Re: [TLS] Case for negotiation of PKCS#1.5 RSASSA-PKCS1-v1_5 in TLS 1.3

[Benjamin Kaduk <[e-mail]>]

On 01/22/2016 01:14 PM, Hubert Kario wrote:
> On Friday 22 January 2016 10:39:26 Andrey Jivsov wrote:
>> On 01/22/2016 03:14 AM, Hubert Kario wrote:
>>>> The only solution that's available at this point is conditioning
>>>> TLS
>>>> 1.3 support on appropriate hardware. For this reason TLS 1.3 it
>>>> probably won't be enabled by default in the product I work on. I
>>>> would prefer for TLS 1.3 to be enabled by default and write the
>>>> code
>>>> to decide whether it does PSS or falls back to RSA PKCS1 1.5.
>>> Yes, it would be nice. But PKCS#1 v1.5 had it long coming. Not
>>> cutting it off now would be negligent.
>> You mean for HS only, while leaving it for X.509 certs?
> If we don't do it for HS in TLS first, we'll never get rid of it in 
> X.509 certs.
>
> We need to start somewhere, and it's more reasonable to expect that 
> hardware with support for new protocols will get updated for RSA-PSS 
> handling than that libraries and hardware will suddenly start 
> implementing it in droves just in anticipation of the time when CAs 
> _maybe_ will start issuing certificates signed with RSA-PSS.
>
>

Isn't it more a matter of TLS being a consumer of external PKIX
infrastructure, the web PKI, etc.?  They are out of the reach of the
IETF TLS working group; any requirements we attempted to impose would be
unenforceable, even if there was an Internet Police (which there is not).

-Ben