1

I am currently trying to figure out what cryptographic algorithms are applicable when using mutual authentication for TLS with PKI-certificates.

So when I am intitially creating a certificate, I first create a public/private key pair. Afterwards I let some CA sign my public key with some additional information.

So if I want to use that certificate in order to authenticate at the start of a TLS session, do I have to pick an asymmetric signing algorithm to create that initial public/private key pair? An asymmetric encryption algorithm does not work? So for instance I am not allowed to use DLIES or ECIES but have to use something like ECDSA or DSA/DSS?

1

There's a bunch of questions rolled in there. Untangling:

  1. Do I have to pick an asymmetric signing algorithm to create that initial public/private key pair?
  2. An asymmetric encryption algorithm does not work?
  3. I am not allowed to use DLIES or ECIES but have to use something like ECDSA or DSA/DSS?

For starters, to see what TLS cipher suites exist, I usually go look at what openssl supports: https://www.openssl.org/docs/man1.0.2/apps/ciphers.html

There's way too much in there to reproduce here, but the basic patterns as far as your question goes are:

TLS_RSA_WITH_*
TLS_[EC]DHE_RSA_WITH_*
TLS_[EC]DHE_DSS_WITH_*
TLS_[EC]DHE_ECDSA_WITH_*

So to answer 1 and 2, you don't have to pick a signing algorithm, but currently the only asymmetric encryption algorithm with wide adoption among TLS libraries is RSA.

Similar answer for 3; RSA, DSS, ECDSA are the signing algorithms that are most guaranteed to be widely supported.

You could of course write your own openssl or JSSE crypto module to provide the cipher suite TLS_ECIES_WITH_*, but you'd run into compatibility issues pretty quick if you try to use that to talk to anything other than your own software.

  • 1
    TLS through 1.2 has server (classic)DHE-DSS (meaning DSA, for hysterical raisins) and ECDHE-ECDSA and both-RSA, but never DHE-ECDSA or ECDHE-DSS/DSA. RSA is technically the most adopted asymmetric encryption in TLS because it's the only one; DSA and ECDSA are signature-only and RSA and DSA signature have been almost universal since last century (starting with SSL3) and ECDSA very common since last decade. What's hard is to get a DSA cert from a public CA, although I've seen some in internal/enterprise setups. Some public CAs now do offer ECC(ECDSA) certs. ... – dave_thompson_085 Oct 26 '18 at 4:56
  • ... TLS1.3 changes this: keyx and auth are no longer in the ciphersuite, keyx is always (EC)DHE or PSK, and server cert is controlled by client sigalgs. In all versions, client cert is controlled (only) by server certreq and yes all 3 are now common. – dave_thompson_085 Oct 26 '18 at 4:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.