Theoretical question: Is there any reason that a client could not securely use Microsoft's Windows 7 SChannel implementation of TLS 1.2 "out of the box", as in with no updates? Having looked at SChannel vulnerabilities on the NIST National Vulnerability Database, it seems there are at least 5 known ones:
- CVE-2014-6321 a.k.a "Winshock"
- CVE-2015-6112 "Triple Handshake Attack"
- CVE-2015-1637 a.k.a "FREAK" attack
- CVE-2010-3229 "TLSv1 DDOS Vulnerability"
However, it seems if you implement TLS v1.2 in the correct manner you can avoid these issues (although I could be and probably am completely wrong here). Again, this is just a theoretical question but stems from a conversation about utilising TLS 1.2 on a Windows 7 system with as little updates and dependencies as possible and no open source libraries.