{"action":"created","issue":{"url":"https://api.github.com/repos/tlswg/tls13-spec/issues/231","labels_url":"https://api.github.com/repos/tlswg/tls13-spec/issues/231/labels{/name}","comments_url":"https://api.github.com/repos/tlswg/tls13-spec/issues/231/comments","events_url":"https://api.github.com/repos/tlswg/tls13-spec/issues/231/events","html_url":"https://github.com/tlswg/tls13-spec/pull/231","id":103496152,"number":231,"title":"Shift decision to abort on unusable cert chain to client and deprecate SHA-1 for it","user":{"login":"davegarrett","id":8292199,"avatar_url":"https://avatars.githubusercontent.com/u/8292199?v=3","gravatar_id":"","url":"https://api.github.com/users/davegarrett","html_url":"https://github.com/davegarrett","followers_url":"https://api.github.com/users/davegarrett/followers","following_url":"https://api.github.com/users/davegarrett/following{/other_user}","gists_url":"https://api.github.com/users/davegarrett/gists{/gist_id}","starred_url":"https://api.github.com/users/davegarrett/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davegarrett/subscriptions","organizations_url":"https://api.github.com/users/davegarrett/orgs","repos_url":"https://api.github.com/users/davegarrett/repos","events_url":"https://api.github.com/users/davegarrett/events{/privacy}","received_events_url":"https://api.github.com/users/davegarrett/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/tlswg/tls13-spec/labels/New%20PR%20needed","name":"New PR needed","color":"5319e7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-08-27T12:21:16Z","updated_at":"2015-09-13T04:05:44Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/tlswg/tls13-spec/pulls/231","html_url":"https://github.com/tlswg/tls13-spec/pull/231","diff_url":"https://github.com/tlswg/tls13-spec/pull/231.diff","patch_url":"https://github.com/tlswg/tls13-spec/pull/231.patch"},"body":"@ekr: Another chunk that was split off of the prior PR with results of list discussions. If you intend to release draft-08 soon, then this may be too late for that, though it doesn't have anything that hasn't been discussed in detail and I can make changes if needed.\r\n\r\nThe changes here are:\r\nSHA-1 is a SHOULD NOT with clients doing so for TLS 1.2 compat required to prioritize it last\r\nSHA-1 is a MUST NOT for servers, unless there is no other option, in which case it MAY give it a try\r\nMD5 is a flat MUST NOT, because it's garbage (especially by itself)\r\nthe client gets the final call on server cert chains to avoid aborts that could've worked\r\n(the language of this last part was ironed out heavily in list discussions with Viktor Dukhovni)\r\n\r\nAllowing the client to have the final say also makes it vaguely possible to attempt to debug it, as opposed to a server returning an error that could mean pretty much anything.\r\n"},"comment":{"url":"https://api.github.com/repos/tlswg/tls13-spec/issues/comments/139843171","html_url":"https://github.com/tlswg/tls13-spec/pull/231#issuecomment-139843171","issue_url":"https://api.github.com/repos/tlswg/tls13-spec/issues/231","id":139843171,"user":{"login":"davegarrett","id":8292199,"avatar_url":"https://avatars.githubusercontent.com/u/8292199?v=3","gravatar_id":"","url":"https://api.github.com/users/davegarrett","html_url":"https://github.com/davegarrett","followers_url":"https://api.github.com/users/davegarrett/followers","following_url":"https://api.github.com/users/davegarrett/following{/other_user}","gists_url":"https://api.github.com/users/davegarrett/gists{/gist_id}","starred_url":"https://api.github.com/users/davegarrett/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davegarrett/subscriptions","organizations_url":"https://api.github.com/users/davegarrett/orgs","repos_url":"https://api.github.com/users/davegarrett/repos","events_url":"https://api.github.com/users/davegarrett/events{/privacy}","received_events_url":"https://api.github.com/users/davegarrett/received_events","type":"User","site_admin":false},"created_at":"2015-09-13T04:05:44Z","updated_at":"2015-09-13T04:05:44Z","body":"The newest language ( https://github.com/davegarrett/tls13-spec/commit/a79b9393fad161ab8412afcb9a05dd0147cfe6a3 ) just says it's NOT RECOMMENDED to support, which is just a restating of what's said in the updated \"Signature Algorithms\". It shouldn't be offered, but may be for back compat. The second sentence just says that if it's rejected, the error must be sent. The third is unchanged as it's just a recommendation to transition ASAP. There's no longer a mention of \"SHOULD accept\" in this commit. I'm saying that I don't think it needs to specially mention that it should accept SHA-1 if it was offered; that's a given. I don't think we need to add a special note to say that it MUST accept it if offered. The PR overall lets the client make whatever decisions it needs here, and as you said, there are other reasons to reject."}}