Re: [TLS] Server Signature Algorithms

[Nikos Mavrogiannopoulos <nmav at gnutls.org>]

Michael D'Errico wrote:
> There are now at least 3 instances where a TLS client needs to know the
> server's list of supported signature algorithms:
> 
>    1. to compute the signature for the CertificateVerify message
>    2. to compute the hash of the handshake messages in (1) without
>       having to hold onto all of the messages
>    3. to compute hashes for the proposed cached information extension
> 
> Rather than duplicate the list for each of these and any future needs,
> it makes sense to send it once in a server hello extension.
> 
> The simplest option would be to use the existing signature algorithms
> extension and make it symmetrical.  But if there is a deployed client
> out there that aborts a connection if it receives a signature algorithm
> extension, then a secondary option would be to create a new server-
> signature-algorithms extension which is identical in structure to the
> existing extension.

I also agree, this is an elegant solution to solve the fact that the
client needs to store all handshake messages in memory.

regards,
Nikos