Re: [TLS] Remove signature algorithms from cipher suites in 1.3

[Brian Smith <[e-mail]>]

Antoine Delignat-Lavaud <[e-mail]> wrote:
> Le 12/23/2014 7:07 AM, Brian Smith a écrit :
>> In theory, that sounds like a problem. Is it really a problem in
>> practice, if we're not concerned about the specific case of RSA-PSS? On
>> the other hand, nobody has ever seemed to want TLS_DHE_ECDSA_* cipher
>> suites, so it doesn't seem like it caused any problem.
>
> Right now, it isn't a problem in practice, but it is not clear either that
> DSA (maybe in danger of being removed?), ECDSA and PKCS#1v1.5 are a good set
> of signature algorithms to commit to for the long run. Even in the short
> term, a MAC-based signature scheme may be useful for PSK and resumption.

OK. It seems like whether we need to solve the problem of whether
cipher suites specify the signature algorithm *now* depends on whether
we're going to standardize a replacement for ECDSA, PKCS#1, and DSA
*now*. If we're not going to replace them now, then I don't think we
need to solve this problem now (for 1.3).

> It is currently impossible to get a non-RSA certificate signed by any public
> CA (I know because I tried hard to get one). Only Google can concretely
> deploy EC certs today. Hence, there's is currently NO alternative to RSA
> signatures for authentication.

I am surprised that you had so much trouble getting an ECC cert.
Please ping me off-list and I will help you with that. I agree with
the more general point that deploying ECDSA certificates is harder
than it should be. That is a fixable problem.

> By the way, it may be a good idea to recommend or mandate RFC6979-style
> deterministic ECDSA signatures in TLS to prevent entropy-exhaustion attacks
> against clients and servers. Off-topic though.

I think it is a good idea to at least explore making RFC6979-style
ECDSA mandatory for TLS 1.3 when ECDSA is used. I don't think it is
off-topic though. If we did that, that would resolve the main problem
with ECDSA, and that would reduce (perhaps eliminate) the need for
RSA-PSS or other new/uncommon signature schemes, which would greatly
reduce the motivation for making the change you propose.

Cheers,
Brian