Re: [TLS] DSS with other than SHA-1 algorithms

[Juho Vähä-Herttua <[e-mail]>]

On Apr 13, 2011, at 9:20 AM, Peter Gutmann wrote:
> Eric Rescorla <[e-mail]> writes:
> 
>> 1. I'm not convinced that the requirement that relying parties check the 
>> signature_algorithm should in fact be relaxed.
> 
> This despite the fact that every single person who responded considered it a 
> really bad idea (and some were far more vigorous in their comments than just 
> "bad idea"), and that no implementation actually checks it?  This sort of
> approach sounds more like PKIX than TLS.

Personally I was pretty shocked by this comment, should someone gather the related discussion from the mailing list into a single statement, in case the consensus wasn't clear enough already? I think there was only one argument for the strict checking, which was constrained devices that don't want to implement multiple hash functions and signing methods. But the bad sides presented clearly outweighed the good sides, having multiple certificates for each hash function just to fill this requirement in TLS 1.2 is simply not going to happen... It's far more likely that either the strict checking is ignored or TLS 1.2 is not implemented at all.


Juho