Re: [TLS] DSS with other than SHA-1 algorithms

[Martin Rex <[e-mail]>]

Peter Gutmann wrote:
> 
> Nikos Mavrogiannopoulos <[e-mail]> writes:
> >
> > According to me this study would be an argument for the _RSA ecc
> > ciphersuites rather than the ECDSA.
> 
> Why?  The draft contains the combinations of parameters and options that
> everything seems to support and everything seems to get right.  Why the
> obsession with _RSA?
> 
> (Note, if you can document support for, and interoperability among,
>  Microsoft, NSS, OpenSSL, and one or two other implementations,
>  for _RSA, I'll be happy to add it).
> 
> To reiterate this yet again, the draft collects in one place the various
> combinations of parameters and options that everything I could find supports
> and handles correctly.  What it doesn't contain is speculative options that
> may or may not work and may or may not be supported.  It is an attempt to
> document the status quo and point out the best options to use in order to
> maximise interoperability.


I think it is worth considering to describe an interoperable set of
_RSA based EC ciphersuites and parameters.

In case that there are, in fact, interop problems with the existing
definitions in the installed base, TLS WG should try to figure out
the kind of problems that exist in the installed base and
try to come up with solutions for these interop problems.

Possible solutions for interop problems with _RSA cipher suites might be:

  - describe workarounds to deal with the problem within the currently
    defined protocol options.

  - modify the existing (TLS extension) definition (in a backwards-compatible
    fashion, of course) to overcome the problem

  - add a new extension

  - define new cipher suite codepoints to represent the intended purpose
    and interop-test _before_ shipping implementations this time around


-Martin