What's the signature structure in TLS server key exchange message?

Question

I'm writing a TLS server. While handling ECDHE-RSA cipher suite, the server key exchange is needed. According to Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS)

    select (KeyExchangeAlgorithm) {
        case ec_diffie_hellman:
            ServerECDHParams    params;
            Signature           signed_params;
    } ServerKeyExchange;

NOTE: SignatureAlgorithm is "rsa" for the ECDHE_RSA key exchange
algorithm and "anonymous" for ECDH_anon.  These cases are defined in
TLS [2][3].

[2]   Dierks, T. and C. Allen, "The TLS Protocol Version 1.0",
     RFC 2246, January 1999.

[3]   Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS)
     Protocol Version 1.1", RFC 4346, April 2006.

So I checked TLS 1.0 & 1.1, in TLS 1.1

  struct {
      select (KeyExchangeAlgorithm) {
          case diffie_hellman:
              ServerDHParams params;
              Signature signed_params;
          case rsa:
              ServerRSAParams params;
              Signature signed_params;
      };
  } ServerKeyExchange;

  struct {
      select (SignatureAlgorithm) {
          case anonymous: struct { };
          case rsa:
              digitally-signed struct {
                  opaque md5_hash[16];
                  opaque sha_hash[20];
              };
          case dsa:
              digitally-signed struct {
                  opaque sha_hash[20];
              };
          };
      };
  } Signature;

So far as I understand, I should use:

digitally-signed struct {
    opaque md5_hash[16];
    opaque sha_hash[20];
};

And what's this digitally-signed structure? I also saw some examples using sha512, is md5 really necessary?

Thanks.

Answer 1

#Digitally-signed struct for RSA signing

And what's this digitally-signed structure?

It's defined in TLS 1.1's Section 4.7. Cryptographic Attributes:

In RSA signing, a 36-byte structure of two hashes (one SHA and one MD5) is signed (encrypted with the private key). It is encoded with PKCS #1 block type 1, as described in [PKCS1A].

#MD5 hash in digitally-signed struct

I also saw some examples using sha512, is md5 really necessary?

Yes, it is set to be this MD5/SHA-1 combination in TLS 1.1. This is something that was only changed in TLS 1.2. There the cipher suite gets to choose the hash.

From TLS 1.2's Section 1.2. Major Differences from TLS 1.1:

• The MD5/SHA-1 combination in the digitally-signed element has been replaced with a single hash. Signed elements now include a field that explicitly specifies the hash algorithm used.