Subject: [TLS] More flexible signature_algorithm selection for Delegated Credentials

From: Nick Sullivan <[email-masked]>
Date: Thu, 21 Nov 2019 11:54:42 +0800

tlswg,

At IETF 106, we discussed adding the ability to advertise specific
signature algorithms for use in DCs without requiring clients to have to
support these signature algorithms in leaf certificates.

Here's a PR to address this issue:
https://github.com/tlswg/tls-subcerts/pull/46

Comments welcome!
Nick

---

From: "Martin Thomson" <[email-masked]>
Date: Thu, 21 Nov 2019 13:43:22 +0800

On Thu, Nov 21, 2019, at 11:54, Nick Sullivan wrote:
> signature algorithms for use in DCs without requiring clients to have 
> to support these signature algorithms in leaf certificates.

Is the intent with supporting an empty extension to support backward compatibility?  I think that deployed implementations can probably just change to use the list so that we don't have to include this additional flexibility.  I'd prefer to always have a list.

---

From: Nick Sullivan <[email-masked]>
Date: Thu, 21 Nov 2019 15:36:52 +0800

On Thu, Nov 21, 2019 at 1:43 PM Martin Thomson <[email-masked]> wrote:

> Is the intent with supporting an empty extension to support backward
> compatibility?  I think that deployed implementations can probably just
> change to use the list so that we don't have to include this additional
> flexibility.  I'd prefer to always have a list.
>

Even simpler. Once we have a pre-allocated codepoint, the can be released
without conflict with deployed code.

>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>