Re: [TLS] Is it possible for a client to offer TLS 1.3, but not be forced to support RSA PSS in TLS 1.2?

David Benjamin <davidben@chromium.org> Tue, 29 May 2018 20:07 UTC

Return-Path: <davidben@google.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5918E124BFA for <tls@ietfa.amsl.com>; Tue, 29 May 2018 13:07:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.951
X-Spam-Level:
X-Spam-Status: No, score=-9.951 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.248, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KYnbaMMcPsUp for <tls@ietfa.amsl.com>; Tue, 29 May 2018 13:07:23 -0700 (PDT)
Received: from mail-qk0-x230.google.com (mail-qk0-x230.google.com [IPv6:2607:f8b0:400d:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 41E25126DFB for <tls@ietf.org>; Tue, 29 May 2018 13:07:21 -0700 (PDT)
Received: by mail-qk0-x230.google.com with SMTP id d125-v6so12524636qkb.8 for <tls@ietf.org>; Tue, 29 May 2018 13:07:21 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=8HtYJ0gP2yowR3blEDpGFWJeYDxln8WCBAz6RlrUHTY=; b=le0xOgY26AoSR4+3mMAUheWsPu1aqhhXDGFVLB0rGuCps5tac8nJj8dhoj5yBsVvNM 4bSs6EJXJHQZoydMiOp5Deznl7W7gcgpWILQUSxWfgQhM+EUFN2JGvbJlQAgZYYrQv/M J4ECIly9H4qQyRaHLIOzr3GxxOF5a3CrBKhAA=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=8HtYJ0gP2yowR3blEDpGFWJeYDxln8WCBAz6RlrUHTY=; b=JUN87am9pi/5xdHhRWd6T2T6dhoF9OmXgtYzT5BSbWqEQpa2hmXGMabgsCc+JqaA6S d2ssUBFwJiAqkLKMWvnCmLbQVZP+w60ufIr9Skh7h7fzT1cE0MNPj8t0rUCdhc013gix h0avyf2pGkp8HvpV2Kho0f4XUBrowZzw5ordL4kHq0kn6zGFK6MShEcJWrVA4h7nz4QC HUwoLw6mpHaAr7JfXSr/KCSwsU4G+68TnUXfW04PdsniBsv2N64OTsJYibOO2T5bRGhc z9oOiZRk5K+KxaII85Pr4qbnph85+5WnwEHB5YWwX9ZfhS+YIjW4JBu24B10cTOCi/5k gioQ==
X-Gm-Message-State: ALKqPwdOg4lSTge/6e2cjMzsADlXI3zn9T/TMw22WQYjcxtk/MdLoULR jT3gU6hwXqf4oF2WuhRPkFx2i5Q4Eslvs6As6sil
X-Google-Smtp-Source: ADUXVKJcZ1JkfMFVTf5xyw9PV7vymuXnIeC1riXrwBglcwU9g1/aIFoij0Ld/WWItU+0J71LTti193Dq98MrW2qiZ+I=
X-Received: by 2002:a37:9507:: with SMTP id x7-v6mr15991573qkd.232.1527624440096; Tue, 29 May 2018 13:07:20 -0700 (PDT)
MIME-Version: 1.0
References: <a96fb90a-5533-6fc9-4473-fa2e5d0ac131@brainhub.org> <20180529191319.GJ13834@akamai.com> <2f30d9d5-17a0-4a83-ab2d-bfd399c73fd2@brainhub.org> <20180529194251.GK13834@akamai.com> <50f2f097-d8b0-334d-e1b2-1ea34fff9d29@brainhub.org>
In-Reply-To: <50f2f097-d8b0-334d-e1b2-1ea34fff9d29@brainhub.org>
From: David Benjamin <davidben@chromium.org>
Date: Tue, 29 May 2018 16:07:08 -0400
Message-ID: <CAF8qwaAZOZs__81Q2zvreM-X-t07G80V-4t1NKgZCWiP5yD-Yg@mail.gmail.com>
To: Andrey Jivsov <crypto@brainhub.org>
Cc: Benjamin Kaduk <bkaduk@akamai.com>, "tls@ietf.org" <tls@ietf.org>
Content-Type: multipart/alternative; boundary="0000000000001ae1d0056d5dc885"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/tcAolxPYOq0xh81Z7f3VWK2dvNo>
Subject: Re: [TLS] Is it possible for a client to offer TLS 1.3, but not be forced to support RSA PSS in TLS 1.2?
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 29 May 2018 20:07:36 -0000

I'm not sure I follow this. So, in this scenario, you are the client. You
wish to support TLS 1.3, which requires supporting RSA-PSS in TLS 1.3, and
this is fine. You are able to verify RSA-PSS signatures from the server at
TLS 1.3.

At the same time, you still talk to some TLS 1.2 servers, so you may get a
response from them. As TLS 1.2 and TLS 1.3 use the same signature
algorithms negotiation, that same ClientHello obligates your client (newly
updated to support TLS 1.3) to also verify RSA-PSS signatures from TLS 1.2.
But this causes troubles somehow.

I'm confused how a client would have an RSA-PSS function available at one
version, but not the other. Or am I misunderstanding your situation?

