[TLS] Signature Algorithms

["Mehner, Carl" <[e-mail]>]

>I believe we are going to remove this entire field and its associated
>code points because it is redundant with the signature algorithms.
sounds good.

Speaking of Signature Algorithms, what do you think of this?


Since root certificates are trusted by their identity rather than the signature I think that amendments to the text in the Server Certificates and Certificate Request sections are necessary.

As we move into a world that lacks trusted SHA-1 signatures, a change in the text would be necessary in order for clients that drop SHA-1 from the supported hash algorithms to continue to connect to servers that send a certificate_list that includes roots signed with SHA-1.

This has been an issue recently with a browser that did not include the MD2 signature algorithm in this client extension. When it encountered a certificate that sends the root in the certificate_list, the client closes the connection (likely before evaluating if there was an alternate trusted chain). I can see this being an issue in the future with the SHA-1 2048-bit roots.

In the Server Certificates section:
OLD:

If the client provided a "signature_algorithms" extension, then all
   certificates provided by the server MUST be signed by a
   hash/signature algorithm pair that appears in that extension.  Note
   that this implies that a certificate containing a key for one
   signature algorithm MAY be signed using a different signature
   algorithm (for instance, an RSA key signed with a DSA key).  This is
   a departure from TLS 1.1, which required that the algorithms be the
   same.

NEW:

If the client provided a "signature_algorithms" extension, then all
   certificates provided by the server, except for the self-signed
   root CA certificate, MUST be signed by a hash/signature algorithm
   pair that appears in that extension.  Note that this implies that
   a certificate containing a key for one signature algorithm MAY be
   signed using a different signature algorithm (for instance, an
   RSA key signed with a DSA key). This is a departure from TLS 1.2,
   which required that all provided certificate signature algorithms
   be included in the client extension regardless of whether or not
   they were evaluated.

Likewise in the Certificate Request section,
OLD:
-  Any certificates provided by the client MUST be signed using a
  hash/signature algorithm pair found in
  supported_signature_algorithms.
NEW: 
-  Any certificates provided by the client, except for the
  self-signed root CA certificate, MUST be signed using a
  hash/signature algorithm pair found in
  supported_signature_algorithms.