Re: [TLS] TLSv1.2 with DSA client cert and key size >1024 bits

The wording could probably use clarification - a "digital signature" key
pair is used by an entity to bind its identity to a piece of
information.  If the only external result of an ephemeral ciphersuite is
an authenticated shared key, then the RSA key is being used for the
purpose of key establishment even if a signature algorithm is used
internally by the key establishment process.

If a client purported to have data signed by a server as a result of
having performed a key exchange using a key establishment certificate,
it would be misrepresenting the results of the key exchange.  No relying
party would accept as valid data "signed" using a key establishment
certificate, protecting the server from unintended consequences.

Dave

-----Original Message-----
From: tls-bounces@ietf.org [mailto:tls-bounces@ietf.org] On Behalf Of Dr
Stephen Henson
Sent: Tuesday, February 15, 2011 11:43 AM
To: mrex@sap.com
Cc: tls@ietf.org
Subject: Re: [TLS] TLSv1.2 with DSA client cert and key size >1024 bits

On 15/02/2011 16:18, Martin Rex wrote:
> Dr Stephen Henson wrote:
>>
>>  [...] a similar comment about SHA-1 though not an outright
prohibition:
>>
>> "A hash function that provides a lower security strength than the
>> security strength associated with the bit length of the modulus
>> ordinarily should not be used, since this would reduce the security
>> strength of the digital signature process to a level no greater
>> than that provided by the hash function."
> 
> It's true that the wording in FIPS 186-3 section 4.2 (page 16 2nd
paragraph)
> uses "should not" (while the same description for ECDSA uses "shall
not").
> 

It also says:

"In addition, an RSA digital signature key pair shall not be used for
other
purposes (e.g., key establishment)."

I can't imagine many servers using two distinct certificates for
ephemeral and
static RSA ciphersuites, even is the server software supports it.

Steve.
-- 
Dr Stephen N. Henson.
Core developer of the   OpenSSL project: http://www.openssl.org/
Freelance consultant see: http://www.drh-consultancy.co.uk/
Email: shenson@drh-consultancy.co.uk, PGP key: via homepage.
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls