Re: [TLS] TLS v1.2 performance (was Re: TLSv1.2 with DSA client cert and

[Yoav Nir <[e-mail]>]

On Feb 17, 2011, at 3:31 AM, Wan-Teh Chang wrote:

> On Wed, Feb 16, 2011 at 3:35 PM, Martin Rex <[e-mail]> wrote:
>> 
>> What I also don't understand is the idea behind "default signature
>> algorithms".  For implementing TLSv1.2, SHA-256 _must_ be supported,
>> but unless explicitly negotiated with the TLS SignatureAlgorithm
>> extension, SHA-256 appears not allowed to be used for CertificateVerify.
>> 
>> That would mean, when TLSv1.2 is negotiated, but no SignatureAlgorithms
>> extension exchanged, the resulting signature with an RSA client cert
>> in CertificateVerify no longer uses MD5+SHA-1 as in TLS up to v1.1,
>> but _only_ SHA-1 (which slightly weakens that signature compared to
>> prior protocol versions...).  The use of SHA-256 is prohibited!??!
> 
> I think you're right.  RFC 5246 Section 7.4.1.4.1 seems to say that
> {sha1,rsa} is the default RSA signature algorithm.
> 
> I guess the solution is for a TLS 1.2 client to always send the
> signature_algorithms extension, and for a TLS 1.2 server to use
> a non-empty supported_signature_algorithms field in the
> Certificate Request message.
> 
> Alternatively, we can amend RFC 5246 to change the default
> RSA signature algorithm to {sha256,rsa} .  It seems that anything
> that uses MD5+SHA-1 in TLS 1.0 and 1.1 should use SHA-256
> by default in TLS 1.2, for consistency.

If you change that, it becomes TLS 1.3. This is a non-backwards-compatible change in default behavior.