Re: [TLS] Draft 18 certificate signature algorithm requirements

2016-12-01 Thread Ilari Liusvaara
On Thu, Dec 01, 2016 at 04:36:17AM +, Peter Gutmann wrote: > Viktor Dukhovni writes: > > >So I'd like to see the text in the first paragraph changed to a SHOULD or > >worst-case a qualified "MUST whenever possible". > > Why is that whole thing even there in the first place? From the previo

Re: [TLS] Draft 18 certificate signature algorithm requirements

2016-11-30 Thread Viktor Dukhovni
> On Nov 30, 2016, at 11:36 PM, Peter Gutmann wrote: > > Why is that whole thing even there in the first place? From the previous > discussions where this came up, the pretty much universal consensus was that > people were ignoring the requirement because it served no obvious purpose > but b

Re: [TLS] Draft 18 certificate signature algorithm requirements

2016-11-30 Thread Peter Gutmann
Viktor Dukhovni writes: >So I'd like to see the text in the first paragraph changed to a SHOULD or >worst-case a qualified "MUST whenever possible". Why is that whole thing even there in the first place? From the previous discussions where this came up, the pretty much universal consensus was

Re: [TLS] Draft 18 certificate signature algorithm requirements

2016-11-30 Thread Viktor Dukhovni
> On Nov 30, 2016, at 10:51 PM, Eric Rescorla wrote: > > > > On Wed, Nov 30, 2016 at 9:50 PM, Viktor Dukhovni > wrote: > > The current text reads: > >Section 4.4.1.2 ( > https://tools.ietf.org/html/draft-ietf-tls-tls13-18#page-56 ) > >All certificates provided by the server MUST

Re: [TLS] Draft 18 certificate signature algorithm requirements

2016-11-30 Thread Eric Rescorla
On Wed, Nov 30, 2016 at 9:50 PM, Viktor Dukhovni wrote: > > We've discussed this before, and the current state of the text is > certainly much improved. I'd like to touch on one final point. > > The current text reads: > >Section 4.4.1.2 ( https://tools.ietf.org/html/ > draft-ietf-tls-tls13-

[TLS] Draft 18 certificate signature algorithm requirements

2016-11-30 Thread Viktor Dukhovni
We've discussed this before, and the current state of the text is certainly much improved. I'd like to touch on one final point. The current text reads: Section 4.4.1.2 ( https://tools.ietf.org/html/draft-ietf-tls-tls13-18#page-56 ) All certificates provided by the server MUST be signed