Re: [TLS] Deprecate SHA1 for signatures in TLS 1.3 (was Re: TLS 1.3 draft-07 sneak peek)

[Eric Rescorla <[e-mail]>]

On Sat, Jul 11, 2015 at 11:17 AM, Viktor Dukhovni <[e-mail]>
wrote:

> On Sat, Jul 11, 2015 at 09:55:45AM -0400, Eric Rescorla wrote:
>
> > This makes a certain amount of sense (though I wonder how often it's
> really
> > an issue that a server declines to send a certificate that would
> otherwise
> > have worked to a compliant client [0]).
>
> Every time with Schannel, Exchange SMTP servers, and opportunistic
> TLS SMTP clients


Well, I assume you mean every time you have a pair with the right
properties.
But my question is how often that happens on the live Internet.

 -Ekr


>
> Perhaps the right text here is that if you have a conformant certificate,
> > you MUST send it, but if not, you MAY send a nonconformant one?
>
> Correct.  It is important to try to match a supported algorithm,
> but failing that, send what you have.  It may well work just fine
> for the client, since the signatures in question are not made in
> real-time by the server, but rather at some previous time by some
> CA, which the client may not care about (pinned leaf cert, DANE
> leaf cert, opportunistic TLS, ...).
>
> And the point about debugging also makes sense.  The client
> administrator can much more easily determine which additional
> algorithm is required to interoperate with the server.
>
> --
>         Viktor.
>
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls
>