Re: [TLS] Deprecate SHA1 for signatures in TLS 1.3 (was Re: TLS 1.3 draft-07 sneak peek)

[Dave Garrett <[e-mail]>]

On Wednesday, July 08, 2015 01:45:49 pm Martin Rex wrote:
> Unfortunately, a non-marginal installed base is exhibiting this self-imposed
> (mis)behaviour of connection failure: Microsoft SChannel beginning 
> with Windows 7 / 2008R2 (aka WinNT 6.1), and Windows 8 / 2012 and
> Windows 8.1 / 2012R2 exhibit the same (mis)behaviour.
> 
> When you install a server certificate with a sha256WithRsaEncryption signature
> on a Microsoft IIS on one of these platforms, enable TLSv1.2 on the server
> and try to connect with an extension-free ClientHello that offers
> client_version= (3,3), you will face a connection failure (IIS simply closes
> the network connection--IIS is notorious in failing to put fatal alerts
> on the wire).
> 
> The handshake succeeds (with TLSv1.1) if the client offers at most TLSv1.1,
> or if the client offers TLSv1.2 in a SSL Version2 CLIENT-HELLO rather than
> an extensionless TLS ClientHello, if TLSv1.2 is disabled on IIS, or if
> a server certificate with only sha1WithRsaEncryption ist used.

To clarify, how does this scenario respond with a TLS 1.2 ClientHello with at least one extension? Does it matter what extension(s)? (e.g. does IIS have to know what it is?)


Dave