Re: [TLS] Summary of discussion regarding spontaneuous authentication

[Ilari Liusvaara <[e-mail]>]

On Wed, Oct 22, 2014 at 06:08:17AM -0700, Martin Thomson wrote:
> On 22 October 2014 05:53, Ilari Liusvaara <[e-mail]> wrote:
> >
> > CertificateRequest has fields certificate_types and
> > supported_signature_algorithms (there's also third field, but IMO
> > that's better sent at application level). Where is the equivalent
> > data put?
> 
> At the application layer.
> 
> These fields, as specified, are not particularly useful in the general
> sense.  The suggestion was that these are not valuable:
> certificate_types is pretty much either known a priori (or assumed to
> be X.509) and signatures have a similarly limited set of options.

Don't confuse certificate_types with {client,server}_certificate_type{,s}.

The relevant values of certificate_types look to be:
- rsa_sign (RSA signature)
- dss_sign (DSA signature)
- ecdsa_sign (ECDSA signature)

(There are some others, but all are either RESERVED or obviously
incompatible with TLS 1.3).


supported_signature_algorithms looks to be supported combinations
of signature (RSA/DSA/ECDSA) and hash.


Especially supported_signature_algorithms looks to belong to TLS
layer (and also arguably certificate_types).


Now, the "third field" was certificate_authorities. Now that is
better sent on application layer.


-Ilari