Re: [TLS] TLS 1.2 clarification requested

[Yoav Nir <[e-mail]>]

On Oct 2, 2013, at 12:42 PM, Johannes Merkle <[e-mail]> wrote:

> 
>> Yes. According to sections 2.2 and 2.4 or RFC 4492, the server certificate for ECDHE_ECDSA and ECDHE_RSA MUST have ECDSA and RSA public keys respectively, and also MUST be signed by ECDSA and RSA respectively. I'm not sure why that last restriction is needed, but it's there. For non-EC ciphersuites, there is no restriction, but you still need to negotiate an algorithm that works with the public key.
>> 
> 
> As you noted in your other post, RFC 5246 relaxes this restriction. And you don't have to go down until appendix A.7, it
> is clearly stated in Section 4.2
> 
> Note
>   that this implies that a certificate containing a key for one
>   signature algorithm MAY be signed using a different signature
>   algorithm (for instance, an RSA key signed with a DSA key).
> 
> Appendix A.7 only points out that this changes the rules of RFC 4492.
> 

And that also means that such certificates are OK for TLS 1.2, but not for TLS 1.0 or 1.1.

Yoav