Re: [TLS] Deprecate SHA1 for signatures in TLS 1.3 (was Re: TLS 1.3 draft-07 sneak peek)

[Viktor Dukhovni <[e-mail]>]

On Fri, Jul 10, 2015 at 06:17:05PM +0200, Martin Rex wrote:

> Was TLSv1.2 really meant to be backwards-incompatible to TLSv1.0 and TLSv1.1
> and create new problems for the migration from sha1-signed server certs
> to sha256-signed server certificates, considering that sha1-signed certs
> had already been officially been deprecated (e.g. by NIST) more than a
> year before TLSv1.2 (rfc5246) was published.

Martin, I think that focusing on a fine-grained scholarly analysis
of the specification is a distraction.  Even if the specification
unequivocally requires servers to do as Schannel does (and there
is some evidence that it does even if not univerally convincing),
the specification is wrong.

There are many situations where the server has little choice of
what chains it can present, and the client is perfectly happy with
chains that bear signatures it does not recognize.

There is no reason for the server to abort the handshake on the
unjustified presumption that the chains it has are unacceptable to
the client.  

Lawyering the RFCs is not worth the effort, concede the law
and go for jury nullification.

-- 
	Viktor.