to support secure web browsing in the 21st century, given that everything before TLS 1.3 has been found to be insecure (it seems like). The answer to this question would help me come up with a project scope on what it would take to implement TLS properly today.
If you can't just implement TLS 1.3 (and need to support the older TLS/SSL versions), what happens if you only had TLS 1.3? What about only TLS 1.3 and 1.2? etc. Basically, what handicaps do you have by only supporting the latest version. Does it mean simply that you can't fetch certain webpages, or what?
It sounds like browsers have stopped supporting SSL 3.0 and before for a while now, but I'm not sure.