Subject: [Trans] duplicate 0x0403 in signature scheme registry

From: "Salz, Rich" <[email-masked]>
Date: Sun, 28 Mar 2021 20:23:08 +0000

>Section 10.3
>
>I'm confused by this registry.  Is the SignatureScheme value required to
>come from/match the TLS SignatureScheme registry?  Is anything going to
>key off that value or otherwise use the value in a protocol data
>structure?  (Why are there two entries for 0x0403?)

The duplicate 0x0403 seems a bug. Any implementor care to clarify?

As for why this registry, I assume it’s to be a subset of the TLS registry “just because”  Are there any other reasons?

---

From: Rob Stradling <[email-masked]>
Date: Mon, 29 Mar 2021 17:40:28 +0000

> The duplicate 0x0403 seems a bug. Any implementor care to clarify

The duplicate 0x0403 is deliberate, because Deterministic and Non-Deterministic ECDSA have different References (RFC6979 and FIPS186-4).

At one point we planned to only permit Deterministic ECDSA, but discussion on this list led us to permit both Deterministic and Non-Deterministic ECDSA (see https://github.com/google/certificate-transparency-rfcs/pull/261); although note that in Section 11.4 we still recommend Deterministic ECDSA.

> As for why this registry, I assume it’s to be a subset of the TLS registry “just because”  Are there any other reasons?

Mirja Kühlewind asked the same question (see the Last Call COMMENTs):
"7) sec 10.3: Couldn’t you use the TLS  SignatureScheme Registry directly (instead of forming an own registry)?"

I responded in https://github.com/google/certificate-transparency-rfcs/pull/316:
'It makes sense to synchronize the signature algorithm values we use with the TLS SignatureAlgorithm registry, because our data structures are defined according to the conventions laid out in the TLS RFC.
However, I don't think it's a good idea to use the TLS SignatureAlgorithm registry directly. In 6962-bis, we've taken steps to make log artifacts smaller (compared to RFC6962); related to that, we've removed the option of logs being permitted to use RSA keys/signatures. https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-16 permits RSA, and several other signature algorithms that we don't wish to permit or recommend (i.e. "anonymous", DSA, GOST, and "Reserved for Private Use").'

________________________________
From: Trans <[email-masked]> on behalf of Salz, Rich <rsalz=[email-masked]>
Sent: 28 March 2021 21:23
To: [email-masked] <[email-masked]>
Subject: [Trans] duplicate 0x0403 in signature scheme registry

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 30 Mar 2021 16:55:07 +0000

>> The duplicate 0x0403 seems a bug. Any implementor care to clarify

  *   The duplicate 0x0403 is deliberate, because Deterministic and Non-Deterministic ECDSA have different References (RFC6979 and FIPS186-4).

How does a relying party know which one is actually being used?  (I am sure I am missing something obvious.)

> As for why this registry, I assume it’s to be a subset of the TLS registry “just because”  Are there any other reasons?

Yes, this was re-wording Mirja’s question. I understand the reasoning; is it worth putting something into the draft?

---

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 30 Mar 2021 10:11:00 -0700

> How does a relying party know which one is actually being used?  (I am sure I am missing something obvious.)

The verifier procedures are the same for both, and the verifier can't tell
which one was used by the signer (unless the signer really screwed up and
used a non-random k).

-Ben

> _______________________________________________
> Trans mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/trans

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 30 Mar 2021 17:14:28 +0000

Shortly after I hit send I realized the verification is the same either way.  At least I didn't do one of those outlook "wants to recall their message" blunders.

Sigh.

---

From: Rob Stradling <[email-masked]>
Date: Tue, 30 Mar 2021 22:11:19 +0000

> I understand the reasoning; is it worth putting something into the draft?

Yes, I think it's worth adding a sentence to explain why we're not using the TLS SignatureScheme registry directly.

________________________________
From: Salz, Rich <[email-masked]>
Sent: 30 March 2021 17:55
To: Rob Stradling <[email-masked]>; [email-masked] <[email-masked]>
Subject: Re: duplicate 0x0403 in signature scheme registry

---

From: Paul Wouters <[email-masked]>
Date: Tue, 30 Mar 2021 18:18:52 -0400 (EDT)

On Tue, 30 Mar 2021, Rob Stradling wrote:

> Subject: Re: [Trans] duplicate 0x0403 in signature scheme registry
> 

And probably a note about the 'duplicate' entry too ?

Paul

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 31 Mar 2021 15:51:10 +0000

Done; https://github.com/google/certificate-transparency-rfcs/pull/324/commits/6beb8d7d7d28ce5459cc03d2fc25dbaca5d22333

On 3/30/21, 6:18 PM, "Paul Wouters" <[email-masked]> wrote:

    Paul