Re: [TLS] Deprecate SHA1 for signatures in TLS 1.3 (was Re: TLS 1.3 draft-07 sneak peek)

[Viktor Dukhovni <[e-mail]>]

On Sat, Jul 11, 2015 at 04:05:01PM -0400, Dave Garrett wrote:

> ========================================
> If the client provided a "signature_algorithms" extension, then all
> certificates provided by the server SHOULD be signed by a hash/signature
> algorithm pair indicated by the extension (or defaults assumed in its
> absence). If the server cannot produce a valid certificate chain using
> these known supported pairs, then it SHOULD send the client a complete
> valid chain which attempts to match known support where possible, yet
> including certificates that are not known to be supported. If the
> client cannot build a trusted chain using these certificates and any
> other trusted information it has access to, then it MUST send an
> "unsupported_certificate" alert message and close the connection.
> ========================================
> 
> Comments?
> 
> Note that for the purposes of discussion here, opportunistic encryption
> can "trust" whatever it wants; anything or nothing, depending on implemented
> strategy.

Largely close enough.  Feel free to borrow any text from the below
that you find to be an improvement.

    ========================================

    Whenever possible, all certificates provided by the server
    SHOULD be signed by a hash/signature algorithm pair indicated
    by the client's supported algorithms extension (or the defaults
    assumed in its absence).  If the server cannot produce a
    certificate chain that is signed via only the indicated supported
    pairs, then it SHOULD continue the handshake by sending the
    client a certificate chain of its choice that may include
    hash/signature algoriths that are not known to be supported by
    the client.

    The public key in the leaf certificate must of course be
    compatible with the chosen cipher-suite, and the subsequent
    ServerKeyExchange message must be signed via a mutually supported
    hash/signature algorithm pair.

    If the client cannot construct a satisfactory chain using the
    provided certificates and decides to abort the handshake, then
    it MUST send an "unsupported_certificate" alert message and
    close the connection.

    ========================================

-- 
	Viktor.