Subject: RE: [TLS] Will CAs decide server signing algorithms in TLS 1.2?

From: <[email-masked]>
Date: Fri, 4 May 2007 15:33:47 +0300

Hi Simon,

This issue was discussed in Prague, and I think the conclusion
was that the current text needs to be changed. In other words:
if the client tells it supports RSA+SHA256, the server can
use it even if the CA used RSA+SHA1 to sign the server cert
(unless the certificate has an extension or something 
explicitly prohibits it -- there's some work in PKIX that
may be relevant).

Best regards,
Pasi

> -----Original Message-----
> From: ext Simon Josefsson [mailto:[email-masked]] 
> Sent: 25 April, 2007 14:58
> To: [email-masked]
> Subject: [TLS] Will CAs decide server signing algorithms in TLS 1.2?
> 
> The Signature structure has changed, and the current text in section
> 7.4.3 says:
> 
>    If the SignatureAlgorithm being used to sign the ServerKeyExchange
>    message is DSA, the hash function used MUST be SHA-1. If the
>    SignatureAlgorithm it must be the same hash function used in the
>                      ^^^^^^^^^^^^^^^^
>    signature of the server's certificate (found in the Certificate)
>    message. This algorithm is denoted Hash below. Hash.length is the
>    length of the output of that algorithm.
> 
> I can't parse the second sentence here.  What is the intention here?
> 
> I'm assuming that the intention is to say that the SignatureAlgorithm
> must be the same as the signing algorithm in the server certificate.
>
> It seems weird that the CA who signs the server certificate will
> implicitly decide which signature algorithm is used inside TLS 
> between all servers and clients.
<snip>

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: "Wan-Teh Chang" <[email-masked]>
Date: Fri, 4 May 2007 08:28:32 -0700

> use it even if the CA used RSA+SHA1 to sign the server cert

How does the client tells the server that it supports RSA+SHA256?
By overloading the "Cert Hash Types" hello extension or adding a
new extension specifically for this purpose?

There is a corresponding issue for the client's signature in the
CertificateVerify message.

Another related issue is the longer DSA variants defined in Draft
FIPS 186-3, which aren't hardcoded to use SHA-1.

Wan-Teh