RFC 9851: TLS Registries Locked to TLS 1.3 and Beyond

The IETF has published RFC 9851, a short but consequential document that changes how TLS registries are managed. Rather than closing any existing registries, it instructs IANA and the TLS Designated Experts to constrain future entries: any TLS registry entry added after approval of this RFC is intended for TLS 1.3 or later, and makes no similar requirement on DTLS.

The practical effect is a freeze on the addition of new protocol elements that target pre-1.3 versions. If you want to register a new cipher suite, extension, or alert, it must be designed for TLS 1.3 or newer. The note explicitly says entries should carry an informal indication like "For TLS 1.3 or later" in the comment column.

The note has been applied to 23 existing TLS registries, including TLS Cipher Suites, TLS ExtensionType Values, TLS SignatureScheme, TLS Supported Groups, and TLS Alerts. Registries that are explicitly excluded from this constraint are the ALPN Protocol IDs and TLS Exporter Labels, which remain open to broader registrations.

This is a deliberate move to prevent the protocol space from being cluttered with legacy-oriented additions. TLS 1.3 has been the standard since 2018, and TLS 1.2 is increasingly a legacy compatibility target. By signaling that new entries are for TLS 1.3+, the IETF is nudging the ecosystem toward modern protocol versions.

For engineers, the immediate takeaway is about planning: if you're designing a new TLS extension or cipher suite, target TLS 1.3 semantics from the start. Don't expect to register something that only works with TLS 1.2 and have it accepted into the main registries. The DTLS exemption is also notable—DTLS is not bound by this constraint, so DTLS-specific registrations can still target older versions if needed.

The document also specifies that any TLS registry created after this RFC is approved should indicate whether the actions defined here are applicable. That ensures the policy is forward-looking, not just a one-time cleanup.

This is a small but meaningful governance change. It won't break anything today, but it shapes the future direction of TLS development. For those maintaining TLS stacks or building on top of them, it's worth understanding the new registration rules before submitting anything to IANA.