cloudflare / cloudflare/tls-tris
Wrong alert returned when client doesn't provide "signature_algorithms"
- Dominant language
- Go
- Stars
- 300
- Forks
- 52
- PR merge metrics
- No merged PRs in 30d
Description
Draft of TLS 1.3 says in 4.2.3:
```
If a server is authenticating via a
certificate and the client has not sent a "signature_algorithms"
extension, then the server MUST abort the handshake with a
"missing_extension" alert (see Section 9.2).
```
Currently code doesn't send this code as "missing_extension" alert is not even on a list of alerts
Contributor guide
Research direction
Trace the server-side TLS 1.3 handshake path used when authenticating with a certificate, then inspect how alert codes are defined and selected. Compare the behavior with the quoted TLS 1.3 Section 4.2.3 requirement; done means a client omitting signature_algorithms receives a missing_extension alert.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100