Re: [TLS] TLS 1.3 draft-07 sneak peek

[Martin Thomson <[e-mail]>]

On 3 July 2015 at 10:53, Hubert Kario <[e-mail]> wrote:
> https://github.com/ekr/tls13-spec/pull/12
 [Make {sha256, xxx} the default signature algorithm extension value
when the extension is absent]

There is a problem with this, and I think that you need to highlight
that in the text.

The reason that this doesn't work particularly well, though it
probably isn't strictly problematic, is that now you have an extension
that means one thing {sha1, rsa} when you negotiate TLS <= 1.2 and
another thing {sha256, rsa} when you negotiate TLS 1.3.  Maybe that's
OK, but it narrows the utility of having a default.

Please add the following (or similar):
A TLS 1.3 client that is willing to do TLS <= 1.2 MUST include the
extension unless it supports SHA-256 for TLS 1.3 and SHA-1 for TLS <=
1.2.