Re: [TLS] Deprecate SHA1 for signatures in TLS 1.3 (was Re: TLS 1.3 draft-07 sneak peek)

[[e-mail] (Martin Rex)]

Dave Garrett wrote:
> Martin Rex wrote:
>> Unfortunately, a non-marginal installed base is exhibiting this self-imposed
>> (mis)behaviour of connection failure: Microsoft SChannel beginning 
>> with Windows 7 / 2008R2 (aka WinNT 6.1), and Windows 8 / 2012 and
>> Windows 8.1 / 2012R2 exhibit the same (mis)behaviour.
>> 
>> When you install a server certificate with a sha256WithRsaEncryption signature
>> on a Microsoft IIS on one of these platforms, enable TLSv1.2 on the server
>> and try to connect with an extension-free ClientHello that offers
>> client_version= (3,3), you will face a connection failure (IIS simply closes
>> the network connection--IIS is notorious in failing to put fatal alerts
>> on the wire).
>> 
>> The handshake succeeds (with TLSv1.1) if the client offers at most TLSv1.1,
>> or if the client offers TLSv1.2 in a SSL Version2 CLIENT-HELLO rather than
>> an extensionless TLS ClientHello, if TLSv1.2 is disabled on IIS, or if
>> a server certificate with only sha1WithRsaEncryption ist used.
> 
> To clarify, how does this scenario respond with a TLS 1.2 ClientHello
> with at least one extension? Does it matter what extension(s)?
> (e.g. does IIS have to know what it is?)


The issue here is the (lack of the) TLSv1.2 signature_algorithms extension.

Windows SChannel appears to treat the absence of this extension
the same as the presence of an extension with (md5,rsa) (sha1,rsa) (sha1,dsa)

If you send the TLSv1.2 signature_algorithms extension with the
algorithm matching the signature of the server certificate,
e.g. (sha256,rsa) in the above example, then a TLSv1.2 handshake will succeed.


Correcting a slight inaccuracy above:  when the server certificate is signed
with sha1WithRsaEncryption, the handshake will succeed with TLSv1.2.

When an SSLv2 ClientHello offering TLSv1.2 is sent, the TLS handshake
will succeed independent of the signature on the IIS server certificate,
but the server will pick only TLSv1.1 rather than TLSv1.2.


-Martin