Re: [TLS] Deprecate SHA1 for signatures in TLS 1.3 (was Re: TLS 1.3 draft-07 sneak peek)

[Viktor Dukhovni <[e-mail]>]

On Wed, Jul 08, 2015 at 09:08:39PM +0300, Yoav Nir wrote:

> It's possible that a single user might be issued multiple certificates,
> but they will be from different CAs, and choosing a client certificate
> based on CA will work. I don't see any use case for a corporate CA to
> issue multiple certificates to the same user or device with different
> algorithms. This is at least true for my use cases.

Are root-CA self-signatures subject to the algorithm compatibility
requirements on intermediate and leaf certificates?  I was under
the impression that root-CA self-signatures were exempted from such
a constraint.

My impression was that it is not uncommon to use the same (say
SHA-1 self-signed) root CA to issue both a SHA-1 and a SHA2-256
intermediate CA, each of which then issues chains signed with the
corresponding algorithm all the way down to the leaf.  

In the above scenario, the server's signal of which root-CA to
choose does not help the client to interoperate with the server by
using a certificate that matches the agreed algorithm.  And I still
expect that most servers and clients will have just one certificate
chain to offer.

Therefore, the requirement to return a chain that uses a shared
algorithm or fail seems too strong.  Returning what you have seems
a lot more reasonable to me.  The peer can reject the chain if so
desired.

-- 
	Viktor.