Re: [TLS] Signature Algorithms

"Mehner, Carl" <Carl.Mehner@usaa.com> Tue, 17 March 2015 18:10 UTC

From: "Mehner, Carl" <Carl.Mehner@usaa.com>
To: Eric Rescorla <ekr@rtfm.com>, Dave Garrett <davemgarrett@gmail.com>
Thread-Topic: [TLS] Signature Algorithms
Thread-Index: AQHQYN2keZkvConmFEatyoGpqnKTLw==
Date: Tue, 17 Mar 2015 18:10:25 +0000
Message-ID: <19075EB00EA7FE49AFF87E5818D673D411463AF8@PRODEXMB01W.eagle.usaa.com>
References: <19075EB00EA7FE49AFF87E5818D673D41145FB0C@PRODEXMB01W.eagle.usaa.com> <201503171341.40315.davemgarrett@gmail.com> <CABcZeBNoVPi-8peRsdjksew0XDv=DnBnrqupk3zWoe+WVHXwSA@mail.gmail.com>
In-Reply-To: <CABcZeBNoVPi-8peRsdjksew0XDv=DnBnrqupk3zWoe+WVHXwSA@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: multipart/alternative; boundary="_000_19075EB00EA7FE49AFF87E5818D673D411463AF8PRODEXMB01Weagl_"
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/MB1o2b2CHPFR2a46kQlKKurhAJE>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Signature Algorithms
Precedence: list

I’m not arguing for TLS 1.3 to drop support for SHA-1 (that’s up to the client configurer), I’m arguing for the TLS signature algorithms extension to not specify the signature of a root. This same argument applies for MD5 roots with long term SHA-1 end-entity certs.

If we want to drop MD5 EE-certs by removing MD5 from the signature algorithms, and you want to keep your long term SHA-1 EE-cert that has a chain which is capped by an MD5 root, you would not be able to send that root in the certificate_list as the document is written today. The text I suggested allows you to still send the root.



If the client provided a "signature_algorithms" extension, then all

   certificates provided by the server, except for the self-signed

   root CA certificate, MUST be signed by a hash/signature algorithm

   pair that appears in that extension.
...



From: Eric Rescorla [mailto:ekr@rtfm.com]
Sent: Tuesday, March 17, 2015 1:00 PM
To: Dave Garrett
Cc: tls@ietf.org; Mehner, Carl
Subject: EXTERNAL: Re: [TLS] Signature Algorithms







On Tue, Mar 17, 2015 at 10:41 AM, Dave Garrett <davemgarrett@gmail.com<mailto:davemgarrett@gmail.com>> wrote:

On Saturday, March 14, 2015 11:40:38 pm Mehner, Carl wrote:
> As we move into a world that lacks trusted SHA-1 signatures, a change in the text would be necessary in order for clients that drop SHA-1 from the supported hash algorithms to continue to connect to servers that send a certificate_list that includes roots signed with SHA-1.

What's the viability of having TLS 1.3 drop support for SHA-1 for end-entity certificates? (not root or intermediary, yet)



I would not be in favor of this. Many people have certificates with very long lifetimes

and this would effectively mean that people could not drop in TLS 1.3 for 1.2 on

their servers, which would be bad.



-Ekr







   This would of course be in addition to dropping all support for MD5, which I think is pretty much a given at this point.

   If it were to be new policy right this second, that wouldn't be great, but by the time TLS 1.3 is ready for widespread adoption I think that's a reasonable expectation. Latest survey shows the SHA-1 to SHA-2 ratio at about 2:3 and improving steadily. SHA-2 will probably be used in the majority within a couple months or so.


   Dave

[TLS] Signature Algorithms Mehner, Carl
Re: [TLS] Signature Algorithms Eric Rescorla
Re: [TLS] EXTERNAL: Re: Signature Algorithms Mehner, Carl
Re: [TLS] Signature Algorithms Dave Garrett
Re: [TLS] Signature Algorithms Hubert Kario
Re: [TLS] Signature Algorithms Viktor Dukhovni
Re: [TLS] Signature Algorithms Viktor Dukhovni
Re: [TLS] Signature Algorithms Dave Garrett
Re: [TLS] Signature Algorithms Viktor Dukhovni
Re: [TLS] Signature Algorithms Mehner, Carl
Re: [TLS] Signature Algorithms Daniel Kahn Gillmor