Re: [TLS] Deprecate SHA1 for signatures in TLS 1.3 (was Re: TLS 1.3 draft-07 sneak peek)

[Dave Garrett <[e-mail]>]

On Tuesday, July 07, 2015 01:45:25 pm Eric Rescorla wrote:
> http://tlswg.github.io/tls13-spec/#server-certificate:
> If the client provided a “signature_algorithms” extension, then all
> certificates provided by the server MUST be signed by a hash/signature
> algorithm pair that appears in that extension. Note that this implies that
> a certificate containing a key for one signature algorithm MAY be signed
> using a different signature algorithm (for instance, an RSA key signed with
> a DSA key).
>
> So if you can't express SHA1 in signature_algorithms, then the server can't
> send you a certificate signed with SHA-1.

Hmm... well, we could state a special case that SHA-1 within some restricted use-case is permitted in certs, but this could quickly become messy. Just axing it all would be better, but yeah, that's a larger change than originally intended.


Dave