Re: [TLS] Draft 18 certificate signature algorithm requirements

[Viktor Dukhovni <[e-mail]>]

> On Nov 30, 2016, at 10:51 PM, Eric Rescorla <[e-mail]> wrote:
> 
> 
> 
> On Wed, Nov 30, 2016 at 9:50 PM, Viktor Dukhovni <[e-mail]> wrote:
> 
> The current text reads:
> 
>    Section 4.4.1.2 ( https://tools.ietf.org/html/draft-ietf-tls-tls13-18#page-56 )
> 
>    All certificates provided by the server MUST be signed by a signature
>    algorithm that appears in the "signature_algorithms" extension
>    provided by the client, if they are able to provide such a chain (see
>    Section 4.2.3).  Certificates that are self-signed or certificates
>    that are expected to be trust anchors are not validated as part of
>    the chain and therefore MAY be signed with any algorithm.
> 
> [...]
> 
> It's "MUST if... ". That's different from SHOULD unless because it
> means that the unless clause is that only reason for violating it, and then
> if that condition obtains it SHOULD do X but could presumably do
> other things.

Yes, I see.  The stretch of text between the "MUST" and the "if" just happened
to overflow my stack limit when I was rereading this today...  Please pardon
the short attention span.  So all is well, unless there is merit it trying
to word-smith the text to bring the "MUST" and "if" closer together....

The good new is that the intent is already just right.

> I don't see any difference between "MUST whenever possible"
> and the current language.

Yes, fair enough...

> On a related note, is there in the current draft anything that
> requires ECDSA certificates to bear ECDSA issuer signatures?
> 
> No. Nor has that been true since TLS 1.2. See:
> https://tools.ietf.org/search/rfc5246#section-7.4.2

Great.  Thanks.

-- 
	Viktor.