Re: [TLS] Deprecate SHA1 for signatures in TLS 1.3 (was Re: TLS 1.3 draft-07 sneak peek)

[Dave Garrett <[e-mail]>]

On Saturday, July 11, 2015 05:13:45 pm Viktor Dukhovni wrote:
> I find this version much improved, in fact very clear and concise.
> Excellent, works for me.  Thanks.

Great. :)

To actually get back to the title of this thread, the change under current discussion could actually help us drop SHA1 from the spec a little more easily. SHA1 can be prohibited to be offered for TLS 1.3+, the defaults can be changed to SHA256 (and eventually to mandatory to send), and nothing else is really needed. The new text allows for unspecified hashes to be used if forced to, which would apply to SHA1. SHA1 would be MUST NOT offer & implicitly SHOULD NOT be sent by server. Thus, the official stance would be that SHA1 is only ever permitted in a fallback chain, which is pretty much what we want.

Note that clients willing to negotiate TLS 1.2 (e.g. the vast majority) would still probably want to offer SHA1 in the short term, so the 1.3 spec would need to state that this is not prohibited for them, but TLS 1.3 servers would have to ignore it.


Dave