Re: [TLS] TLSv1.2 with DSA client cert and key size >1024 bits

[Martin Rex <[e-mail]>]

Dr Stephen Henson wrote:
> 
>  [...] a similar comment about SHA-1 though not an outright prohibition:
> 
> "A hash function that provides a lower security strength than the
> security strength associated with the bit length of the modulus
> ordinarily should not be used, since this would reduce the security
> strength of the digital signature process to a level no greater
> than that provided by the hash function."

It's true that the wording in FIPS 186-3 section 4.2 (page 16 2nd paragraph)
uses "should not" (while the same description for ECDSA uses "shall not").

However, this looks to me like a transitional exception that might have ended
on 31.12.2010.  In the same section, last paragraph on page 15, it reads:

  Both the security strength of the hash function used and the
  security strength of the (L, N) pair shall meet or exceed the
  security strength required for the digital signature process.


> 
> Using SHA-2 algorithms isn't possible in TLS 1.1 and earlier with RSA
> as they hard code the SHA1+MD5 signature.

I agree.  The hash algorithm(s) in the digital signature of the
KeyExchange and CertificateVerify handshake messages prior
to TLSv1.2 is implied and fixed.

Support for longer DSA keys with hashes from the SHA-2 family will
require code changes to the installed base, where some may wonder
why not implementing TLSv1.2.  One of the problem appears to be
the default reluctance to offer/use TLSv1.2 even by those implementations
that already contain the code and the resulting TLS handshake failures
with non-marginal parts of the installed base of servers for clients
proposing TLSv1.2 through ClientHello.client_version.

-Martin