I was looking at the TLS 1.2 RFC and I see no official "threat model".
I've looked a bit around and no sign of it.
How come TLS has no threat model?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
RFC 5246 does include a threat model, but it is described very succinctly and quite informally. It is at the start of Appendix F:
The TLS protocol is designed to establish a secure connection between a client and a server communicating over an insecure channel. This document makes several traditional assumptions, including that attackers have substantial computational resources and cannot obtain secret information from sources outside the protocol. Attackers are assumed to have the ability to capture, modify, delete, replay, and otherwise tamper with messages sent over the communication channel.
The last sentence is the one that most closely resembles an embryonic "threat model".
Your question now becomes: why does the TLS standard not include anything better ? Basically, because nobody bothered to write down a better explained threat model, or to include it in the standard. Also, what is a threat model is unclear; notably, as indicated by the Wikipedia page, there are several conflicting definitions out there.
Ivan Ristić once wrote a nice diagram that looks like this:
and he calls that a "threat model", which I guess corresponds to at least one of the possible definitions of the expression "threat model".