Re: [TLS] TLS 1.3 certificate delegation?

[[e-mail] (Martin Rex)]

Johannes Merkle wrote:
> 
> >>
> >> FWIW, there's precedent for using new TLS versions to expand the set
> >> of allowable certificates.  If I"m reading it correctly, TLS 1.2
> >> allows ECDSA certificates that are signed with RSA; TLS 1.1 and below
> >> will reject those.
> > 
> > TLSv1.1 will certainly not reject those.
> > It is only rfc4492 that incorrectly alleges that those should be rejected.
> 
> I think you are wrong: Section 7.4.2 of RFC 4346 states
> 
>                               Unless otherwise specified, the signing
>       algorithm for the certificate MUST be the same as the algorithm
>       for the certificate key.

The history of this obvious defect starts in rfc2246.

There exists no such artificial limitation in SSLv3, and when I looked
at implementations I've been using for interop testing a few
years ago (Microsoft SChannel, OpenSSL, Firefox), they would
happily interoperate with an RSA server cert signed by a CA with a
DSA key.  To me it looks like most implementors were either not
aware of this bogus, backwards-incompatible requirement,
or they applied common sense and deliberately ignored it.

One can not "violate" rfc2119 Section 6 more than with the above
statement, so it is null and void.

Not only is this method "must be the same algorithm" not required
for interop, it is the the worst possible way to impair interop
without a cause.


-Martin