Re: [TLS] Explicit error expectations (was Re: Deprecate SHA1 for signatures in TLS 1.3)

[Ilari Liusvaara <[e-mail]>]

On Sat, Jul 11, 2015 at 02:44:58AM -0400, Dave Garrett wrote:
> On Saturday, July 11, 2015 01:09:11 am Viktor Dukhovni wrote:
> 
> > The decision of whether the chain is or is not
> > supported by the client MUST be left to the client.  The server
> > does not have sufficient information to make this decision unilaterally
> > (even if knows all the signature algorithms the client appears to
> > support).
> 
> Just an idea, but maybe a way for the client to state that desire
> should be added? Maybe add "any(255)" values to the enums so clients
> could request, e.g. {any,rsa}+{any,ecdsa} or {any,any}, etc.? (there
> might be a better way to do this, though)

It is not about clients that can process any hash or signature
algorithm, it is about if chain processing will terminate (reached
"trust anchor") before the client runs into the unsupported hash/
signature and chokes.

And that trust anchor might even be the public key in the end-
entity certificate, which would cause every signature except the
one EE public key itself makes[1] to be skipped (so even if
the EE cert itself was signed by Foo/Bar, both of which are
unknown to client, it would still work).


[1] Obviously the client must know the signature algorithm
the key uses or things just plain won't work. Additionally
if the key forces hash algorithm (at least some CFRG signature
proposals work that way), that hash needs to be known too.


-Ilari