Re: [TLS] Deprecate SHA1 for signatures in TLS 1.3 (was Re: TLS 1.3 draft-07 sneak peek)

[[e-mail] (Martin Rex)]

Dave Garrett wrote:
> On Friday, July 10, 2015 11:05:15 am Viktor Dukhovni wrote:
>>
>> Yes, when possible servers should provide a chain that is more
>> likely to be understood by the client.  But refusing to provide
>> the chain they have, just because the client did not disclose every
>> signature algorithm it supports (or simply did not send any) is a
>> mistake in the implementation and likely a design error in the
>> specification.
> 
> https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1
> 
> The only instance a TLS 1.2 client is allowed to omit the extension
> is when it only support the defaults. If it doesn't support the default
> or supports something else (or both) then it MUST send the extension.

This is the result of an incorrect reading of rfc5246.

If the TLSv1.2 client uses the *PERMITTED* option in
section 7.4.1.2 ClientHello:

   extensions
      Clients MAY request extended functionality from servers by sending
      data in the extensions field.  The actual "Extension" format is
      defined in Section 7.4.1.4.

Then the entire Section 7.4.1.4 HelloExtensions and all of its SubSections
are completely irrelevant to that client.


There is no (valid) prohibition of TLSv1.0 and TLSv1.1 clients and servers
to use server certificate that is signed by sha256WithRsaEncryption, and
as you can test yourself, Microsoft SChannel will properly handshake
with these protocol versions and a server certificate that has a
(sha256,rsa) signature.  The only situation where Microsoft SChannel
crashes and burns is when an extension-less ClientHello arrives with
ClientHello.client_version = (3,3).


Was TLSv1.2 really meant to be backwards-incompatible to TLSv1.0 and TLSv1.1
and create new problems for the migration from sha1-signed server certs
to sha256-signed server certificates, considering that sha1-signed certs
had already been officially been deprecated (e.g. by NIST) more than a
year before TLSv1.2 (rfc5246) was published.


-Martin