I was looking at the TLS 1.2 RFC and I see no official "threat model".

I've looked a bit around and no sign of it.

How come TLS has no threat model?

  • please remember to cite your sources when making references
    – schroeder
    Commented Jun 12, 2015 at 19:56
  • None of the TLS or SSL RFCs have a threat model, by the way. Why do you expect to see one?
    – schroeder
    Commented Jun 12, 2015 at 19:57
  • @schroeder: didn't occur to me that it was necessary sorry! Commented Jun 12, 2015 at 20:08
  • @schroeder: because that's usually what you want to define first when you build a tool/protocol that provides security. What does it protect against/doesn't protect against... Commented Jun 12, 2015 at 20:08
  • If you research the other threat models in other RFCs, you will note that there are threat models for using technologies over TLS/SSL (i.e. how TLS affects the threat model for other technologies). I believe in the case of a foundational protocol, you don't need a threat model.
    – schroeder
    Commented Jun 12, 2015 at 20:16

1 Answer 1


RFC 5246 does include a threat model, but it is described very succinctly and quite informally. It is at the start of Appendix F:

   The TLS protocol is designed to establish a secure connection between
   a client and a server communicating over an insecure channel.  This
   document makes several traditional assumptions, including that
   attackers have substantial computational resources and cannot obtain
   secret information from sources outside the protocol.  Attackers are
   assumed to have the ability to capture, modify, delete, replay, and
   otherwise tamper with messages sent over the communication channel.

The last sentence is the one that most closely resembles an embryonic "threat model".

Your question now becomes: why does the TLS standard not include anything better ? Basically, because nobody bothered to write down a better explained threat model, or to include it in the standard. Also, what is a threat model is unclear; notably, as indicated by the Wikipedia page, there are several conflicting definitions out there.

Ivan Ristić once wrote a nice diagram that looks like this:

and he calls that a "threat model", which I guess corresponds to at least one of the possible definitions of the expression "threat model".

  • I stumbled upon that diagram (and btw I have a hard time understanding how to read it). But what I was wondering mostly is why such an important protocol doesn't have a threat model in its RFC. An "official" threat model. Commented Jun 12, 2015 at 21:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .