Subject: DSA/SHA-1, and OIDs

From: Eric Rescorla <[email-masked]>
Date: Mon, 12 Nov 2007 11:12:23 -0800

Hi PKIX guys,

As you probably know, in some modes of TLS one or the other party
signs data. In some cases, this presumably means DSA. This is 
fine if you can guarantee that you are going to use SHA-1 with
DSA, but obviously there's going to be a desire to transition
to SHA-256, which raises the issue of digest substitution.

My understanding of the current thinking on how to prevent this
is to indicate in the certificate which digest algorithm is to
be used with the cert. So, the rule we plan to promulgate in TLS
is: 

	OID 1 2 840 10040 4 1 MUST only be used with SHA-1.  Future
	revisions of [PKIX] MAY define new object identifiers for DSA
	with other hash algorithms.

I wanted to check that this is compatible with the current PKIX
thinking.

Thanks,
-Ekr