UK NCSC Issues TLS Configuration Guidance and Post-Quantum Migration Advice

The UK National Cyber Security Centre published new guidance on configuring Transport Layer Security (TLS) to protect digital communications and manage the transition to post-quantum cryptography. The advisory targets system administrators responsible for server and client configurations within their organizational estates.

The agency emphasizes that only TLS 1.3 offers protection against quantum attacks when set up properly. While TLS 1.2 remains secure against classical threats with recommended profiles, it will not receive new features beyond critical security updates. The NCSC advises users of TLS 1.2 to plan a migration to TLS 1.3 to adopt post-quantum capabilities.

Protocol Deprecation and Standards

All versions of the Secure Sockets Layer (SSL) protocol are deprecated and considered insecure, requiring immediate disablement. TLS 1.0 and TLS 1.1 are also deprecated by the Internet Engineering Task Force (IETF) per RFC 8996 and should not be used. The NCSC recommends that government systems upgrade to support TLS 1.3 and stop supporting these older protocol versions entirely.

RFC 10024 standardizes three post-quantum/traditional hybrid key agreement mechanisms for TLS 1.3. These mechanisms combine the post-quantum ML-KEM algorithm with traditional elliptic curve algorithms. The NCSC considers all three suitable for protecting personal, enterprise, and OFFICIAL-tier government information, recommending hybrid schemes as an interim measure during migration.

Affected Systems and Future Standards

A cryptographically relevant quantum computer would threaten current key exchange and digital signature algorithms used in TLS. The primary mitigation is migrating to post-quantum cryptography, aligning with broader NCSC advice. The IETF is developing standards for non-hybrid ML-KEM, specifically MLKEM768 and MLKEM1024, which the NCSC deems acceptable for use in TLS.

Currently, the IETF has only standardized post-quantum algorithms for key exchange. Work continues on standardizing post-quantum authentication for TLS and the wider Web PKI. Organizations with private PKIs may adopt post-quantum authentication sooner than those relying on the public Web PKI, where standardization and ecosystem adoption are ongoing.

What should you do?

Administrators should review their current TLS configurations to ensure TLS 1.3 is enabled and prioritized. They must verify that all SSL versions, TLS 1.0, and TLS 1.1 are disabled on servers and clients. Organizations should also assess their readiness to implement hybrid key exchange mechanisms as interim steps toward full post-quantum migration.

What to do and how to stay safe: NCSC

• Audit server and client configurations to ensure TLS 1.3 is enabled and preferred over older versions.
• Plan a migration path from TLS 1.2 to TLS 1.3 to prepare for post-quantum cryptography adoption.
• Monitor IETF developments for standardized post-quantum authentication and update guidance as mature implementations become available.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is TLS 1.2 still considered secure?

TLS 1.2 provides strong protection against classical attacks when configured with recommended cryptographic profiles, but it will not receive new features apart from critical security updates.

When will post-quantum authentication standards be available?

The IETF is currently working on standardizing post-quantum authentication for TLS and the wider Web PKI, with drafts at various levels of maturity; guidance will update once standards are finalized.

What should I do about SSL and older TLS versions?

You must disable all versions of SSL, as well as TLS 1.0 and TLS 1.1, because they are deprecated and considered insecure by the NCSC and IETF.