[TLS] [Errata Rejected] RFC5246 (5535)

RFC Errata System <rfc-editor@rfc-editor.org> Sat, 27 October 2018 23:17 UTC

To: dave_thompson_2@comcast.net, tim@dierks.org, ekr@rtfm.com
From: RFC Errata System <rfc-editor@rfc-editor.org>
Cc: kaduk@mit.edu, iesg@ietf.org, tls@ietf.org, rfc-editor@rfc-editor.org
Content-Type: text/plain; charset="UTF-8"
Message-Id: <20181027231659.6F37AB80194@rfc-editor.org>
Date: Sat, 27 Oct 2018 16:16:59 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/TTFLNxLQzqtcj01XSzZ6738NOvQ>
Subject: [TLS] [Errata Rejected] RFC5246 (5535)
Precedence: list

The following errata report has been rejected for RFC5246,
"The Transport Layer Security (TLS) Protocol Version 1.2".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata/eid5535

--------------------------------------
Status: Rejected
Type: Technical

Reported by: Dave Thompson <dave_thompson_2@comcast.net>
Date Reported: 2018-10-19
Rejected by: Benjamin Kaduk (IESG)

Section: 4.7

Original Text
-------------
   In DSA, the 20 bytes of the SHA-1 hash are run directly through the
   Digital Signing Algorithm with no additional hashing. ...

Corrected Text
--------------
   In DSA, the bytes of the selected hash are run directly through the
   Digital Signing Algorithm with no additional hashing. ...

Notes
-----
In 2246 and 4346 this statement (then using the less-accurate spellings DSS and SHA) was correct because only SHA1 was used for DSA (and ECDSA, in 4492, versus SHA1+MD5 for RSA), but 5246 changed this to allow specifying one of several hashes, with selection constrained by the signature_algorithms extension (if present) or CertificateRequest field from the peer.

FIPS 186 actually defines the hashing step as part of signature generation and verification, so it might be even better to make this something like "For DSA, signature generation applies the selected hash [to the contents] and then computes two values, r and s." similar to the way the preceding paragraph of 5246 "In RSA signing" differs from the 2246 and 4346 versions by no longer treating the hashing as separate, but that is a bigger change to an obsoleted document, and arguably problematic because the normative reference is FIPS 186-2; as indicated in Appendix B on page 80, 186-3 which officially allowed DSA to use FIPS 180-3 hashes (not only SHA-1) was released in draft before 5246 but not finalized until after (2006-03 to 2009-06 versus 2008-08).
 --VERIFIER NOTES-- 
 As described in the reported Notes, at the time of publication, the DSA specification in force only allowed for the usage of SHA-1.  So the document was correct at time of publication and an errata is not appropriate, even though subsequent events have allowed for the usage of a broader set of hash algorithms with DSA.

--------------------------------------
RFC5246 (draft-ietf-tls-rfc4346-bis-10)
--------------------------------------
Title               : The Transport Layer Security (TLS) Protocol Version 1.2
Publication Date    : August 2008
Author(s)           : T. Dierks, E. Rescorla
Category            : PROPOSED STANDARD
Source              : Transport Layer Security
Area                : Security
Stream              : IETF
Verifying Party     : IESG

[TLS] [Errata Rejected] RFC5246 (5535) RFC Errata System