Re: [TLS] TLS v1.2 performance (was Re: TLSv1.2 with DSA client

[Michael D'Errico <[e-mail]>]

Juho Vähä-Herttua wrote:
> On 19.2.2011, at 3.06, Michael D'Errico wrote:
>> The point of the signature_algorithms extension is to permit a graceful
>> upgrade of server certificates to using better than SHA-1 hash functions.
>> You couldn't just suddenly switch your server cert to one signed with
>> RSA/SHA-256 and expect every client to cope.  It would certainly cause
>> problems for some.
>>
>> To benefit from the extension, you would need to have two concurrent
>> server certificates: one signed with RSA/SHA-1, and another signed with
>> RSA/SHA-256.  Then based on the signature algorithms presented by the
>> client, your TLS code would choose the best one.
> 
> Yes, but even in this case I think it would make much more sense to have the requirement as SHOULD and not MUST. Because if all the server has is RSA/SHA-1 and the client is requesting RSA/SHA-256, I think it's much better that the server will continue with RSA/SHA-1 and then the client can fail if it doesn't like it. How does your implementation work by the way if the requested SHA/SHA-256 is not found? I expect you have a client implementation as well, does it check that all the server certificate signatures match the signature_algorithms extension sent in ClientHello and fail if not?

Originally I made the server lenient; if there was no suitable certificate
chain, then it would choose the "best" match and hope the client would
accept it.

But then I got a bug report from someone who suggested that the server
should abort the handshake if there isn't a perfect match.  Initially I
disagreed, but their logic makes sense: if the client was willing to
accept a certificate signed with RSA/SHA-1, then it would have included
that algorithm in the list.  Since it didn't (and in this case the client
only wanted ECDSA certificates which I don't support yet), it was causing
the client trouble.

I'm pretty sure my client code is still lenient, but it's been a while
since I looked at that part of it.

Mike




> I think it's ok to use signature_algorithms as a recommended list of algorithms and then fall back to locally configured preference if that is not found, worst case is that the handshake fails, but it would fail anyway if no suitable certificate is found... 
> 
> 
> Juho
>