Subject: Re: [TLS] signature_algorithms extension definition

From: Peter Gutmann <[email-masked]>
Date: Fri, 12 Sep 2014 14:26:07 +0000

"Salz, Rich" <[email-masked]> writes:

>Times change, and I think Google is now forcing the issue because of their
>SHA1 deprecation. At least those of us who serve old and new clients need
>hints on which cert chains to serve.

But in that case it's a hint, not a MUST.  At most it should be a MAY, along
with a note saying what its intended purpose is (in other words to clarify
that there's some intent there, rather than just "here's an arbitrary silly-
walk that you need to perform to claim compliance with the spec").  Given
without any explanation as it currently is, it just looks like a
pointless/illogical requirement that should be ignored.

Even if a client says "I only want to do SHA256", if I've only got a SHA1 cert
I'm going to go ahead and serve that because it's better than the alternative,
which is not interoperating.  Presumably the immediate next step will be the
client reconnecting in plaintext-only because "there's a problem with the
server, TLS doesn't work".

Peter.

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 12 Sep 2014 09:55:52 -0500

> But in that case it's a hint, not a MUST.  At most it should be a MAY, along

Sure, I'm fine with that. 
--  
Principal Security Engineer, Akamai Technologies
IM: [email-masked] Twitter: RichSalz