Why Chromium Deprecated TLS 1.0 and TLS 1.1 Support

The Chromium project deprecated support for Transport Layer Security (TLS) 1.0 and 1.1 to protect users from outdated cryptographic standards and severe security vulnerabilities. This article provides a straightforward examination of the technical weaknesses of these legacy protocols, the cyberattacks that exploited them, the threat of protocol downgrade attacks, and the coordinated industry-wide effort to transition the web to the much safer TLS 1.2 and TLS 1.3 standards.

Reliance on Weak Cryptography

TLS 1.0, released in 1999, and TLS 1.1, released in 2006, were designed in an era with vastly different computing capabilities. Both protocols rely heavily on the MD5 and SHA-1 hashing algorithms to verify the integrity of the connection handshake. Modern computing power has rendered both MD5 and SHA-1 cryptographically broken. Because they are vulnerable to collision attacks, well-resourced attackers can potentially impersonate servers and intercept encrypted traffic.

Vulnerability to High-Profile Exploits

Over the past decade, security researchers uncovered fundamental flaws in the way TLS 1.0 and 1.1 handle encryption. These flaws led to several notorious exploits:

  • BEAST (Browser Exploit Against SSL/TLS): Discovered in 2011, this attack exploited weaknesses in how TLS 1.0 implemented Cipher Block Chaining (CBC), allowing attackers to silently decrypt parts of the HTTPS traffic, such as session cookies.
  • CRIME and BREACH: These attacks exploited data compression features used alongside older TLS versions to recover secret authentication tokens.
  • POODLE (Padding Oracle On Downgraded Legacy Encryption): Although primarily an attack on SSL 3.0, variations of POODLE also impacted TLS 1.0 and 1.1 implementations that handled encryption padding incorrectly.

Patching these vulnerabilities required complex workarounds in the Chromium source code, which increased the risk of introducing new bugs.

Lack of Modern Cipher Suites

TLS 1.0 and 1.1 do not support modern cryptographic primitives. Specifically, they lack support for Authenticated Encryption with Associated Data (AEAD) cipher suites, such as AES-GCM and ChaCha20-Poly1305. AEAD ciphers simultaneously provide confidentiality and data integrity, preventing attackers from tampering with encrypted messages in transit. Furthermore, the older protocols poorly support Perfect Forward Secrecy (PFS), a crucial security feature that ensures recorded encrypted traffic cannot be decrypted in the future, even if the server's private key is eventually stolen.

Eliminating Downgrade Attacks

Even when a website and a browser both support modern protocols like TLS 1.3, the mere presence of TLS 1.0 and 1.1 in the browser creates a security risk. In a "downgrade attack," a man-in-the-middle attacker intercepts the initial connection attempt and tricks the browser and server into believing the other only supports TLS 1.0. Once the connection is forced down to the weaker protocol, the attacker can exploit its known vulnerabilities. By completely removing the code for TLS 1.0 and 1.1, Chromium eliminated the possibility of these downgrade attacks.

Industry Consensus and Standards Compliance

Chromium’s decision was part of a synchronized move across the entire technology sector. In October 2018, Google (representing the Chromium project), Apple, Microsoft, and Mozilla jointly announced the deprecation of TLS 1.0 and 1.1. This collective action ensured that website administrators had a unified deadline to upgrade their servers.

Additionally, the deprecation aligned Chromium with regulatory and standards bodies. The Payment Card Industry Data Security Standard (PCI DSS) had already banned the use of TLS 1.0 for processing online payments, and the Internet Engineering Task Force (IETF)—the organization responsible for maintaining internet protocols—officially deprecated both versions in RFC 8996. By the time Chromium permanently disabled the protocols, over 99% of secure connections made by the browser were already successfully using TLS 1.2 or TLS 1.3.