Re: [TLS] TLS 1.3 draft-07 sneak peek

[Hubert Kario <[e-mail]>]

On Friday 03 July 2015 15:22:21 Martin Thomson wrote:
> On 3 July 2015 at 10:53, Hubert Kario <[e-mail]> wrote:
> > https://github.com/ekr/tls13-spec/pull/12
> 
>  [Make {sha256, xxx} the default signature algorithm extension value
> when the extension is absent]
> 
> There is a problem with this, and I think that you need to highlight
> that in the text.
> 
> The reason that this doesn't work particularly well, though it
> probably isn't strictly problematic, is that now you have an extension
> that means one thing {sha1, rsa} when you negotiate TLS <= 1.2 and
> another thing {sha256, rsa} when you negotiate TLS 1.3.  Maybe that's
> OK, but it narrows the utility of having a default.
> 
> Please add the following (or similar):
> A TLS 1.3 client that is willing to do TLS <= 1.2 MUST include the
> extension unless it supports SHA-256 for TLS 1.3 and SHA-1 for TLS <=
> 1.2.

Hmm, true, I'll fix it.

And while we're at it, maybe a security recommendation stating that 
advertising support for sha-1 and md-5 is not recommended?
-- 
Regards,
Hubert Kario
Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic