I was looking at the TLS 1.2 RFC and I see no official "threat model".

I've looked a bit around and no sign of it.

How come TLS has no threat model?

  • please remember to cite your sources when making references – schroeder Jun 12 '15 at 19:56
  • None of the TLS or SSL RFCs have a threat model, by the way. Why do you expect to see one? – schroeder Jun 12 '15 at 19:57
  • @schroeder: didn't occur to me that it was necessary sorry! – David 天宇 Wong Jun 12 '15 at 20:08
  • @schroeder: because that's usually what you want to define first when you build a tool/protocol that provides security. What does it protect against/doesn't protect against... – David 天宇 Wong Jun 12 '15 at 20:08
  • If you research the other threat models in other RFCs, you will note that there are threat models for using technologies over TLS/SSL (i.e. how TLS affects the threat model for other technologies). I believe in the case of a foundational protocol, you don't need a threat model. – schroeder Jun 12 '15 at 20:16

RFC 5246 does include a threat model, but it is described very succinctly and quite informally. It is at the start of Appendix F:

   The TLS protocol is designed to establish a secure connection between
   a client and a server communicating over an insecure channel.  This
   document makes several traditional assumptions, including that
   attackers have substantial computational resources and cannot obtain
   secret information from sources outside the protocol.  Attackers are
   assumed to have the ability to capture, modify, delete, replay, and
   otherwise tamper with messages sent over the communication channel.

The last sentence is the one that most closely resembles an embryonic "threat model".

Your question now becomes: why does the TLS standard not include anything better ? Basically, because nobody bothered to write down a better explained threat model, or to include it in the standard. Also, what is a threat model is unclear; notably, as indicated by the Wikipedia page, there are several conflicting definitions out there.

Ivan Ristić once wrote a nice diagram that looks like this:

and he calls that a "threat model", which I guess corresponds to at least one of the possible definitions of the expression "threat model".

| improve this answer | |
  • I stumbled upon that diagram (and btw I have a hard time understanding how to read it). But what I was wondering mostly is why such an important protocol doesn't have a threat model in its RFC. An "official" threat model. – David 天宇 Wong Jun 12 '15 at 21:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.