Re: [TLS] draft-gutmann-tls-eccsuites

[[e-mail] (Martin Rex)]

Hubert Kario wrote:
> 
> Unrelated to the above:
> The draft specifies few TLS1.1-and-lower compatible cipher suites, e.g.:
> TLS_ECDHE_ECDSA_P256_SHA256_WITH_AES_128_CBC_SHA
> My understanding is that you can't use anything but concatenation of MD5|SHA1
> for signing the key exchange with TLS1.1-and-lower. Am I missing something
> or does it apply only the hash used for digital signatures in certificates?

The concatenation of MD5|SHA1 applies only to RSA-signatures
(in digitally signed PKCS#1 v1.5 (block type 2?)) in TLSv1.1 and earlier.

For (EC)DSA, it is traditionally SHA1-only (r+s integers).
But there is a general rule about acceptable hash algorithms for
use with (EC)DSA keypairs, and the key parameters are normally
chosen in a fashion that implies a minimum length of the hash output
(either SHA-1 or one of the SHA-2 algorithms).  rfc4492 says that
the hash could be something other than SHA-1, which I would read as
use the minimum hash length as implied by the (EC)DSA key parameters.


-Martin