Re: [TLS] AD Review of draft-ietf-tls-tls13

[Nico Williams <[e-mail]>]

On Fri, May 19, 2017 at 09:43:19PM -0400, Dave Garrett wrote:
> On Friday, May 19, 2017 04:51:21 pm Viktor Dukhovni wrote:

> > I note that TLS 1.3 does not have any language prohibiting MD2, MDC2DES,
> > MD4, RIPEMD160, private signature oids, ... that may be weaker than SHA-1
> > or even MD5.
> 
> They're not listed as possible field values anywhere directly in the TLS spec.

That's because it wouldn't be TLS that mentions them but PKIX, so _of
course_ TLS doesn't reiterate everything that PKIX says.

> > Opportunistic unauthenticated TLS ignores the peer certificate and should
> > not have to fall back to cleartext just because some certificate in the
> > chain is not sufficiently sexy.  There are other legitimate use cases where
> > the restrictions above are inappropriate.
> 
> Opportunistic unauthenticated TLS isn't the protocol we're defining here.

TLS certainly can be used that way.  And it is.

> If your goal isn't authentication, then by all means violate the requirements
> laid out for authentication. I have no problem making that explicit, if desired,
> however this is not the primary desired operating mode of TLS.

Then state the requirements in such a way that it is still possible to
use TLS in this way.

"When using TLS to authenticate the server, certificate signature
algorithms weaker than <list of weakest acceptable signature algs here>
MUST NOT be used."

Nico
--