Re: [TLS] TLS v1.2 performance (was Re: TLSv1.2 with DSA client

[Matt DeMoss <[e-mail]>]

On Fri, Mar 4, 2011 at 6:41 PM, Martin Rex <[e-mail]> wrote:


>
> The TLS spec should not mess around with PKI and X.509 issues.
> Negotiation of the algorithm used for the "digitally signed" struct
> ought to be _completely_ seperate from characteristics of certificates.
>
> A TLS extension to convey hints about digital signature algorithms
> ought to be a fairly black box to TLS, containing a list of
> ASN.1 AlgIds, and with the semantic of a "hint to the PKI software
> for selecting the most appropriate certificates", i.e. "MAY" not "MUST".
>

This is interesting to me; as a kind of thought experiment do you
think it would ever be appropriate for TLS to negotiate hash
algorithms on CRLs or on OCSP responses? It seems unlikely that
multiple CRLs will be generated with different hashes and that is only
slightly less true for X.509 certs.

Does it make more sense for TLS to instead negotiate the version of
X.509 (or PKIX profile, or other credential) in use and hope some
future version will provide functionality for a smoother transition? I
read RFC 5280 to say there can only be one signature per certificate,
but it isn't hard to imagine having doubly signed certificates in the
future.