Re: [TLS] Remove signature algorithms from cipher suites in 1.3

[Hanno Böck <[e-mail]>]

Hi,

On Tue, 23 Dec 2014 12:26:27 +0100
Antoine Delignat-Lavaud <[e-mail]> wrote:

> No, in my proposal, the algorithm used in CertificateVerify messages
> is negotiated based on advertised support in the "signature
> algorithms" extension (and supported_signature_algorithms field in 
> CertificateRequest). Clients are encouraged to prioritize
> rsa-pss/sha256 over rsa/sha256 or rsa/sha1, and supporting servers
> may pick PSS even if their certificate chain only contains rsa/sha256
> and rsa/sha1.

Okay, then I misinterpreted you.

But my point remains: Why not just say "TLS 1.3 has to use RSA with
PSS, mo more PKCS #1 1.5"?

> If anything, my own concern is the opposite. Allowing the same RSA
> key to be used to sign with both PSS and PKCS#1v1.5 is considered 
> cryptographic malpractice, as the composition of secure and weak 
> signatures may very well be broken. However, servers have the ability
> to avoid this risk by sending a different certificate depending on
> whether the client advertises support for PSS or not, even if the two 
> certificates are signed with PKCS#1 (the proof of the protocol will 
> probably assume servers enforce this behavior).

I am aware that using same key for both protocol versions is bad
practice. However are you aware of any sign this may be a real risk?

Anyway, for the scenario that TLS 1.3 uses only PSS, could a server
send different keys for <=1.2 and 1.3?


> Furthermore, one of the issues of PSS in RFC 4055 is its reliance on 
> signature parameters, which have tricky agility characteristics. For 
> everyone's sake, it may help adoption if new OIDs for PSS signatures 
> were used that correspond to fixed parameters. In any case, this 
> discussion is out of the scope of the TLS WG.

I know all the problems, I implemented this once :-)

cu,
-- 
Hanno Böck
http://hboeck.de/

mail/jabber: [e-mail]
GPG: BBB51E42