• Filippo Valsorda's avatar
    crypto/tls: disable RSA-PSS in TLS 1.2 again · 0b3a57b5
    Filippo Valsorda authored
    Signing with RSA-PSS can uncover faulty crypto.Signer implementations,
    and it can fail for (broken) small keys. We'll have to take that
    breakage eventually, but it would be nice for it to be opt-out at first.
    
    TLS 1.3 requires RSA-PSS and is opt-out in Go 1.13. Instead of making a
    TLS 1.3 opt-out influence a TLS 1.2 behavior, let's wait to add RSA-PSS
    to TLS 1.2 until TLS 1.3 is on without opt-out.
    
    Note that since the Client Hello is sent before a protocol version is
    selected, we have to advertise RSA-PSS there to support TLS 1.3.
    That means that we still support RSA-PSS on the client in TLS 1.2 for
    verifying server certificates, which is fine, as all issues arise on the
    signing side. We have to be careful not to pick (or consider available)
    RSA-PSS on the client for client certificates, though.
    
    We'd expect tests to change only in TLS 1.2:
    
        * the server won't pick PSS to sign the key exchange
          (Server-TLSv12-* w/ RSA, TestHandshakeServerRSAPSS);
        * the server won't advertise PSS in CertificateRequest
          (Server-TLSv12-ClientAuthRequested*, TestClientAuth);
        * and the client won't pick PSS for its CertificateVerify
          (Client-TLSv12-ClientCert-RSA-*, TestHandshakeClientCertRSAPSS,
          Client-TLSv12-Renegotiate* because "R" requests a client cert).
    
    Client-TLSv13-ClientCert-RSA-RSAPSS was updated because of a fix in the test.
    
    This effectively reverts 88343530.
    
    Testing was made more complex by the undocumented semantics of OpenSSL's
    -[client_]sigalgs (see openssl/openssl#9172).
    
    Updates #32425
    
    Change-Id: Iaddeb2df1f5c75cd090cc8321df2ac8e8e7db349
    Reviewed-on: https://go-review.googlesource.com/c/go/+/182339Reviewed-by: default avatarAdam Langley <agl@golang.org>
    0b3a57b5
Server-TLSv12-ALPN-NoMatch 7.18 KB