Designated experts are instructed to decline codepoint registrations for documents already adopted or proposed for adoption by IETF WGs or IRTF RGs. The Specification Required policy is intended for protocols developed outside the IETF/IRTF; internal work should be coordinated with the TLS WG to ensure appropriate review.

tls, registry, process

The 'D' (discouraged) value was introduced to allow IANA registries to actively signal that an algorithm or mechanism is problematic — such as a weak cipher or an interoperability hazard — without removing it. The 'N' value only means 'not evaluated', not 'avoid', so a third value was needed to distinguish actively discouraged items.

tls, registry, security

This document updates RFC 8447. Registries that already had a 'Comment' or 'Note' column, or were orphaned by TLS 1.3, are excluded from the 'Comment' column additions. Existing 'Y' and 'N' entries in the 'Recommended' column are preserved; only the new 'D' entries and the governance rules are changed.

tls, registry

IANA MUST verify that one TLS Exporter Label is not a prefix of any other label. For example, labels 'key' or 'master secretary' are forbidden because they could prefix other valid labels.

tls, registry

Implementers and users SHOULD consult the linked references for items marked 'D' to determine the conditions under which the item SHOULD NOT or MUST NOT be used.

tls, registry, security

Registration requests for TLS codepoints MUST be submitted either by email to iana@iana.org or via the online IANA form. Email requests SHOULD use an appropriate subject line identifying the target registry.

tls, registry, process

Setting a registry value to 'Y' or 'D', or transitioning from 'Y' or 'D', in the 'Recommended' column requires IETF Standards Action with Expert Review or IESG Approval (RFC 8126). This applies to all affected TLS registries.

tls, registry, process

When marking a registry entry as 'D' (discouraged), either the 'Reference' or the 'Comment' column MUST include sufficient information to determine why the marking has been applied.

tls, registry

The 'Recommended' column in TLS registries now supports three values: 'Y' (IETF consensus recommends the item), 'N' (not evaluated or no consensus), and 'D' (discouraged — may cause problems such as weak cryptography or interoperability issues). This extends the binary Y/N scheme from RFC 8447.

tls, registry, security

A 'Comment' column is added to 20 TLS IANA registries that did not already have a 'Comment' or 'Note' column and were not orphaned by TLS 1.3, including TLS Cipher Suites, TLS ExtensionType Values, TLS ALPN Protocol IDs, TLS SignatureScheme, TLS SSLKEYLOGFILE Labels, and others.

tls, registry

The 'TLS Cipher Suites' registry is updated to mark a large set of cipher suites as 'D' (discouraged), including all KRB5-based suites, PSK suites with NULL or RC4, ECDHE suites with NULL or RC4, and experimental TLS_SHA256_SHA256 / TLS_SHA384_SHA384 suites. A 'Comment' column is added.

tls, registry, security, crypto

The 'TLS ClientCertificateType Identifiers' registry gains a 'Recommended' column. RSA_sign (1) and ECDSA_sign (64) are marked 'Y'; rsa_ephemeral_dh_RESERVED (5), dss_ephemeral_dh_RESERVED (6), and fortezza_dms_RESERVED (20) are marked 'D'.

tls, registry, security

The 'TLS Exporter Labels' registry registration procedure is changed from Specification Required to Expert Review. The 'Note' column is renamed 'Comment'. The expert reviewer note is updated to clarify scope and limitations of the review.

tls, registry, process

The 'TLS ExtensionType Values' registry is updated to mark truncated_hmac (value 4), two Reserved values (40, 46), and the deprecated connection_id (53) as 'D' (discouraged). A 'Comment' column is also added to this registry.

tls, registry, security

The 'TLS HashAlgorithm' registry gains a new 'Recommended' column. MD5 (1), SHA-1 (2), and SHA-224 (3) are marked 'D'; SHA-256 (4), SHA-384 (5), SHA-512 (6), and Intrinsic (8) are marked 'Y'; 'none' (0) is marked 'Y'.

tls, registry, crypto, security

The 'TLS SignatureAlgorithm' registry gains a new 'Recommended' column. RSA (1), ECDSA (3), Ed25519 (7), and Ed448 (8) are marked 'Y'; anonymous (0), DSA (2), and GOST algorithms (64, 65) are marked 'N'.

tls, registry, crypto, security

The 'TLS Supported Groups' registry is updated to mark 15 weak elliptic curve groups (sect163k1 through secp224r1, values 1–21) as 'D' (discouraged), with a link to the IETF 118 TLS WG slides in the 'Comment' column as justification.

tls, registry, security, crypto

Designated expert review of TLS registry entries ensures that specifications are publicly available, but expert approval should not be taken as an endorsement of the security of a cipher suite, extension, or supported group.

tls, security, registry

NULL-encryption cipher suites do not provide confidentiality and MUST NOT be used in protocols or applications that require confidentiality as a security property. EXPORT suites use weak ciphers (deprecated in TLS 1.1). Anonymous (anon) suites provide no authentication and are vulnerable to on-path attacks.

tls, security, crypto

Recommended algorithms are considered secure at the time of registration, but cryptographic algorithms and parameters may be broken or weakened over time. The 'Recommended' status in the registry may lag behind advances in cryptanalysis, so implementers must independently verify that listed algorithms still provide the expected level of security.

tls, security, crypto