TLS 1.3 - Windows 10: enabled by default

Microsoft announced this week that activated the TLS 1.3, the latest version of the security protocol, in the latest versions of Windows 10 starting from build 20170.

The company states that TLS 1.3 is enabled by default in IIS / HTTP.SYS and that for old Microsoft Edge and the Internet Explorer administrators should enable it from Internet options in the Advanced section.

The new Microsoft Edge supports TLS 1.3 without additional settings according to Microsoft.

Its activation TLS 1.3 in recent editions of Windows 10 is the first step towards the wider adoption of the Security Protocol in Windows 10. The company has not revealed when it intends to activate it in its fixed versions Windows 10.

It is probably unlikely that we will see it enabled TLS 1.3 in the next feature update Windows 10 of version 20H2. The new protocol will probably be released for everyone with the 21H1 version of Windows 10, the first update of possibilities next year. This will coincide with their deactivation TLS 1.0 and 1.1 that Microsoft announced would not take place before Spring 2021.

The TLS 1.0 and TLS 1.1 will not be disabled by default for any of the company's browsers until Spring 2021 at the earliest. Companies wishing to disable it TLS 1.0 and TLS 1.1 before this date can do so using Group Policy.

The TLS 1.3 promises better security and performance than older protocols. Microsoft advises developers to start trying it out TLS 1.3 in their applications and services as soon as possible. The Windows 10 will support three cipher suites to reduce complexity and guarantee "specific security properties".

The supported cipher suites are:

• TLS_AES_128_GCM_SHA256
• TLS_AES_256_GCM_SHA384
• TLS_CHACHA20_POLY1305_SHA256

The third cipher is not enabled by default.

The protocol allows encryption earlier in the handshake, which provides greater security, preventing intrusion by malicious users. The TLS 1.3 the client certificate is encrypted, therefore the client identity (client identity) remains private and no renegotiation is required for secure client authentication.