TLS 1.3 Cipher Suites: authentication algorithm unspecified?

Question

I was looking at Cipher Suites indicated on SSLLabs and I noticed something, here is a result for google.com (for instance):

With TLS 1.2, examples of Cipher Suites are:

• TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: in which I understand that the server authentication part is done using ECDSA, the session ephemeral key is established using ECDHE, the symmetric encryption algorithm is AES_128_GCM and the message authentication is using SHA256
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: in which the difference is that the server authentication is performed using RSA

First, is that interpretation correct?

Now, with TLS 1.3 I see Cipher Suites like TLS_AES_128_GCM_SHA256 which do not mention a public/private key algorithm (e.g. RSA, ECDSA).

What is the server authentication algorithm used in this case and why is it not specified in the Cipher Suite?

Answer 1

From "Major Differences from TLS 1.2" in the RFC:

The cipher suite concept has been changed to separate the authentication and key exchange mechanisms from the record protection algorithm (including secret key length) and a hash to be used with both the key derivation function and handshake message authentication code (MAC)

See "Protocol Overview" section of RFC for overview.

See "Cryptographic Negotiation" subsection of Handshake section of the RFC about the TLS handshake.

The FFDHE was changed to only support named groups (no custom groups like those produced by openssl dhparam), but in practice nobody uses FFDHE, so you get to specify X25519 or NISP P-256, P-384, P-521. See "Supported Groups Extension" section of the RFC for supported values.

The signatures used in practice are ECDSA with NIST P-256 and RSA PKCS#1 v1.5 and RSASSA-PSS. TLS1.3 changed the requirement to produce RSASSA-PSS signature using the private key of the end-entity certificate if the public key is of RSA type (regardless of the signatures in the certificates themselves). See "Signature Algorithm Extension" section of the RFC for supported values.