Re: [TLS] TLS 1.3 draft-07 sneak peek

[[e-mail] (Martin Rex)]

Martin Thomson wrote:
> Hubert Kario <[e-mail]> wrote:
> 
> There is a problem with this, and I think that you need to highlight
> that in the text.
> 
> The reason that this doesn't work particularly well, though it
> probably isn't strictly problematic, is that now you have an extension
> that means one thing {sha1, rsa} when you negotiate TLS <= 1.2 and

The two weak RSA signature algorithms {md5,rsa} and {sha1,rsa} were
security vulnerability that were deliberately ADDED to TLSv1.2.

All prior protocol versions, including SSLv3, are using RSA signatures
with a 278-bit hash (a concatenation of sha1+md5), which is a reasonable
and conservative design.  Given that this TLS-specific signature
scheme had been used successfully for more than a decade when TLSv1.2
was specified, it is difficult to understand why this was deliberately
weakened in TLSv1.2, rather than using the straight forward safe
solution to define a codepoint for { sha1+md5, rsa } to identify
the SSLv3->TLSv1.1 RSA signature transform for use in TLSv1.2
rather than newly adding and allowing the well-known weak signature
schemes {md5,rsa} and {sha1,rsa} (and de-facto mandating support
for the latter).


-Martin