Re: [TLS] DSS with other than SHA-1 algorithms

[Martin Rex <[e-mail]>]

Simon Josefsson wrote:
> 
> Peter Gutmann <[e-mail]> writes:
> > 
> > Hovav Shacham <[e-mail]> writes:
> > >
> > >How about we remove DSA support from TLS, then?

The decision in 1997 to mandate DHE_DSS was more of a political
than a technical decision, because the DH patent had just expired
and the RSA patent would not expire until 2000 (albeit the RSA
patent existed only in that part of the world where patent filing
was allowed up to a year after publication).


>
> > Possibly a bit extreme, but we could at least mark it "historical" or 
> > "deprecated" or something.  In fact we could do that for an awful lot of 
> > existing cipher suites.  Note that this isn't changing the standard
> > in any way, it's just documenting what's already the norm among
> > implementations.  If a cipher suite's been in there for ten years
> > and there are, approximately, zero cases of it being used, then
> > saying "Don't bother with this one" in order to help guide
> > implementers seems sensible.
> 
> Unfortunately I think DSA is still mandatory-to-implement in some
> protocols.  That makes it a bit more complicated, but still doable.

DHE_DSS was mandatory to implement _only_ for TLSv1.0 (but not SSLv3!):

 TLSv1.0      http://tools.ietf.org/html/rfc2246#section-9

   9. Mandatory Cipher Suites

   In the absence of an application profile standard specifying
   otherwise, a TLS compliant application MUST implement the cipher
   suite TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA.


 TLSv1.1      http://tools.ietf.org/html/rfc4346#section-9

   In the absence of an application profile standard specifying
   otherwise, a TLS compliant application MUST implement the cipher
   suite TLS_RSA_WITH_3DES_EDE_CBC_SHA.

 TLSv1.2      http://tools.ietf.org/html/rfc5246#section-9

   In the absence of an application profile standard specifying
   otherwise, a TLS-compliant application MUST implement the cipher
   suite TLS_RSA_WITH_AES_128_CBC_SHA (see Appendix A.5 for the
   definition).


The wording in that section 9 looks garbled to me.
I assume this requirement was supposed to apply to
"TLS compliant implementations", and not application callers of TLS
(applications would not implement, but rather request cipher suites).


In practice, a TLS implementation without these two cipher suites

      CipherSuite TLS_RSA_WITH_RC4_128_SHA              = { 0x00,0x05 };
      CipherSuite TLS_RSA_WITH_3DES_EDE_CBC_SHA         = { 0x00,0x0A };

will likely encounter interop problems with a number of TLS peers,
whereas TLS implementations with _only_ RSA (no DH, no DHE, no DSS)
hardly ever missed those cipher suites, except maybe in a few
exotic PKIs.


SSLv3 does not appear to have any mandatory cipher suites.
Section D.1 of the SSL version 3 draft (draft302.txt) says this:

   D.4 CipherSuites

   SSL supports a range of key sizes and security levels, including
   some which provide no or minimal security.  A proper implementation
   will probably not support many cipher suites.  


-Martin