Subject: [TLS] Regarding multiple signature algorithms in TLS 1.3

From: Philip Lafrance <[email-masked]>
Date: Wed, 5 Jul 2017 11:20:01 -0400

Hello all,

I am not certain whether the issue of multiple signature algorithms has
previously come up in the TLS 1.3 discussion and was wondering if this is
something we need to consider.

As many of you know, updating roots of trust to support quantum-resistant
algorithms in various devices may be a fairly urgent issue.  Fortunately,
we can use hash-based algorithms for that soon.  Hash-base algorithms can
even be used in end-entity certificates for code signing.

Now, I am wondering if we will ever have a situation where we will need to
support certificate chains in TLS where CA certificates use hash-based
algorithms and end-entity certificates use some new stateless signature
algorithm.  If that is the case, we will need to support multiple digital
signatures in one certificate chain.

Does TLS 1.3 currently permit negotiating multiple signature algorithms?
Admittedly I don’t quite have the current draft memorized, but a cursory
reading of v21 seems to suggest that it does not allow for multiple
algorithms; simply that the client sends an ordered list of preferred
algorithms and the server selects one of them.  If not, then does anyone
think it is worthwhile to add this functionality to TLS 1.3?

Thanks in advance,

Philip Lafrance

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 5 Jul 2017 10:12:51 -0700

No, it does not. The way to do that presently would be to have combined
algoithms.

-Ekr

On Wed, Jul 5, 2017 at 8:20 AM, Philip Lafrance <[email-masked]
> wrote:

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>
>

---

From: Ilari Liusvaara <[email-masked]>
Date: Wed, 5 Jul 2017 20:23:31 +0300

> signatures in one certificate chain.

You can already mix-and-match algorithms across the chain (by the spec
in TLS 1.2 and 1.3, and in practice in earlier versions).

However, to use an algorithm for signing key exchange, you need:

- TLS SignatureScheme value for it.
- PKIX SPKI key OID for it.

And to use algorithm for certificate signing:

- PKIX SPKI key OID for it.
- PKIX signature OID for it.
- Preferably TLS SignatureScheme value for it.

(The last is not absolute requirement, but doing without is an interop
hazard)

-Ilari