Re: [TLS] DSS with other than SHA-1 algorithms

[Peter Gutmann <[e-mail]>]

=?ISO-8859-1?Q?Juho_V=E4h=E4-Herttua?= <[e-mail]> writes:

>I think the deployment is very small on the server side, but I would say it
>is quite common on the client side. I know at least Firefox has had ECC
>cipher suites enabled by default for quite a long time (3 years or so), and I
>think that attributes to somewhere close to one third of all browsers
>globally. (according to Mozilla more than 350 million users) Calling TLS-ECC
>deployment vanishingly small is a bit of an understatement, don't you think?

"Implemented in the client" != "used" though.  The only hard data that we have
at the moment, the SSL Observatory, indicates:

Number of deployed DSA TLS servers with certs chaining to a trusted root: 25
Number "  " ECC  "  "  ": Zero
Number "  " RSA  "  "  ": Millions

For non-trusted certs I think there were a total of six servers doing ECC in
the entire world, and I'm guessing most or even all of them are the small
number of public interop servers out there.

Both of those make it "vanishingly small" (at least for public deployment) as
far as I'm concerned :-).

>That's exactly the parts of the draft I am referring to. This should be
>combined with the RFC 5246 text:
>
>    If the client does not send the signature_algorithms extension, the
>    server MUST do the following:
>...
>    -  If the negotiated key exchange algorithm is one of (ECDH_ECDSA,
>       ECDHE_ECDSA), behave as if the client had sent value {sha1,ecdsa}.
>
>Your draft does not mandate sending the signature_algorithms extension, but
>at the same time it does say one should use the SHA256 or SHA386 for
>signatures. Does it override the above clause of TLS 1.2 or does it implicate
>signature_algorithms have to be always sent in case any of those cipher
>suites are to be offered?

Ah, I see what you mean.  OK, I'll add a note to address this.  RFC 5246
assumes the universal-substrate SHA1 if you forget the signature_algorithms
extension as a means of handling the lack of an explicit indication since
there's no other way to tell what to use, but the ECC-suites draft makes it
explicit what hash to use so there's no need to use the fall-back rules.

>That explains it much better, I tried to google it before but didn't really
>get any sensible results. Looks like searching for "chinese menu column" gives
>more hits,

I've added a note to explain it for non-US readers.  If you search for "one
from column A one from column B" you'll get an awful lot of hits, things
like medical papers using that in the title:

http://www.ncbi.nlm.nih.gov/pubmed/11827830

The search term "Chinese menu" gets overwhelmed by links to restaurants.

Peter.