Re: [TLS] DSS with other than SHA-1 algorithms

[Geoffrey Keating <[e-mail]>]

Martin Rex <[e-mail]> writes:

> In practice, a TLS implementation without these two cipher suites
> 
>       CipherSuite TLS_RSA_WITH_RC4_128_SHA              = { 0x00,0x05 };
>       CipherSuite TLS_RSA_WITH_3DES_EDE_CBC_SHA         = { 0x00,0x0A };
> 
> will likely encounter interop problems with a number of TLS peers,
> whereas TLS implementations with _only_ RSA (no DH, no DHE, no DSS)
> hardly ever missed those cipher suites, except maybe in a few
> exotic PKIs.

Actually, the first one is almost certainly not necessary for a
client.  A small fraction (less than 0.5%) of servers still require
TLS_RSA_WITH_RC4_128_MD5, but generally if you have
TLS_RSA_WITH_3DES_EDE_CBC_SHA you'll be OK, and you can reasonably add
TLS_DHE_RSA_WITH_AES_256_CBC_SHA to obtain forward security on those
servers that support it.  Many servers do prefer RC4 (probably for
performance reasons, if their alternative was 3DES!) but if it's not
available they'll choose something else.

There are some Internet hosts with a DSA key signed by a popular root
CA, but we're talking 0.03% or so, and many of those are expired.

For future work, I would ignore DSS.  It has some useful
characteristics in some circumstances, but ECDSA has the same
characteristics and more.