RFC 10015: Deprecating Obsolete Key Exchange Methods in TLS 1.2 and DTLS 1.2

RFC 10015 Deprecating Obsolete Key Exchanges in (D July 2026 Aviram Standards Track [Page] Stream: Internet Engineering Task Force (IETF) RFC: 10015 Updates: 4162, 4279, 4346, 4785, 5246, 5288, 5289, 5469, 5487, 5932, 6209, 6347, 6367, 6655, 7905, 8422, 9325 Category: Standards Track Published: July 2026 ISSN: 2070-1721 Author: N. Aviram RFC 10015 Deprecating Obsolete Key Exchange Methods in TLS 1.2 and DTLS 1.2 Abstract For (D)TLS 1.2, this document deprecates the use of two key exchanges, namely Diffie-Hellman (DH) over a finite field and RSA. It also discourages the use of static Elliptic Curve Diffie-Hellman (ECDH) cipher suites.¶ These prescriptions apply only to (D)TLS 1.2, since (D)TLS 1.0 and TLS 1.1 are deprecated by RFC 8996 and (D)TLS 1.3 either does not use the affected algorithms or does not share the relevant configuration options. (There is no DTLS version 1.1.)¶ This document updates RFCs 4162, 4279, 4346, 4785, 5246, 5288, 5289, 5469, 5487, 5932, 6209, 6347, 6367, 6655, 7905, 8422, and 9325 to either deprecate or discourage the use of cipher suites using the above key exchange methods in (D)TLS 1.2 connections.¶ Status of This Memo This is an Internet Standards Track document.¶ This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841.¶ Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc10015.¶ Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶ This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶ ▲ Table of Contents 1.  Introduction 1.1.  Requirements Language 2.  Non-Ephemeral Diffie-Hellman 3.  Ephemeral Finite Field Diffie-Hellman 4.  RSA 5.  Updates to Cipher Suites and TLS ClientCertificateType Identifiers 5.1.  DH Cipher Suites Deprecated by This Document 5.2.  ECDH Cipher Suites Whose Use Is Discouraged by This Document 5.3.  DHE Cipher Suites Deprecated by This Document 5.4.  RSA Cipher Suites Deprecated by This Document 5.5.  TLS ClientCertificateType Identifiers Deprecated by This Document 6.  Updates to RFC 9325 7.  IANA Considerations 8.  Security Considerations 9.  References 9.1.  Normative References 9.2.  Informative References Acknowledgments Author's Address 1. Introduction (D)TLS 1.2 supports a variety of key ex