RFC Errata


Errata Search

 
Source of RFC  
Summary Table Full Records

RFC 8422, "Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier", August 2018

Note: This RFC has been updated by RFC 8996

Source of RFC: tls (sec)

Errata ID: 8179
Status: Reported
Type: Technical
Publication Format(s) : TEXT

Reported By: warren.wang
Date Reported: 2024-11-16

Section 5.4. Server Key Exc says:

   The ServerKeyExchange message is extended as follows.

           enum {
               ec_diffie_hellman
           } KeyExchangeAlgorithm;

   o  ec_diffie_hellman: Indicates the ServerKeyExchange message
      contains an ECDH public key.

      select (KeyExchangeAlgorithm) {
          case ec_diffie_hellman:
              ServerECDHParams    params;
              Signature           signed_params;
      } ServerKeyExchange;

.....................................................

        enum {
            ecdsa(3),
            ed25519(7)
            ed448(8)
        } SignatureAlgorithm;
        select (SignatureAlgorithm) {
           case ecdsa:
                digitally-signed struct {
                    opaque sha_hash[sha_size];
                };
           case ed25519,ed448:
                digitally-signed struct {
                    opaque rawdata[rawdata_size];
                };
        } Signature;
      ServerKeyExchange.signed_params.sha_hash
          SHA(ClientHello.random + ServerHello.random +
                                 ServerKeyExchange.params);
      ServerKeyExchange.signed_params.rawdata
          ClientHello.random + ServerHello.random +
                                 ServerKeyExchange.params;

   NOTE: SignatureAlgorithm is "rsa" for the ECDHE_RSA key exchange
   algorithm and "anonymous" for ECDH_anon.  These cases are defined in
   TLS.  SignatureAlgorithm is "ecdsa" or "eddsa" for ECDHE_ECDSA.

It should say:

The extended ServerKeyExchange message seems just for tls version 1.0 and version 1.1, not for 1.2, because tls version 1.2 ServerKeyExchange message format is different from version 1.0 and 1.1. The following is tls version 1.2 ServerKeyExchange message format:

 struct {
 select (KeyExchangeAlgorithm) {
 case dh_anon:
 ServerDHParams params;
 case dhe_dss:
 case dhe_rsa:
 ServerDHParams params;
 digitally-signed struct {
 opaque client_random[32];
 opaque server_random[32];
 ServerDHParams params;
 } signed_params;
 case rsa:
 case dh_dss:
 case dh_rsa:
 struct {} ;
 /* message is omitted for rsa, dh_dss, and dh_rsa */
 /* may be extended, e.g., for ECDH -- see [TLSECC] */
 };
 } ServerKeyExchange;

it does not specify the message format for ECDH_RSA and ECDH_anon, the "NOTE" in original text does not apply to tls version 1.2, because it doesn't have the "Signature" field.

Notes:

the ServerKeyExchange for ECDH_RSA and ECDH_anon should be specified for tls version 1.2.

Report New Errata



Advanced Search