Re: [TLS] TLSv1.2 with DSA client cert and key size >1024 bits

[Dr Stephen Henson <[e-mail]>]

On 14/02/2011 16:48, Martin Rex wrote:
> Dear implementors of TLSv1.2,
> 
> The use of TLSv1.2 with DSA client certs using key lengths > 1024
> as defined by FIPS 186-3 appears slightly underspecified.
> I would like to find out what current implementations of TLSv1.2
> are doing -- and what they are doing when negotiating a protocol
> version less that {0x03,0x03}.
> 

OpenSSL uses SHA-1 for TLS v1.1 and below. OpenSSL doesn't currently support TLS
v1.2.

As I mentioned elsewhere FIPS 186-3 also includes comments about RSA (section
5). For example it limits keys sizes to 1024, 2048 and 3072 bits. 4096 bit RSA
keys are not that uncommon and oddball keylengths like 2047 bits crop up quite
often too.

There is a similar comment about SHA-1 though not an outright prohibition:

"A hash function that provides a lower security strength than the security
strength associated with the bit length of the modulus ordinarily should not be
used, since this would reduce the security strength of the digital signature
process to a level no greater than that provided by the hash function."

Using SHA-2 algorithms isn't possible in TLS 1.1 and earlier with RSA as they
hard code the SHA1+MD5 signature.

Steve.
-- 
Dr Stephen N. Henson.
Core developer of the   OpenSSL project: http://www.openssl.org/
Freelance consultant see: http://www.drh-consultancy.co.uk/
Email: [e-mail], PGP key: via homepage.