Subject: [TLS] TLS 1.2 signature_algorithms extension

From: Rob Dugal <[email-masked]>
Date: Wed, 26 Nov 2008 13:16:43 -0500

I believe there is an oversite in the TLS 1.2 specification regarding the signature_algorithms extension.
In section 7.4.1.4.1 it says this:

   Note: this extension is not meaningful for TLS versions prior to 1.2.
   Clients MUST NOT offer it if they are offering prior versions.
   However, even if clients do offer it, the rules specified in [TLSEXT]
   require servers to ignore extensions they do not understand.

If a client wishes to support multiple protocols, including TLS 1.2, then it must not send this extension.
But this effectively limits the client to only supporting RSA/SHA1, ECDSA/SHA1, DSA/SHA1 in TLS 1.2 negotiations. 
I think clients must be allowed to send this extension when supporting multiple protocols.

-----------------------------------------------
Robert Dugal
Member of Development Group
Certicom Corp.
EMAIL: [email-masked]
PHONE: (905) 501-3848
FAX  : (905) 507-4230
WEBSITE: www.certicom.com

_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls

---

From: Mike <[email-masked]>
Date: Wed, 26 Nov 2008 10:34:25 -0800

I think that the text is implying that the signature_algorithms
extension must only appear if the offered TLS version is 1.2 or
greater.  If the server doesn't support version 1.2 and falls
back to an earlier version, there is no harm in including the
extension.  In other words, don't try to retrofit the extension
into a 1.0 or 1.1 client that doesn't support version 1.2.

Mike

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 26 Nov 2008 17:31:51 -0800

At Wed, 26 Nov 2008 10:34:25 -0800,
> into a 1.0 or 1.1 client that doesn't support version 1.2.

That seems like what I meant :)

-Ekr

---

From: Rob Dugal <[email-masked]>
Date: Fri, 28 Nov 2008 06:52:54 -0500

Thanks, that also answers my questions with draft-rescorla-tls-suiteb-11.txt
I originally had interpretted the text like you meant but had a 3rd party come back and say I interpretted it incorrectly.
So the wording in this text is not clear enough.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Eric Rescorla
> Sent: Wednesday, November 26, 2008 8:32 PM
> To: Mike
> Cc: [email-masked]
> Subject: Re: [TLS] TLS 1.2 signature_algorithms extension
>