2

I'm writing a TLS server. While handling ECDHE-RSA cipher suite, the server key exchange is needed. According to Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS)

    select (KeyExchangeAlgorithm) {
        case ec_diffie_hellman:
            ServerECDHParams    params;
            Signature           signed_params;
    } ServerKeyExchange;

NOTE: SignatureAlgorithm is "rsa" for the ECDHE_RSA key exchange
algorithm and "anonymous" for ECDH_anon.  These cases are defined in
TLS [2][3].

[2]   Dierks, T. and C. Allen, "The TLS Protocol Version 1.0",
     RFC 2246, January 1999.

[3]   Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS)
     Protocol Version 1.1", RFC 4346, April 2006.

So I checked TLS 1.0 & 1.1, in TLS 1.1

  struct {
      select (KeyExchangeAlgorithm) {
          case diffie_hellman:
              ServerDHParams params;
              Signature signed_params;
          case rsa:
              ServerRSAParams params;
              Signature signed_params;
      };
  } ServerKeyExchange;

  struct {
      select (SignatureAlgorithm) {
          case anonymous: struct { };
          case rsa:
              digitally-signed struct {
                  opaque md5_hash[16];
                  opaque sha_hash[20];
              };
          case dsa:
              digitally-signed struct {
                  opaque sha_hash[20];
              };
          };
      };
  } Signature;

So far as I understand, I should use:

digitally-signed struct {
    opaque md5_hash[16];
    opaque sha_hash[20];
};

And what's this digitally-signed structure? I also saw some examples using sha512, is md5 really necessary?

Thanks.

2

Digitally-signed struct for RSA signing

And what's this digitally-signed structure?

It's defined in TLS 1.1's Section 4.7. Cryptographic Attributes:

In RSA signing, a 36-byte structure of two hashes (one SHA and one MD5) is signed (encrypted with the private key). It is encoded with PKCS #1 block type 1, as described in [PKCS1A].

MD5 hash in digitally-signed struct

I also saw some examples using sha512, is md5 really necessary?

Yes, it is set to be this MD5/SHA-1 combination in TLS 1.1. This is something that was only changed in TLS 1.2. There the cipher suite gets to choose the hash.

From TLS 1.2's Section 1.2. Major Differences from TLS 1.1:

  • The MD5/SHA-1 combination in the digitally-signed element has been replaced with a single hash. Signed elements now include a field that explicitly specifies the hash algorithm used.
  • Thank you for the answer. After checked PKCS1A, I found Using SHA2 Algorithms with Cryptographic Message Syntax is quite useful. I'm trying to understand the meaning of id-sha512: 30 0b 06 09 60 86 48 01 65 03 04 02 03. 30 means 'sequence' in ASN.1, 0b is the length(11), 06 means 'object identifier', 09 is the length(9), but what is this 60 86 48? I can guess the later sequence 01 65 03 04 02 03 means 'organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 3'. – Wise Simpson Jun 29 '15 at 14:53
  • No real idea. Best put it in a new, separate question. – StackzOfZtuff Jun 29 '15 at 15:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.