Re: [TLS] which alert for TLS client cert w/o keyUsage digitalSignature

[[e-mail] (Martin Rex)]

Rob Stradling wrote:
> On 19/09/13 18:01, Michael D'Errico wrote:
> >>> Wan-Teh Chang wrote:
> >>>> Note: I don't understand why RFC 4492 says "It MUST be signed with
> >>>> RSA."
> <snip>
> > Page 47 of RFC 5246 hints at these rules:
> <snip>
> 
> RFC 5246 relaxes the "It MUST be signed with RSA" rule, doesn't it?
> 
> Appendix A.7 (Changes to RFC 4492) says:
>    "As described in Sections 7.4.2 and 7.4.6, the restrictions on the
>     signature algorithms used to sign certificates are no longer tied to
>     the cipher suite (when used by the server) or the
>     ClientCertificateType (when used by the client).  Thus, the
>     restrictions on the algorithm used to sign certificates specified in
>     Sections 2 and 3 of RFC 4492 are also relaxed."
 

Not really.  Actually, it makes things worse,

because rather than the "hidden" backwards-incompatible self-imposed
limitiation from TLSv1.0, rfc5246 now contains a very explicit limitation
to those algorithms negotiated by the signature algorithms TLS extension,
and stupidly asks TLS implementations to enforce this for the entire
certificate chain up to the root.  In TLSv1.0 this limitiation, for
anyone who actually noticed it, was clearly limited to the signature
algorithm on the EE cert itself, but not signature algorithms of
any intermediate and cross-CA certificates further up the chain.


-Martin