Subject: [TLS] signature-algorithms extension in ServerHello

From: Xuelei Fan <[email-masked]>
Date: Thu, 30 Sep 2010 10:25:58 +0800

Hi,

In the end of section 7.4.1.4.1, RFC5246 (TLS 1.2), it says that
    Servers MUST NOT send this extension. ...
    When performing session resumption, this extension is not included
in Server Hello, and the server ignores the extension in Client Hello
(if present).

"this extension is not included in Server Hello" is a little confusing
to me. No matter full handshake or session resumption, this extension
MUST NOT be included in the ServerHello message, right?

And I don't think it is a type of "this extension is not included in
Client Hello", because when requesting a session resumption, a client
normally cannot expect whether the server will do a full handshake or a
abbreviated handshake, so the client need to always include this
extension in ClientHello for the preference signature algorithms.
Otherwise, the server may be able  to response with a full handshake and
use not-that-strong algorithms, such as (sha1, rsa), while the client
may only want to SHA-2 hash functions.

Thanks,
Xuelei Fan

---

From: Michael D'Errico <[email-masked]>
Date: Wed, 29 Sep 2010 23:49:51 -0700

A client should always include the signature-algorithms extension in
the ClientHello, whether it is attempting to resume a session or not
for the reasons you stated.

The spec forbids a server from ever including it in the ServerHello.

The wording you quoted is just trying to emphasize that it is not
included when a session is resumed.  This is a requirement given in
section 7.4.1.4:

    In general, the specification of each extension type needs to
    describe the effect of the extension both during full handshake and
    session resumption....

Mike

---

From: Xuelei Fan <[email-masked]>
Date: Thu, 30 Sep 2010 19:26:42 +0800

Thanks for the clarification.

Xuelei