Re: [TLS] TLSv1.2 with DSA client cert and key size >1024 bits

[Martin Rex <[e-mail]>]

Dr Stephen Henson wrote:
> 
> [FIPS 186-3] also says:
> 
> "In addition, an RSA digital signature key pair shall not be used for other
> purposes (e.g., key establishment)."
> 
> I can't imagine many servers using two distinct certificates for ephemeral and
> static RSA ciphersuites, even is the server software supports it.

I noticed that as well.  :)

So I looked at the next best SSL Server cert (happened to be issued
by Thawte SGC) and noticed that it does not contain a KeyUsage
extension (only ExtendedKeyUsage and BasicConstraints cA=FALSE).

static RSA ciphersuites need KeyUsage "keyEncipherment", and
DHE_RSA would need "digitalSignature".  But asserting both in a
cert seems literally incompatible with FIPS 186-3.  


I also noticed the distinction between PKCS1-v1.5 and PKCS1-PSS signatures,
and that RSA keys should be used for only one of the two for their entire
lifetime.  While it is sensible in general to distinguish credentials for
online authentication and credentials for longterm digital signatures,
PKCS1-v1.5 is hardwired into SSLv3 and all current versions of TLS.
I didn't see reference to or definition of an ExtendedKeyUsage OID
to recognize/distinguish RSA PKCS1-PSS keys in FIPS 186-3, which
looks somewhat inconsequential for the v1.5/PSS issue.


-Martin