Re: [TLS] TLS 1.3 draft-07 sneak peek

[Karthikeyan Bhargavan <[e-mail]>]

Putting aside the timeline for retiring SHA-1 from certificates, which will happen
sooner than later, I think we should ban MD5 and SHA1 from client and server 
signatures in TLS 1.3. 

Recent events show that TLS servers get updated too slowly to hope
for graceful deprecation. Using the version change to remove these 
(like we removed RSA encryption and RC4) would be right thing to do

-Karthik

> On 07 Jul 2015, at 10:34, Ilari Liusvaara <[e-mail]> wrote:
> 
> On Fri, Jul 03, 2015 at 07:25:04PM -0400, Dave Garrett wrote:
>> On Friday, July 03, 2015 07:13:15 pm Eric Rescorla wrote:
>>> I think we probably need to have WG consensus for the SHA-1 thing.
>> 
>> Yes, that's why I left it out of that changeset. I don't think the
>> topic of what to do in the TLS 1.3 spec with SHA1 has been discussed
>> on this list. (if it has, please point me to the thread if someone
>> can)
>> 
>> The simplest thing would be to have a MUST NOT offer or negotiate
>> in 2017 or later and a NOT RECOMMENDED to use until then. Or, we
>> could go deeper into the weeds and talk about expiration dates.
>> Banning it totally for TLS 1.3+ is also an option, but probably not
>> wanted yet.
> 
> No, the simplest thing would be to ban it entierely:
> - MUST ignore entries with MD5 or SHA1 hash in
>  supported_signature_algorithms, even if those are the only
>  ones (which will cause handshake failure).
> - MUST terminate connection with insufficient_security if MD5 or
>  SHA1 is seen in DigitallySigned.algorithm.
> 
> SHA-1 is known to be seriously broken. That is way more than
> enough reason to completely remove it. Especially from new
> standards.
> 
> 
> If one wants those to also apply to TLS 1.2, plus:
> - MUST send signature_algorithms extension in TLS 1.2+,
>  server MUST terminate connections without it.
> - MUST NOT send MD5 or SHA1 entries in
>  supported_signature_algorithms.
> 
> Effective immeidately for MD5, and in 1.1.2017 for SHA1
> (including signature_algorithms) is separate matter
> (and separate draft).
> 
> 
> 
> -Ilari
> 
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls