3 ms·

I haven't found any real implementations to test (I'd like to). But it seems Fortinet is making bold claims that, on the surface, feel like lip service thus far

I haven't found any real implementations to test (I'd like to). But it seems Fortinet is making bold claims that, on the surface, feel like lip service thus far: https://www.fortinet.com/blog/business-and-technology/tls-is-here-what-this-means-for-you.html https://www.fortinet.com/blog/business-and-technology/tls-is... Keep in mind this is just TLS1.3 and they make no claims around IETF QUIC / HTTP/3.

tialaramex 8y ago
They say > The good news for Fortinet customers is FortiOS 6.2 fully supports TLS 1.3 for effective and high-performance MITM inspection. and in contrast > The latest version of FortiOS 6.0 not only fully supports TLS 1.2 MITM, but it also does not break TLS 1.3 when it has to negotiate down to TLS 1.2. [ The "break TLS 1.3" they're talking about is the phenomenon I described in a cousin post in this thread, several of their competitors screwed up here ] So that suggests that in Fortinet's case products running their 6.2 release (it's unclear to me if this is merely in Beta or actually a finished product) will actually do TLS 1.3. It's sad that they feel they can boast about the earlier 6.0 product actually working correctly (compatibility with TLS 1.3 by downgrading to TLS 1.2 is literally how everything would work if you just correctly implemented the specification, yet) when it was released in 2018, many years after the TLS 1.2 specification was finalised and in wide use. Still you know "Better late than never".
- windexh8er 8y ago
  I read the article as they were fully supporting it through downgrade. Then again, as you noted, 6.2 doesn't appear to be out... So more lip service by these network security vendors. I think the most interesting marketing aspect of this is they never claim the methods they often use to meet performance claims is by weakening overall security. Hypocrisy at it's best.

tialaramex 8y ago

They say > The good news for Fortinet customers is FortiOS 6.2 fully supports TLS 1.3 for effective and high-performance MITM inspection. and in contrast > The latest version of FortiOS 6.0 not only fully supports TLS 1.2 MITM, but it also does not break TLS 1.3 when it has to negotiate down to TLS 1.2. [ The "break TLS 1.3" they're talking about is the phenomenon I described in a cousin post in this thread, several of their competitors screwed up here ] So that suggests that in Fortinet's case products running their 6.2 release (it's unclear to me if this is merely in Beta or actually a finished product) will actually do TLS 1.3. It's sad that they feel they can boast about the earlier 6.0 product actually working correctly (compatibility with TLS 1.3 by downgrading to TLS 1.2 is literally how everything would work if you just correctly implemented the specification, yet) when it was released in 2018, many years after the TLS 1.2 specification was finalised and in wide use. Still you know "Better late than never".

windexh8er 8y ago
I read the article as they were fully supporting it through downgrade. Then again, as you noted, 6.2 doesn't appear to be out... So more lip service by these network security vendors. I think the most interesting marketing aspect of this is they never claim the methods they often use to meet performance claims is by weakening overall security. Hypocrisy at it's best.