DCMTK

With DICOM supplement 230 (in public comment as of July 2022), all existing TLS profiles will be retired and replaced by two new TLS profiles:

• BCP 195 RFC 8996 TLS Secure Transport Connection Profile
• Extended BCP 195 RFC 8996 TLS Secure Transport Connection Profile

This will require implementation of the new profiles in the dcmtls module and appropriate command line options in all command line tools that support TLS.

The difference between the current "Non-Downgrading BCP 195 TLS Secure Transport Connection Profile" and the new "BCP 195 RFC 8996 TLS Secure Transport Connection Profile" seem to be very small. It seems that the only differences are that TLS 1.3 must now be preferred over TLS 1.2 when both are available (which we do anyway), and that additional ciphersuites may only be supported if they are of similar or greater strength than the four default ones. (Note that this analysis is based on the public comment version, not the final text)

The differences between the two Extended profiles have to be analyzed in more detail.