Re: [TLS] TLS 1.3 signature algorithms in TLS 1.2

[Ilari Liusvaara <[e-mail]>]

On Tue, Jul 12, 2016 at 10:29:29PM +0300, Ilari Liusvaara wrote:

> By the time CertificateRequest is sent, the server knows the final
> protocol, so it can omit algorithms it knows it can't handle. Also,
> the client picks the actual algorithm, so it too can avoid algorithms
> it can't handle. So client auth isn't the interop hazard server auth
> is.

There actually are TLS stacks in dev that have TLS 1.2 client
authentication on will-not-implement-list (for reasons totally unrelated
to "message-based signatures") but are willing to consider or implement
TLS 1.3 client authentication (these are done by authors who actually
care about security[1], and know just how dangerous "crap" is).

(Oh, at least two of those have backend signature APIs that actually
are message-based for all signatures).


[1] To the point of willfully ignoring "MUST" or "MUST NOT" requirements
that conflict on security. E.g. unsafe MTIs won't be implemented.



-Ilari