Strict TLS 1.3 in chrome 72 or 73?

[emr_1]

Hello Guys,

Which information is true?

Chrome 72(in topic) or Chrome 73(in article)?

[BPry]

@emr_1,

72 enables downgrade protection, and to an extent, the damage was already done with the release of 70. 72 is simply taking things a small step further. To prepare yourself for this, simply upgrade to one of the following and you should be good to go. 

• PAN-OS 8.1 must be ≥ 8.1.4
• PAN-OS 8.0 must be ≥ 8.0.14
• PAN-OS 7.1 must be ≥ 7.1.21

[emr_1]

Hi BPry,

Thanks for your reply.

I tested with my testbed : PA-5020 v8.0.13 with Chrome 72.

Here is test results.

chrome://flags/#tls13-variant ## default
chrome://flags/#enforce-tls13-downgrade ## default
-> I could access to the gmail

chrome://flags/#tls13-variant ## default
chrome://flags/#enforce-tls13-downgrade ## enabled
-> confirmed "ERR_TLS13_DOWNGRADE_DETECTED"

-> also confirmed I could access to the gmail after I upgrade into 8.0.14.

chrome://flags/#tls13-variant ## default
chrome://flags/#enforce-tls13-downgrade ## disabled
-> I could access to the gmail

Thus, I believe downgrade protection is not enabled in 72. 

[BPry]

@emr_1,

They may have gotten enough pushback from Enterprise users that they chose not to enable it by Default; I know the original plan was to do so in 72. Looking through the Chromium commits I'm not seeing anything about it being switched in 73 either, they actually disabled the KeyUpdate function due to bugs. 

I wouldn't be suprised to see this goalpost keep getting pushed back to be honest. 

[gwesson]

Google pushed the full enforcement to Chrome version 73 (unless they push it again). They have enabled it in version 72 but only if you don't trust the CA.

The advisory has now been updated to reflect this new info:

https://live.paloaltonetworks.com/t5/Customer-Advisories/Action-required-if-you-have-enabled-SSL-dec...

[emr_1]

Hi BPry, gwesson

Thank you for replies. I understood the situation.