Re: [TLS] Deprecate SHA1 for signatures in TLS 1.3 (was Re: TLS 1.3 draft-07 sneak peek)

[Dave Garrett <[e-mail]>]

Ok, revised:

========================================
If the client provided a "signature_algorithms" extension, then all
certificates provided by the server SHOULD be signed by a hash/signature
algorithm pair indicated by the extension (or defaults assumed in its
absence). If the server cannot produce a valid certificate chain using
these known supported pairs, then it SHOULD send the client a complete
valid chain which attempts to match known support where possible, yet
including certificates that are not known to be supported. If the
client cannot build a trusted chain using these certificates and any
other trusted information it has access to, then it MUST send an
"unsupported_certificate" alert message and close the connection.
========================================

Comments?

Note that for the purposes of discussion here, opportunistic encryption can "trust" whatever it wants; anything or nothing, depending on implemented strategy.


Dave