Re: [TLS] Kathleen Moriarty's Yes on draft-ietf-tls-rfc4492bis-15: (with COMMENT)

[Yoav Nir <[e-mail]>]

> On 14 Mar 2017, at 23:29, Martin Thomson <[e-mail]> wrote:
> 
> On 15 March 2017 at 08:26, Yoav Nir <[e-mail]> wrote:
>> That is the document that was referenced by RFC 4492 and it’s from 1998. It
>> doesn’t mention any hash function other than SHA-1.
>> 
>> RFC 4492 said that other hash functions may be used. We’ve upgraded it to a
>> SHOULD.
> 
> In light of recent developments, is there any reason we couldn't
> further upgrade this advice?

It might be better to rephrase the whole thing and eliminate the thing about a default. X9.62 has been revised in 2005. This newer version does mention the SHA-2 family in addition to SHA-1, so I don’t know it that is in any sense of the word still “the default”. I’d look it up, but as an ANSI standard, it’s behind a paywall.

We might just say:

OLD
   All ECDSA computations MUST be performed according to ANSI X9.62 or
   its successors.  Data to be signed/verified is hashed, and the result
   run directly through the ECDSA algorithm with no additional hashing.
   The default hash function is SHA-1 [FIPS.180-2 <https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-15#ref-FIPS.180-2>], and sha_size (see
   Section 5.4 <https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-15#section-5.4> and Section 5.8 <https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-15#section-5.8>) is 20.  However, an alternative hash
   function, such as one of the new SHA hash functions specified in FIPS
   180-2 [FIPS.180-2 <https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-15#ref-FIPS.180-2>], SHOULD be used instead.

NEW
   All ECDSA computations MUST be performed according to ANSI X9.62 or
   its successors.  Data to be signed/verified is hashed, and the result
   run directly through the ECDSA algorithm with no additional hashing.
   A secure hash function such as the SHA-256, SHA-384, and SHA-512
   [FIPS.180-4] MUST be used.