Re: [TLS] TLS 1.2 hash agility

Mike <mike-list@pobox.com> Thu, 27 September 2007 14:39 UTC

Return-path: <tls-bounces@lists.ietf.org>
Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IauWD-0002J1-0c; Thu, 27 Sep 2007 10:39:09 -0400
Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IauWB-00025q-Pf for tls@ietf.org; Thu, 27 Sep 2007 10:39:07 -0400
Received: from sceptre.pobox.com ([207.106.133.20]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IauW4-00007z-LM for tls@ietf.org; Thu, 27 Sep 2007 10:39:01 -0400
Received: from sceptre (localhost.localdomain [127.0.0.1]) by sceptre.pobox.com (Postfix) with ESMTP id 72AEF2FA; Thu, 27 Sep 2007 10:39:11 -0400 (EDT)
Received: from [192.168.1.8] (wsip-24-234-114-35.lv.lv.cox.net [24.234.114.35]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by sceptre.sasl.smtp.pobox.com (Postfix) with ESMTP id 16CEB7FF70; Thu, 27 Sep 2007 10:39:09 -0400 (EDT)
Message-ID: <46FBC052.9030609@pobox.com>
Date: Thu, 27 Sep 2007 07:38:10 -0700
From: Mike <mike-list@pobox.com>
User-Agent: Thunderbird 2.0.0.6 (Windows/20070728)
MIME-Version: 1.0
To: Pasi.Eronen@nokia.com
Subject: Re: [TLS] TLS 1.2 hash agility
References: <46ABB82D.8090709@pobox.com> <46ACCCCB.8000201@pobox.com><B356D8F434D20B40A8CEDAEC305A1F24046B2496@esebe105.NOE.Nokia.com><20070914215611.0342933C21@delta.rtfm.com><46EB102E.2070900@pobox.com><20070914225606.9E9B433C21@delta.rtfm.com><46EC2AE7.9040903@pobox.com><20070917185820.6E7CC33C3A@delta.rtfm.com><46FA745A.3070305@pobox.com><20070926152907.8A60B33C23@delta.rtfm.com><46FA91E8.5020303@pobox.com> <46FB4397.6040203@pobox.com> <B356D8F434D20B40A8CEDAEC305A1F2404A1F1D7@esebe105.NOE.Nokia.com>
In-Reply-To: <B356D8F434D20B40A8CEDAEC305A1F2404A1F1D7@esebe105.NOE.Nokia.com>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
X-Spam-Score: 0.0 (/)
X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17
Cc: tls@ietf.org
X-BeenThere: tls@lists.ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.lists.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@lists.ietf.org?subject=unsubscribe>
List-Archive: <http://www1.ietf.org/pipermail/tls>
List-Post: <mailto:tls@lists.ietf.org>
List-Help: <mailto:tls-request@lists.ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@lists.ietf.org?subject=subscribe>
Errors-To: tls-bounces@lists.ietf.org

>> The only thing I could come up with is that putting the list of
>> signature algorithms in the CertificateRequest is a change to the
>> format of that message, so it requires version-specific processing,
>> whereas if you use the server extension, the format of Certificate
>> Request is the same as previous TLS versions.
> 
> CertificateRequest will require version-specific processing anyway,
> because its semantics will change. For example, in TLS 1.0/1.1
> ClientCertificateType "rsa_sign" meant a certificate containing
> an RSA key, and signed with RSA. In TLS 1.2, it will probably
> mean just a cert containing an RSA key; the signature algorithm
> part will be specified separately.

Ok, this is valid.  However, I have too much code that looks like:

    if (version == ssl3)
       do_this;
    else if (version <= tls11)
       do_that;
    else
       do_the_other;

Which is a maintenance nightmare.  In some places I used separate
functions for different TLS versions, all of which are very similar,
so that is not ideal either.  The less of this we need, the better.

> (Another difference is that in TLS 1.0/1.1, clients that didn't
> have certificates often just ignored CertificateRequest; 
> current draft of TLS 1.2 mandates sending an empty Certificate 
> message instead.)

Yes, but you can change your code to always send an empty Certificate
even for the earlier versions.

Mike

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls