Re: [TLS] Explicit error expectations (was Re: Deprecate SHA1 for signatures in TLS 1.3)

[Viktor Dukhovni <[e-mail]>]

On Sat, Jul 11, 2015 at 12:56:07AM -0400, Dave Garrett wrote:

> Due to discussion here, I've started a branch to add some better
> expectations or errors to deal with things more clearly. Just a WIP at
> this point:
> 
> https://github.com/davegarrett/tls13-spec/compare/seanfixesredux...davegarrett:morealerts

Thanks for collecting these.  Is there a reason to "perpetuate"
the TLS 1.2 specification anomaly under discussion in this thread
in lines 2207-2211:

    If a server receives a ClientHello, but the server cannot produce a valid
    certificate chain using the hash/signature pairs known to be supported by
    the client (via this extension or the defaults assumed in its absence),
    then the server MUST send an "unsupported_certificate" alert message and
    close the connection.

Or are you just summarizing current state, with any proposed changes
to be discussed separately?  I still maintain that is clearly
incorrect server behaviour, any specifications to the contrary
notwithstanding.  The decision of whether the chain is or is not
supported by the client MUST be left to the client.  The server
does not have sufficient information to make this decision unilaterally
(even if knows all the signature algorithms the client appears to
support).

-- 
	Viktor.