IETF Logo Mail Archive

Re: [TLS] Deprecate SHA1 for signatures in TLS 1.3 (was Re: TLS 1.3 draft-07 sneak peek)

Martin Thomson <martin.thomson@gmail.com> Tue, 07 July 2015 23:01 UTC

Return-Path: <martin.thomson@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B47031B2A0F for <tls@ietfa.amsl.com>; Tue, 7 Jul 2015 16:01:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d-MzMh0iscYk for <tls@ietfa.amsl.com>; Tue, 7 Jul 2015 16:01:11 -0700 (PDT)
Received: from mail-yk0-x236.google.com (mail-yk0-x236.google.com [IPv6:2607:f8b0:4002:c07::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98CF11A1A98 for <tls@ietf.org>; Tue, 7 Jul 2015 16:01:07 -0700 (PDT)
Received: by ykeo3 with SMTP id o3so71576280yke.0 for <tls@ietf.org>; Tue, 07 Jul 2015 16:01:07 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=2LAuPN0htdWQwlcK7y4XLnHgnajBnMwUA84BBT9oxZg=; b=P0PxDr+dP7f7EZEG/BNmTVy9yRVINk2xIYu2ZLzfaF2Mql9gUvNPek+Wog/0OW437o zOuLYWvpbNheL/emoOiRJGj8h7krJR5i4u4Rk1mBjvocpQDQs0Rf6jZ6Bg/HuQ68keIR ZzLEMvtGfd30G24Q3FZpEZ4RI8itq/1ZrPegkXQX/A3kVZxIGNxSF26wnsWsJ0gt30mq 21NSYWpy0WAU69xHJ4vAJwL1B1nnnYpXrLpkPQFMdHb2Np9UdalcOfSAzZLU3I732/kR IPaHO3c5bTl0EY+JrAnPNT/W4sUnq6IlKJaxVno+/AQAyw3hgVrA6upaHL1dLhJSfS45 VE6A==
MIME-Version: 1.0
X-Received: by 10.170.131.198 with SMTP id x189mr7728745ykb.118.1436310067069; Tue, 07 Jul 2015 16:01:07 -0700 (PDT)
Received: by 10.129.110.138 with HTTP; Tue, 7 Jul 2015 16:01:07 -0700 (PDT)
In-Reply-To: <20150707205858.GH21534@mournblade.imrryr.org>
References: <CABcZeBOWK_WnHAefsZUBr4UyEkyiZqi1mhoZH8ZeGFftdOqTTw@mail.gmail.com> <CABcZeBMPsopxV=mu+MJAwJC6w=iuytA3ueyXKpg1QFdV=JWirw@mail.gmail.com> <201507071242.23235.davemgarrett@gmail.com> <201507071257.26088.davemgarrett@gmail.com> <CABcZeBNxW6jaf=HZFvm56K5pKeLD4GyNXOimUHUCt34r_76Vzw@mail.gmail.com> <20150707205858.GH21534@mournblade.imrryr.org>
Date: Tue, 07 Jul 2015 16:01:07 -0700
Message-ID: <CABkgnnXZ9HmW2BHrda3s9LMVUzZbdbdD2yKU84w2W8roycJ-xg@mail.gmail.com>
From: Martin Thomson <martin.thomson@gmail.com>
To: "tls@ietf.org" <tls@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/hWimtV6pw34Wyh1ZIKNrSnQ_PVo>
Subject: Re: [TLS] Deprecate SHA1 for signatures in TLS 1.3 (was Re: TLS 1.3 draft-07 sneak peek)
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 07 Jul 2015 23:01:12 -0000

On 7 July 2015 at 13:58, Viktor Dukhovni <ietf-dane@dukhovni.org> wrote:
> Which SSL libraries allow server administrators to configure multiple
> chains based on the signature algorithm?

I just investigated this earlier today.  NSS maintains separate
certificates keyed on the signature algorithm and selects based on the
cipher suite, though this does not consider the hash part of the
signature algorithm pair.  That's the server end; the client side is
far less capable (though I have a patch in progress that would enable
what you describe).

v2.23.0 | Report a Bug | By Email