Forward secrecy mandatory — seven TLS libraries missed the memo
For eight years IETF merely suggested TLS rotate its keys. Now it has made a stand — rotation mandatory — seven widely-used libraries still don’t.
11 July 2026
Internet standard body spent eight years politely suggesting encryption software should change keys once in a while, on 11 July 2026 it stopped suggesting: RFC 9846 (obsoleting RFC 8446) makes key rotation mandatory; implementations MUST now rekey (or tear-down connection).
Seven libraries don’t, jeopardising global internet traffic #harvest-now
Two things are being made compulsory here. Rotating a key mid-connection is what gives you forward secrecy: change the key as you go, and a key stolen tomorrow cannot open what was said today. Without it, one secret guards a connection from its first byte to its last, so anyone who later lifts that key, from a crash dump, a memory bug, or a machine seized months afterwards, can decrypt the whole conversation. Traffic an eavesdropper recorded weeks earlier, waiting for exactly that key, falls the same way.
The second thing being made compulsory is stranger, and more interesting. The point at which a connection must rotate is not a round number someone liked, but the point where the mathematics runs out: a cipher is proven safe only up to a certain volume of data under one key, and past that the proof makes no promises. This is not a warning that the cipher breaks; the guarantee simply expires. So the TLS specification is doing what a standards body almost never does — pinning a hard requirement to a theorem.
Missed memo. Seven widely-used TLS libraries do neither of these things, so every long-lived connection they carry runs start to finish under one secret, with no forward secrecy and no proof behind it.
Whether this is a scandal or a shrug is genuinely arguable. One reading: no cipher breaks, the limit sits eons away, a stolen key is rare, so a rule this cautious costs little to skip. The other: it says MUST, forward secrecy is real and a proof worth keeping, and a library claiming TLS 1.3 either does it or does not. The quiet part is not in dispute: seven libraries carry months-long connections under a single key, none of which will ever change. Read on →