Issue metadata
Sign in to add a comment
|
X.509 key usage extensions aren't enforced for RSA in TLS <= 1.2 |
||||||||||||||||||
Issue descriptionFor historical reasons, we don't enforce the cipher-specific key usage bit for RSA keys in TLS 1.2 and below. Contrary to some proposals, enforcing the key usage does *not* solve the Bleichenbacher attack. Any client which still supports the deprecated static RSA mode (including ourselves, alas) talking to a server vulnerable to it could be attacked just by selecting one of those ciphers. Nonetheless, this is a good thing to enforce, to keep the ecosystem honest and perhaps in preparation for future when this isn't completely useless. We enforce it for ECDSA at all versions and RSA starting TLS 1.3, but RSA in TLS 1.2 will require metrics to see what the breakage is. E.g., an antivirus MITM which copies key usage bits on a digitalSignature-only key but switches from ECDHE_RSA to static RSA will break.
,
Dec 15 2017
Metrics are in. Will check back again mid January to get an initial read on the situation. Though this would mostly be about whether we need to tweak the metrics. I don't think I'd trust data here that wasn't on stable.
,
Jan 15 2018
The NextAction date has arrived: 2018-01-15
,
Jan 23 2018
Early metrics suggest that enforcing this for known roots should be feasible. Unknown roots might also, but there's some indication that things will break. We'll follow the metrics as they get to beta and stable and see how they look.
,
Jun 20 2018
,
Jun 25 2018
The NextAction date has arrived: 2018-06-25
,
Jun 25 2018
Stable is consistent with comment #4. Enforcing it for known roots is solid. Enforcing for unknown roots should also be doable, but we probably should go through some temporary admin policy to be thorough. I'll block this on issue #347402 , so we can more sanely condition it on the known root bit. |
|||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||
Comment 1 by bugdroid1@chromium.org
, Dec 15 2017