Skip to content

Remove requirement to use PSS, consistent with suggestion from DavidBen #1399

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Remove requirement to use PSS, consistent with suggestion from DavidBen #1399

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions draft-ietf-tls-rfc8446bis.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3300,9 +3300,7 @@ MUST be one of those present in the supported_signature_algorithms
field of the "signature_algorithms" extension in the CertificateRequest message.

In addition, the signature algorithm MUST be compatible with the key
in the sender's end-entity certificate. RSA signatures MUST use an
RSASSA-PSS algorithm, regardless of whether RSASSA-PKCS1-v1_5 algorithms
appear in "signature_algorithms". The SHA-1 algorithm MUST NOT be used
in the sender's end-entity certificate. The SHA-1 algorithm MUST NOT be used
in any signatures of CertificateVerify messages.
All SHA-1 signature algorithms in this specification are defined solely
for use in legacy certificates and are not valid for CertificateVerify
Expand Down