Key points
- The NCSC advises disabling all SSL versions and TLS 1.0/1.1 immediately.
- TLS 1.3 is the only version supporting post-quantum cryptography features.
- Hybrid key exchange mechanisms are recommended for interim PQC migration.
The short version
- System administrators must disable SSL, TLS 1.0, and TLS 1.1.
- TLS 1.3 is required for future post-quantum cryptography support.
- TLS 1.2 remains secure against classical attacks but lacks PQC features.
The details
The UK National Cyber Security Centre released updated guidance for system administrators responsible for configuring servers and clients. The advisory focuses on securing Transport Layer Security configurations and preparing for the transition to post-quantum cryptography. The agency states that only TLS 1.3 provides protection against quantum attacks when configured correctly. Administrators are instructed to use recommended TLS 1.3 profiles immediately.
For systems still using TLS 1.2, the NCSC advises developing a migration plan to TLS 1.3. While TLS 1.2 offers strong protection against classical attacks with proper cryptographic profiles, it will not receive new features beyond critical security updates. The protocol is effectively in maintenance mode according to RFC 9851. Organizations using TLS 1.2 should treat it as a temporary state while planning their upgrade path to the newer standard.
The guidance explicitly mandates the disabling of all SSL versions. SSL is the predecessor to TLS and is considered insecure across all its iterations. Additionally, TLS 1.0 and TLS 1.1 have been deprecated by the Internet Engineering Task Force and should not be used. The NCSC recommends that government systems do not support these deprecated versions and upgrade to TLS 1.3 instead. Disabling known insecure TLS features is also a mandatory step in this configuration process.
The context
A cryptographically relevant quantum computer would threaten the key exchange and digital signature algorithms currently securing TLS communications. The primary mitigation for this emerging risk is migrating to post-quantum cryptography. RFC 10024 standardizes three post-quantum and traditional hybrid key agreement mechanisms for TLS 1.3. These mechanisms combine the post-quantum ML-KEM algorithm with traditional elliptic curve algorithms.
The NCSC recommends using these hybrid schemes as an interim measure during the migration to PQC. All three standardized mechanisms are suitable for protecting personal, enterprise, and OFFICIAL-tier government information. The IETF is also developing standards for non-hybrid ML-KEM, which will standardize MLKEM768 and MLKEM1024 options for TLS. The NCSC considers these algorithms acceptable for use and notes they are already available in many common TLS implementations.
Currently, the IETF has only standardized post-quantum algorithms for key exchange in TLS. Work is ongoing to standardize post-quantum authentication for TLS and the wider Web Public Key Infrastructure. Organizations operating private PKIs may be able to adopt post-quantum authentication sooner than services relying on the public Web PKI. Once these standards are finalized and mature implementations are available commercially, the NCSC will update its guidance to include recommendations for their use.
What to watch
- Finalization of post-quantum authentication standards for TLS and Web PKI.
- Availability of mature commercial implementations for non-hybrid ML-KEM algorithms.
- Updates to NCSC guidance regarding post-quantum authentication recommendations.
- Ongoing development of IETF drafts for post-quantum key agreement mechanisms.
What it means for organisations
Security teams should audit their infrastructure to identify any remaining SSL or TLS 1.0/1.1 configurations. Organizations must coordinate with suppliers to ensure all external connections support TLS 1.3. Internal stakeholders, including operations and compliance, need to understand the timeline for PQC migration. Teams usually review certificate management processes to align with new cryptographic requirements. Leadership should be informed of the operational changes required to disable legacy protocols without disrupting business continuity.
What to do and how to stay safe
- Implement recommended TLS 1.3 cryptographic profiles on all supported systems.
- Develop a migration plan to transition TLS 1.2 systems to TLS 1.3 for PQC readiness.
- Monitor vendor updates for TLS implementations supporting hybrid post-quantum key exchange.
Step-by-step guide: Secure Home Routers for Small Business Networks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
