cloudflare / cloudflare/tls-tris

Wrong alert returned when client doesn't provide "signature_algorithms"

Open
#100 0 comments 0 reactions 0 assignees View on GitHub
bug open for community contribution
Dominant language
Go
Stars
300
Forks
52
PR merge metrics
No merged PRs in 30d

Description

Draft of TLS 1.3 says in 4.2.3:

```
If a server is authenticating via a
certificate and the client has not sent a "signature_algorithms"
extension, then the server MUST abort the handshake with a
"missing_extension" alert (see Section 9.2).
```

Currently code doesn't send this code as "missing_extension" alert is not even on a list of alerts

Contributor guide

Open the contributing guide

Research direction

Trace the server-side TLS 1.3 handshake path used when authenticating with a certificate, then inspect how alert codes are defined and selected. Compare the behavior with the quoted TLS 1.3 Section 4.2.3 requirement; done means a client omitting signature_algorithms receives a missing_extension alert.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
networking, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.