On Tue, May 29, 2018 at 4:05 PM Andrey Jivsov <crypto@brainhub.org>; wrote:

> On 05/29/2018 12:42 PM, Benjamin Kaduk wrote:
> > On Tue, May 29, 2018 at 12:35:20PM -0700, Andrey Jivsov wrote:
> >> On 05/29/2018 12:13 PM, Benjamin Kaduk wrote:
> >>> On Tue, May 29, 2018 at 11:57:39AM -0700, Andrey Jivsov wrote:
> >>>> Greetings.
> >>>>
> >>>> TLS 1.3 draft in sec 4.2.3.  Signature Algorithms tells that if a
> client
> >>>> wants to negotiate TLS 1.3, it must support an upgraded (and
> >>>> incompatible) version of TLS 1.2, the one that changes RFC 5246 to
> allow
> >>>> RSA-PSS in sec. 7.4.1.4.1. Signature Algorithms.
> >>>>
> >>>> You might recall that the possibility to negotiate between PSS and
> >>>> RSASSA-PKCS1-v1_5 in TLS 1.3 handshake, just as it is allowed for
> X.509
> >>>> signatures, was discussed on the mailing list. The WG decision then
> was
> >>>> to hard-wire PSS in the TLS 1.3 handshake.
> >>>>
> >>>> I don't recall any discussion on going further than this, all the way
> to
> >>>> changing the 10-year old TLS 1.2.
> >>>>
> >>>> Unfortunately, our products have issues with PSS beyond our control.
> The
> >>>> only solution left to avoid receiving PSS with TLS 1.2 is to never
> >>>> negotiate TLS 1.3 as a client. Another solution is insecure fallback,
> >>>> but we presently don't do this.
> >>>>
> >>>> Is my reading of the situation correct? Thank you.
> >>>
> >>> Sounds like it:
> >>>
> >>>    RSASSA-PKCS1-v1_5 algorithms  Indicates a signature algorithm using
> >>>       RSASSA-PKCS1-v1_5 [RFC8017] with the corresponding hash algorithm
> >>>       as defined in [SHS].  These values refer solely to signatures
> >>>       which appear in certificates (see Section 4.4.2.2) and are not
> >>>       defined for use in signed TLS handshake messages, although they
> >>>       MAY appear in "signature_algorithms" and
> >>>       "signature_algorithms_cert" for backward compatibility with TLS
> >>>       1.2,
> >>>
> >>> -Ben
> >>>
> >>
> >> I was referring to
> >>>
> >>>    -  Implementations that advertise support for RSASSA-PSS (which is
> >>>       mandatory in TLS 1.3), MUST be prepared to accept a signature
> >>>       using that scheme even when TLS 1.2 is negotiated.  In TLS 1.2,
> >>>       RSASSA-PSS is used with RSA cipher suites.
> >>
> >> I am OK with what you quoted. What I just quoted represents a
> >> significant change in behavior in TLS 1.2 and there is no way to opt out
> >> of this change to TLS 1.2.
> >
> > Ah, I misread your original message, but all is clear now.
> >
> >> I will add that I've seen this behavior by servers already, even when
> >> client doesn't advertise TLS 1.3. Just the fact of including some 08 xx
> >> IDs in signature_algorithms in ClientHello, without protocol_version
> >> extension, gets the TLS 1.2 upgraded to RSA-PSS.
> >>
> >> IMO this paragraph should be removed. Those that want PSS in the
> >> handshake should negotiate TLS 1.3. Preservation of current behavior of
> >> TLS 1.2 is important, at least as an option.
> >
> > First off, it's basically too late to make substantive changes like that;
> > the bar to meet is something like "a huge outcry from deployments" or
> > "a critical security flaw".
> >
> > Second, what's going on here is that TLS 1.3 is defining some new
> signature
> > algorithms for TLS messages, and making them mandatory to support for
> TLS 1.3.
> > But negotiation of TLS signature algorithms has *always* been
> independent of
> > protocol version.  If you support TLS 1.3, you also support the new
> signature
> > algorithms; if you support TLS 1.3 and TLS 1.2, you support the new
> signature
> > algorithms and you support TLS 1.2, therefore by the longstanding
> negotiation
> > rules you are obligated to support the combination.  You are in effect
> proposing
> > that we make a break in the signature (and hash) algorithm space with
> individual
> > algorithms supported either in <=1.2 or >=1.3, but not both -- we did
> this for
> > ciphersuites since we fundamentally changed the meaning of what a
> ciphersuite is.
> > But the signature scheme does not seem to have undergone such a
> fundamental change,
> > so it seems hard to justify introducing this sort of split.
> >
> > -Ben
> >
>
> We are talking about TLS 1.3-specific IDs:
>
>          /* RSASSA-PSS algorithms with public key OID rsaEncryption */
>           rsa_pss_rsae_sha256(0x0804),
>           rsa_pss_rsae_sha384(0x0805),
>           rsa_pss_rsae_sha512(0x0806)
>
> In TLS 1.2 08 corresponds to the (undefined) hash algorithm, and thus
> these IDs have no meaning to TLS 1.2.
>
> TLS 1.3 spec purposely "split" these IDs so that they have no meaning to
> TLS 1.2 servers. One needs the paragraph I quoted to force
> implementations to change the behavior of TLS 1.2.
>
> What's the harm of dropping this one paragraph I quoted and keeping TLS
> 1.2 behavior the same?
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>