Re: [TLS] DSS with other than SHA-1 algorithms

[" Juho Vähä-Herttua " <[e-mail]>]

On Apr 13, 2011, at 9:20 AM, Peter Gutmann wrote:
>> 3. The ECC issues you raise are not issues in 5246 at all, since ECC is 
>> specified in a different document (4492).
> 
> 5246 claims to be an update to 4492 (line 4 of the doc), and a far more 
> drastic one than just adding a few new cipher suites since it's not 
> backwards-compatible with 4492.  This would be just another update of 4492,
> and one that's fully backwards-compatible.

I had to go to dig out the original email describing the ECC issues, because
I didn't read it well enough the first time. I was wondering if you could
clarify the following statement a bit:

Sub-issue: The overall suite chosen can be retroactively modified by ECC
parameters sent later in the handshake, so when choosing a suite you have to
remember not only the main suite but also one (or possibly more) backup suites
to fall back on if a later ECC parameter means you can't use your first
choice.

I don't see how this works, because in case of ECC the server is always
selecting the cipher suite and sending the ServerKeyExchange, and these both
happen between ServerHello and ServerHelloDone. What did I miss?

Otherwise I think we can agree that the ECC extension in TLS is very complex,
but then again I'm happy that it doesn't mandate for example supporting P256
curve, because I'm working with devices that wouldn't have the resources for
handling it.


Juho