Switch the calls to use DTLS 1.3

Feature Proposal
,
1

Please switch the calls to use DTLS 1.3—after all, this is done simply by specifying a parameter in the function call:

rawApp.commandLine.appendSwitch(
‘force-fieldtrials’,
‘WebRTC-ForceDtls13/Only/’
)

2

The suggested change would only affect DC desktop and Delta Touch. If we go for this, we need to ensure compatibility, with older versions and with other clients.

3

As far as I understand, current Electron/WebRTC already negotiates DTLS 1.3 whenever both peers support it. My proposal was only to disable fallback to DTLS 1.2. Am I missing anything, or is your concern solely about backward compatibility with older clients?

4

Would you like the call to fail if one of the peers doesn’t support DTLS 1.3?

5

TLS 1.3 is not downgradable to TLS 1.2, so you don’t really gain anything by explicitly disabling TLS 1.2: RFC 9846: The Transport Layer Security (TLS) Protocol Version 1.3 | RFC Editor

6

No, I just don’t want the weakest and most outdated encryption currently available to keep being used.
Right now, the situation is: we can’t import encryption keys, we can’t use 1.3…

7

Downgrade protection means that if both peers support TLS 1.3 and TLS 1.2, then TLS 1.3 will be negotiated and cannot be downgraded to TLS 1.2 by an active attack. Disabling TLS 1.2 only matters if the other side does not support TLS 1.3.

8

Which clients in the current version lack support for DTLS 1.3?

9

I did not check, but expect that all clients support TLS 1.3, so TLS 1.3 is likely already always used and there is no need to explicitly disable TLS 1.2.

I’m not against disabling TLS 1.2, we set the minimum version to TLS 1.3 on chatmail relays for IMAP connections because Delta Chat is known to support TLS 1.3. But if disabling it requires hidden settings like “force-fieldtrials” or cannot be done on some platform, it is not really worth the effort, there is already no downgrade attack possible.

10

Where does it say that the highest available version is always the one agreed upon?

What happens if I use regular email instead of ChatMail?

How does this affect calls and DTLS?