Subject: Re: [TLS] signature_algorithms extension definition

From: Peter Gutmann <[email-masked]>
Date: Fri, 12 Sep 2014 13:15:20 +0000

Peter Bowen <[email-masked]> writes:

>Why do you say it is ignored?

See my previous message, when this last came up all of the implemeters who
responded said they ignored it because it made no sense and hindered
interoperability.

Peter.

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 12 Sep 2014 09:04:37 -0500

> See my previous message, when this last came up all of the implemeters
> who responded said they ignored it because it made no sense and hindered
> interoperability.

Times change, and I think Google is now forcing the issue because of their SHA1 deprecation. At least those of us who serve old and new clients need hints on which cert chains to serve.

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Fri, 12 Sep 2014 16:13:29 +0200

> Times change, and I think Google is now forcing the issue because of their SHA1 deprecation. At least those of us who serve old and new clients need hints on which cert chains to serve.

I believe that the comments were on the "MUST" requirement, and the fact
that it is ignored. Having it as a SHOULD or MAY may be a good thing, as
the servers with choice could select, but having a MUST requirement for
servers with no choice is pointless.

regards,
Nikos