New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
crypto/tls: advertise full SHA suite in SignatureHashAlgorithm #9757
Comments
Please take a look at https://github.com/golang/go/blob/master/CONTRIBUTING.md.
Seems like this issue is similar to #8190. |
on OS X 10.9.5. That issue points to the fix I'd suggest as well, however you can check the source to see that it didn't make it into go1.4.1. |
I think the reason sha512/384 arr not advised is that they are rarely used, However, it makes sense that if the program does import crypto/sha512, |
|
CL https://golang.org/cl/9415 mentions this issue. |
CL https://golang.org/cl/9472 mentions this issue. |
Prior to TLS 1.2, the handshake had a pleasing property that one could incrementally hash it and, from that, get the needed hashes for both the CertificateVerify and Finished messages. TLS 1.2 introduced negotiation for the signature and hash and it became possible for the handshake hash to be, say, SHA-384, but for the CertificateVerify to sign the handshake with SHA-1. The problem is that one doesn't know in advance which hashes will be needed and thus the handshake needs to be buffered. Go ignored this, always kept a single handshake hash, and any signatures over the handshake had to use that hash. However, there are a set of servers that inspect the client's offered signature hash functions and will abort the handshake if one of the server's certificates is signed with a hash function outside of that set. https://robertsspaceindustries.com/ is an example of such a server. Clearly not a lot of thought happened when that server code was written, but its out there and we have to deal with it. This change decouples the handshake hash from the CertificateVerify hash. This lays the groundwork for advertising support for SHA-384 but doesn't actually make that change in the interests of reviewability. Updating the advertised hash functions will cause changes in many of the testdata/ files and some errors might get lost in the noise. This change only needs to update four testdata/ files: one because a SHA-384-based handshake is now being signed with SHA-256 and the others because the TLS 1.2 CertificateRequest message now includes SHA-1. This change also has the effect of adding support for client-certificates in SSLv3 servers. However, SSLv3 is now disabled by default so this should be moot. It would be possible to avoid much of this change and just support SHA-384 for the ServerKeyExchange as the SKX only signs over the nonces and SKX params (a design mistake in TLS). However, that would leave Go in the odd situation where it advertised support for SHA-384, but would only use the handshake hash when signing client certificates. I fear that'll just cause problems in the future. Much of this code was written by davidben@ for the purposes of testing BoringSSL. Partly addresses #9757 Change-Id: I5137a472b6076812af387a5a69fc62c7373cd485 Reviewed-on: https://go-review.googlesource.com/9415 Run-TryBot: Adam Langley <agl@golang.org> Reviewed-by: Adam Langley <agl@golang.org>
This is the second in a two-part change. See https://golang.org/cl/9415 for details of the overall change. This change updates the supported signature algorithms to include SHA-384 and updates all the testdata/ files accordingly. Even some of the testdata/ files named “TLS1.0” and “TLS1.1” have been updated because they have TLS 1.2 ClientHello's even though the server picks a lower version. Fixes golang#9757. Change-Id: Ia76de2b548d3b39cd4aa3f71132b0da7c917debd Reviewed-on: https://go-review.googlesource.com/9472 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
This is the second in a two-part change. See https://golang.org/cl/9415 for details of the overall change. This change updates the supported signature algorithms to include SHA-384 and updates all the testdata/ files accordingly. Even some of the testdata/ files named “TLS1.0” and “TLS1.1” have been updated because they have TLS 1.2 ClientHello's even though the server picks a lower version. Fixes golang#9757. Change-Id: Ia76de2b548d3b39cd4aa3f71132b0da7c917debd Reviewed-on: https://go-review.googlesource.com/9472 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
A simple Go client connecting to a server via TLS1.2 advertises supported algorithms as the equivalent of
openssl s_client -sigalgs RSA+SHA256:ECDSA+SHA256:RSA+SHA1:ECDSA+SHA1 -tls1_2
, while it should be capable of more. An excerpt of theClientHello
sent from the client is below:The server (a web load balancing appliance), which has an RSA+SHA256 certificate and a bundled RSA+SHA384 intermediary perhaps reasonably responds with an
alert(40)
(handshake_failure
), whilst internally logging "[h]andshake failure selecting certificate for foo.example.com: Certificate chain uses algorithms not supported by client". On the face of what's presented by the client, this is true.I believe this is the same issue previously reported by Michael Daffin on the golang-nuts mailing list. In that case, connecting to the specified server using a simulated string of
yields success.
I believe the GoLang TLS library should advertise the full SHA suite it supports in the SignatureHashAlgorithm.
The text was updated successfully, but these errors were encountered: