Re: [TLS] I-D Action: draft-ietf-tls-rfc4492bis-00.txt

[Viktor Dukhovni <[e-mail]>]

On Tue, Dec 02, 2014 at 07:05:35PM +0100, Henrick Hellstr?m wrote:

> On 2014-12-02 18:40, Viktor Dukhovni wrote:
> >Given the far from universal support for ECDSA by clients, a server
> >that wants to use ECDSA when possible, but still wants to interoperate
> >with more than just a select few clients really SHOULD have both
> >ECDSA and RSA certificates.
> 
> Fair enough, but is it really an acceptable outcome that a fully conformant
> server (that is deployed with only RSA certificates) and a fully conformant
> client (that only implements one of the mandatory ECDSA cipher suites) will
> not be able to negotiate a connection?

This document does not replace the mandatory to implement cipher
suites in TLS 1.x.  So the client and server MUST still both offer
the usual (RSA-based) MTI cipher suites for each version of TLS
they support.

The text in question provides additional ciphersuites that conformant
implementations SHOULD support.  So in your example, a client that
suports ECDH(E) only with ECDSA, will employ neither EC based key
agreement nor EC based authentication.  The various MTI cipher
suites don't require either.

This said, perhaps the asymmetry between the client and server
requirements deserves more explanation.

-- 
	Viktor.