Subject: [TLS] consensus to drop non-ECC DSA from TLS 1.3 spec? (was: DSA should die)

From: Dave Garrett <[email-masked]>
Date: Tue, 19 May 2015 15:07:30 -0400

https://www.ietf.org/mail-archive/web/tls/current/msg15773.html

The topic of completely dropping DSA was brought up a while back, and the WG seemed to be mostly in favor of it. (in favor of using ECDSA instead, if not wanting to use RSA) Cutting it out of the spec would get rid of a fair bit of obsolete text that doesn't need to be there anymore, which would simplify things a bit. Did we ever get to a point where consensus could be called in favor of killing it?

(The threads on the topic veered off into how to make cipher selection better, the result of that line of discussion being that cipher suites should be restricted to negotiating the symmetric cipher and the rest should be negotiated by mandating usage of existing extensions that can do so. No consensus was agreed upon doing that, though, but that's another issue.)

Dave

---

From: Kurt Roeckx <[email-masked]>
Date: Tue, 19 May 2015 23:09:32 +0200

> The topic of completely dropping DSA was brought up a while back, and the WG seemed to be mostly in favor of it. (in favor of using ECDSA instead, if not wanting to use RSA) Cutting it out of the s…

The usage of DSA certificates is so low that I know about 4
certificates that didn't expire yet, but haven't seen any for
more than a year.  Firefox recently (March 31) stopped supporting
DSA certificates and I don't know of any problems with that
change.

So I see no need to support it in TLS 1.3.

Kurt