Do not offer DSA sigalgs or other forbidden parameters with TLS 1.3
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 30.8k
- Forks
- 11.5k
- Avg merge
- 10m
- Merged PRs (30d)
- 1
Description
As noted in #13863 we are in violation of RFC 8446 by offering DSA sigalgs along with TLS 1.3. That issue is (in my understanding) targeting 3.0.0, to ensure that we accurately document our (non-)compliance to RFC 8446.
As noted in #14037 we do not actually want to make the breaking behavior change for 3.0.0, since we are trying to minimize changes in that release even if our policy does allow making them. So, this is a separate issue to track this change for the subsequent release that allows breaking changes.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No implementation file or test is named. Start by reading RFC 8446 and the related issues #13863 and #14037, then locate the TLS 1.3 code that offers signature algorithms and other parameters. Done means forbidden parameters, including DSA signature algorithms, are no longer offered with TLS 1.3 while the behavior change is kept separate from the 3.0.0 release.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100