Re: [TLS] I-D Action: draft-ietf-tls-rfc4492bis-00.txt

On Dec 02, 2014, at 13:19, Viktor Dukhovni <ietf-dane@dukhovni.org> wrote:

> On Tue, Dec 02, 2014 at 07:05:35PM +0100, Henrick Hellstr?m wrote:
> 
>> On 2014-12-02 18:40, Viktor Dukhovni wrote:
>>> Given the far from universal support for ECDSA by clients, a server
>>> that wants to use ECDSA when possible, but still wants to interoperate
>>> with more than just a select few clients really SHOULD have both
>>> ECDSA and RSA certificates.
>> 
>> Fair enough, but is it really an acceptable outcome that a fully conformant
>> server (that is deployed with only RSA certificates) and a fully conformant
>> client (that only implements one of the mandatory ECDSA cipher suites) will
>> not be able to negotiate a connection?
> 
> This document does not replace the mandatory to implement cipher
> suites in TLS 1.x.  So the client and server MUST still both offer
> the usual (RSA-based) MTI cipher suites for each version of TLS
> they support.

This is correct - RFC 4492 didn’t change the MTI cipher suites for TLS1.0-1.2 and since 4492bis is just an update it won’t change the MTI cipher suites either.

spt

> The text in question provides additional ciphersuites that conformant
> implementations SHOULD support.  So in your example, a client that
> suports ECDH(E) only with ECDSA, will employ neither EC based key
> agreement nor EC based authentication.  The various MTI cipher
> suites don't require either.
> 
> This said, perhaps the asymmetry between the client and server
> requirements deserves more explanation.
> 
> -- 
> 	Viktor.
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls